salt-onedir
MEDIUM
maintainer spookfish
4 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package installs additional Python packages via pip using a variable (SALT_ADDITIONAL_PIP_PACKAGES) which could introduce untrusted or unverified code into the build, representing a supply-chain risk if the variable is set by the user or an external source.
Triggered rules
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs additional Python packages via pip using a variable (SALT_ADDITIONAL_PIP_PACKAGES) which could introduce untrusted or unverified code into the build, representing a supply-chain risk if the variable is set by the user or an external source.
-
PKGBUILD:63
"${onedir}"/bin/pip3 install ${SALT_ADDITIONAL_PIP_PACKAGES}
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Fabian Leditzky <spookfish@ldsoft.dev>
2
# Maintainer: Sven Rueß <github@sven-ruess.de>
3
4
# Parts of this PKGBUILD are based on the PKGBUILD for extra/salt
5
6
# NOTES:
7
# - Set env var SALT_ADDITIONAL_PIP_PACKAGES for additional onedir pip packages.
8
# Example: SALT_ADDITIONAL_PIP_PACKAGES='gitpython pynacl' makepkg
9
# The additional packages are listed in the package description.
10
# - makepkg will complain about packaging issues because the .pyc files (python bytecode)
11
# contain the absolute path of the resource during the build, meaning $srcdir references
12
# are found in the final build. This does not appear to cause any real issues.
13
#
14
15
pkgname=salt-onedir
16
provides=('salt')
17
pkgver=3008.5
18
pkgrel=1
19
pkgdesc="Central system and configuration manager (onedir installation +[${SALT_ADDITIONAL_PIP_PACKAGES}])"
20
arch=('x86_64' 'aarch64')
21
url='https://saltproject.io'
22
license=('Apache-2.0')
23
replaces=('salt-zmq' 'salt-raet')
24
conflicts=('salt-zmq' 'salt-raet' 'salt')
25
depends=()
26
makedepends=('rsync')
27
optdepends=('dmidecode: decode SMBIOS/DMI tables')
28
backup=('etc/logrotate.d/salt'
29
'etc/salt/master'
30
'etc/salt/minion')
31
32
source_x86_64=("https://github.com/saltstack/salt/releases/download/v${pkgver}/salt-${pkgver}-onedir-linux-x86_64.tar.xz")
33
sha256sums_x86_64=('3bbc89d18ff1cef340bfe662d0e973db8387c9affbb0633df1645725bb63786e')
34
35
source_aarch64=("https://github.com/saltstack/salt/releases/download/v${pkgver}/salt-${pkgver}-onedir-linux-arm64.tar.xz")
36
sha256sums_aarch64=('5d8bd57c89e91a9ff5d367b023cb62e147113dd446ff31f8d6917eeda3071445')
37
38
# The source tarball is downloaded because we need various files from pkg/common that are not included in the onedir tarball
39
source=("https://github.com/saltstack/salt/releases/download/v${pkgver}/salt-${pkgver}.tar.gz"
40
salt.logrotate
41
0000-services.patch)
42
sha256sums=('0259deafd601d783721e5aa8ed10677d8c4d6cc12f5de17499af71590d593315'
43
'abecc3c1be124c4afffaaeb3ba32b60dfee8ba6dc32189edfa2ad154ecb7a215'
44
'6eb7d8840c40da7070167d3c742e7337c45f80d639fb7ef72f196fcaa2843469')
45
46
47
prepare() {
48
# Extracted salt source tarball
49
saltsrc="${srcdir}/salt-${pkgver}"
50
cd "${saltsrc}"
51
52
# patch services to run /opt/salt/bin/* binaries directly
53
# not strictly required as we symlink into /usr/bin
54
patch -Np1 -i ../0000-services.patch
55
}
56
57
build() {
58
# Extracted salt-onedir tarball
59
onedir="${srcdir}/salt"
60
61
# Add additional python deps for Salt
62
if [[ -n ${SALT_ADDITIONAL_PIP_PACKAGES} ]]; then
63
"${onedir}"/bin/pip3 install ${SALT_ADDITIONAL_PIP_PACKAGES}
64
fi
65
}
66
67
package() {
68
# Extracted salt-onedir tarball
69
onedir="${srcdir}/salt"
70
# Extracted salt source tarball
71
saltsrc="${srcdir}/salt-${pkgver}"
72
73
# Copy over our onedir package
74
mkdir "${pkgdir}"/opt
75
rsync -a "${onedir}/" "${pkgdir}"/opt/salt
76
77
# Create relative symlinks in /usr/bin for all relevant binaries
78
# These will link into the /opt/salt/bin directory
79
mkdir "${pkgdir}"/usr/bin -p
80
for bin in "${pkgdir}"/opt/salt/{salt,spm}*; do
81
ln -sr "${bin}" "${pkgdir}"/usr/bin
82
done
83
84
install -Dm644 salt.logrotate "$pkgdir"/etc/logrotate.d/salt
85
86
# Install various files from the source tarball into the package
87
cd "${saltsrc}"
88
89
# default config
90
install -v -Dm644 conf/master "$pkgdir/etc/salt/master"
91
install -v -Dm644 conf/minion "$pkgdir/etc/salt/minion"
92
93
# systemd services
94
for _svc in salt-master.service salt-syndic.service salt-minion.service salt-api.service; do
95
install -v -Dm644 pkg/common/$_svc "$pkgdir/usr/lib/systemd/system/$_svc"
96
done
97
98
# completions
99
# For some reason there is no more pkg/common/salt.bash
100
# The rpm one has the same content.
101
install -v -Dm644 pkg/rpm/salt.bash "$pkgdir/usr/share/bash-completion/completions/salt"
102
install -v -Dm644 pkg/common/salt.zsh "$pkgdir/usr/share/zsh/site-functions/_salt"
103
install -v -Dm644 -t "$pkgdir/usr/share/fish/vendor_completions.d" pkg/common/fish-completions/*
104
}
105
106
# vim:set ts=2 sw=2 et:
107
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-11-01 00:21@@ -14,7 +14,7 @@ pkgname=salt-onedir provides=('salt')-pkgver=3008.4+pkgver=3008.5 pkgrel=1 pkgdesc="Central system and configuration manager (onedir installation +[${SALT_ADDITIONAL_PIP_PACKAGES}])" arch=('x86_64' 'aarch64')@@ -30,16 +30,16 @@ 'etc/salt/minion') source_x86_64=("https://github.com/saltstack/salt/releases/download/v${pkgver}/salt-${pkgver}-onedir-linux-x86_64.tar.xz")-sha256sums_x86_64=('83652a14b1fad321220b03b71a64e4b7fdea879a7d42ea7378eabb6909383eaf')+sha256sums_x86_64=('3bbc89d18ff1cef340bfe662d0e973db8387c9affbb0633df1645725bb63786e') source_aarch64=("https://github.com/saltstack/salt/releases/download/v${pkgver}/salt-${pkgver}-onedir-linux-arm64.tar.xz")-sha256sums_aarch64=('7b514e9eb88337564ca08b90d0f2252bb237d976e48a7519f7be77c9270dc5f3')+sha256sums_aarch64=('5d8bd57c89e91a9ff5d367b023cb62e147113dd446ff31f8d6917eeda3071445') # The source tarball is downloaded because we need various files from pkg/common that are not included in the onedir tarball source=("https://github.com/saltstack/salt/releases/download/v${pkgver}/salt-${pkgver}.tar.gz" salt.logrotate 0000-services.patch)-sha256sums=('52d1ada79389bece3d73ba0315c052183829c76313bcc2b32b2f11f540cac8e7'+sha256sums=('0259deafd601d783721e5aa8ed10677d8c4d6cc12f5de17499af71590d593315' 'abecc3c1be124c4afffaaeb3ba32b60dfee8ba6dc32189edfa2ad154ecb7a215' '6eb7d8840c40da7070167d3c742e7337c45f80d639fb7ef72f196fcaa2843469') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 1 |
| 2026-10-31 00:07:41 | Medium | 1 |
| 2026-10-30 00:29:30 | Medium | 1 |
| 2026-10-29 01:51:16 | Medium | 1 |
| 2026-10-29 00:13:55 | Medium | 1 |
| 2026-10-28 00:06:54 | Medium | 1 |
| 2026-10-27 00:23:28 | Medium | 1 |
| 2026-10-26 00:12:40 | Medium | 1 |
| 2026-10-25 00:20:48 | Medium | 1 |
| 2026-10-24 07:39:45 | Medium | 1 |
| 2026-10-06 00:13:36 | Low | 1 |
| 2026-10-05 23:40:58 | Clean | 0 |
| 2026-10-05 00:08:03 | Low | 1 |
| 2026-10-04 00:18:08 | Low | 1 |
| 2026-10-03 00:23:04 | Low | 1 |
| 2026-10-02 00:00:32 | Low | 1 |
| 2026-10-01 00:02:06 | Low | 1 |
| 2026-09-30 00:20:07 | Low | 1 |
| 2026-09-29 00:07:46 | Low | 1 |
| 2026-09-28 00:28:32 | Low | 1 |