setline

LOW

maintainer chaostone 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from the project's own official GitHub source, and the .install hook only performs standard post-install housekeeping (creating a system user/group, setting directory permissions, enabling systemd units) — all normal for a daemon package. The flagged 'privileged install' patterns are legitimate useradd/groupadd/chown calls typical of system service packaging, not malicious privilege escalation. The git source has SKIP'd checksum (normal for git+), and the few votes/recent upload are minor concerns but not indicators of malice.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The package builds from the project's own official GitHub source, and the .install hook only performs standard post-install housekeeping (creating a system user/group, setting directory permissions, enabling systemd units) — all normal for a daemon package. The flagged 'privileged install' patterns are legitimate useradd/groupadd/chown calls typical of system service packaging, not malicious privilege escalation. The git source has SKIP'd checksum (normal for git+), and the few votes/recent upload are minor concerns but not indicators of malice.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:27 chmod 2775 /etc/setline 2>/dev/null || :
.install:32 chmod 2775 /var/lib/setline /var/log/setline 2>/dev/null || :

PKGBUILD

      1# 上游仓库：https://github.com/beangle/setline
    
      2# AUR 维护目录：~/aur-packages/setline（本目录）
    
      3#
    
      4# 发布新版本：上游打 tag（v0.0.4）-> 改下面 pkgver -> makepkg --printsrcinfo > .SRCINFO
    
      5# -> git add -A && git commit && git push（AUR 只接受 master 分支上的 PKGBUILD/.SRCINFO）。
    
      6#
    
      7# 版本号的唯一来源是上游 git tag（dub.json 里没有 version），所以 source 必须钉 #tag=v${pkgver}。
    
      8
    
      9pkgname=setline
    
      10pkgver=0.0.4
    
      11pkgrel=1
    
      12pkgdesc="Beangle local HTTP path router and transparent proxy"
    
      13arch=('x86_64')
    
      14url='https://github.com/beangle/setline'
    
      15license=('GPL-3.0-or-later')
    
      16# 二进制在 Arch 上静态链接 druntime/Phobos（ldc 1.42 实测 readelf -d 里既没有
    
      17# libphobos2-ldc-shared 也没有 libz），所以不需要 liblphobos/zlib。
    
      18# systemd: 安装 unit/timer，且 setline-apply 靠 systemctl reload 生效
    
      19# bash:    /usr/lib/setline/setline-apply 的解释器
    
      20depends=('bash' 'systemd')
    
      21makedepends=('ldc' 'dub' 'git')
    
      22optdepends=(
    
      23  'haproxy: edge proxy setline-apply can validate and reload'
    
      24  'nginx: edge proxy setline-apply can validate and reload'
    
      25)
    
      26install=setline.install
    
      27source=(
    
      28  "git+https://github.com/beangle/setline.git#tag=v${pkgver}"
    
      29  "setline.install"
    
      30  "setline.sysusers"
    
      31  "setline.tmpfiles"
    
      32)
    
      33sha256sums=('SKIP'
    
      34            '0ee234408bc442374e5a625cb61729317aefb950411be6b48e63f79fe75d40f0'
    
      35            '56e26acdac8b69bb99a05caf720551877cacae5f442f77c6172af5e0771f13be'
    
      36            '2c7aa9cbc587e904380b2c409275abab1b370d87de48125003ec13cc5640aa22')
    
      37
    
      38prepare() {
    
      39  cd setline
    
      40  dub fetch
    
      41}
    
      42
    
      43build() {
    
      44  cd setline
    
      45  dub build --build=release-nobounds --compiler=ldc2
    
      46}
    
      47
    
      48# 单测走内建 unittest 配置，产物是 target/beangle-setline-test-unittest，不会覆盖
    
      49# build() 产出的 target/setline（因此不必像 jstart 那样先留一份二进制）。用例只在
    
      50# 127.0.0.1 上起临时服务，chroot 受限时可整段注释。
    
      51check() {
    
      52  cd setline
    
      53  dub test --compiler=ldc2
    
      54}
    
      55
    
      56package() {
    
      57  cd setline
    
      58
    
      59  install -Dm755 target/setline "$pkgdir/usr/bin/setline"
    
      60  install -Dm755 scripts/package/setline-apply "$pkgdir/usr/lib/setline/setline-apply"
    
      61
    
      62  # /etc/setline/setline.json 由 setline.install 首次生成、不由包跟踪（理由见该文件），
    
      63  # 包里只放模板和两份示例。
    
      64  install -Dm644 scripts/package/setline.json "$pkgdir/usr/share/setline/setline.json.default"
    
      65  install -Dm644 scripts/package/apply.conf.example "$pkgdir/usr/share/setline/apply.conf.example"
    
      66  install -Dm644 scripts/package/haproxy-setline-cfgdir.conf.example "$pkgdir/usr/share/setline/haproxy-setline-cfgdir.conf.example"
    
      67
    
      68  # 文档整目录安装：unit 的 Documentation= 指向 deployment.md/agent-reload.md 等，
    
      69  # 只装其中几篇会留下打不开的死链接。
    
      70  install -Dm644 CHANGELOG.md "$pkgdir/usr/share/doc/setline/CHANGELOG.md"
    
      71  local doc
    
      72  for doc in docs/*.md; do
    
      73    install -Dm644 "$doc" "$pkgdir/usr/share/doc/setline/${doc#docs/}"
    
      74  done
    
      75
    
      76  install -Dm644 scripts/package/setline.service "$pkgdir/usr/lib/systemd/system/setline.service"
    
      77  install -Dm644 scripts/package/setline-render.service "$pkgdir/usr/lib/systemd/system/setline-render.service"
    
      78  install -Dm644 scripts/package/setline-render.timer "$pkgdir/usr/lib/systemd/system/setline-render.timer"
    
      79  install -Dm644 scripts/package/setline-apply.service "$pkgdir/usr/lib/systemd/system/setline-apply.service"
    
      80  install -Dm644 scripts/package/setline-apply.timer "$pkgdir/usr/lib/systemd/system/setline-apply.timer"
    
      81
    
      82  install -Dm644 "$srcdir/setline.sysusers" "$pkgdir/usr/lib/sysusers.d/setline.conf"
    
      83  install -Dm644 "$srcdir/setline.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/setline.conf"
    
      84
    
      85  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 11:17:57	Low	3
2026-10-16 11:16:06	Medium	2