sysforge

maintainer FrostyMalice · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The .install script creates a directory and a marker file with appropriate permissions, which is a common and safe practice for first-run configuration; the use of chgrp on a local file does not constitute a security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The .install script creates a directory and a marker file with appropriate permissions, which is a common and safe practice for first-run configuration; the use of chgrp on a local file does not constitute a security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:13 install -d -m 2775 /var/lib/sysforge 2>/dev/null || mkdir -p /var/lib/sysforge

PKGBUILD

      1# Maintainer: Keith Raghubar <aur.archlinux.org.buckskin000@passmail.net>
    
      2
    
      3pkgname=sysforge
    
      4pkgver=2.6.0
    
      5pkgrel=1
    
      6pkgdesc="Arch Linux build and maintenance suite for system setup and package management with compiler-optimized builds"
    
      7arch=('any')
    
      8url="https://github.com/KeithRaghubar/sysforge"
    
      9license=('MIT')
    
      10depends=(
    
      11    'python>=3.11'
    
      12    'git'
    
      13    'sudo'
    
      14    'gnupg'
    
      15    'base-devel'
    
      16)
    
      17makedepends=(
    
      18    'uv'
    
      19    'python-installer'
    
      20)
    
      21optdepends=(
    
      22    'bash-completion: bash tab completions'
    
      23    'ccache: compiler cache support'
    
      24    'sccache: Rust compiler cache support'
    
      25    'uv: required for bootstrap pipeline (configure stage)'
    
      26    'zsh: zsh shell support'
    
      27    'glow: in-shell markdown rendering for docs'
    
      28    'zsh-completions: additional zsh completions'
    
      29    'clang: required for the LLVM build profile and sysforge run toolchain --compiler=llvm'
    
      30    'lld: required for the optimized build profile (-fuse-ld=lld)'
    
      31    'llvm: required for sysforge run toolchain --compiler=llvm (PGO bootstrap)'
    
      32    'compiler-rt: required for sysforge run toolchain --compiler=llvm'
    
      33)
    
      34conflicts=('sysforge-git')
    
      35install=sysforge.install
    
      36backup=(
    
      37    'etc/sysforge/sysforge.toml'
    
      38    'etc/sysforge/profiles.toml'
    
      39    'etc/sysforge/packages.toml'
    
      40    'etc/sysforge/kernel.toml'
    
      41    'etc/sysforge/toolchain.toml'
    
      42)
    
      43# Maintainer release-signing key. Releases are GPG-signed (signed tag + detached
    
      44# signature of the release tarball, uploaded to the GitHub release by
    
      45# tools/release.sh); makepkg verifies the .asc below against this fingerprint.
    
      46# REPLACE the sentinel with the real 40-hex fingerprint (gpg --fingerprint);
    
      47# tools/release.sh refuses to publish while the sentinel is present.
    
      48validpgpkeys=('23774499080F9288FEFB49CE7AAE22E6E1B4B22C')
    
      49source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz"
    
      50        "$pkgname-$pkgver.tar.gz.asc::$url/releases/download/v$pkgver/sysforge-$pkgver.tar.gz.asc")
    
      51sha256sums=('8a632d24f4a11e06c0ad64257e2cd864465fa4ca2b58333bb6dff0fd25e19caa'
    
      52            'SKIP')
    
      53
    
      54build() {
    
      55    cd "$srcdir/$pkgname-$pkgver"
    
      56    uv build --wheel
    
      57}
    
      58
    
      59package() {
    
      60    cd "$srcdir/$pkgname-$pkgver"
    
      61    python -m installer --destdir="$pkgdir" dist/*.whl
    
      62
    
      63    # Man page
    
      64    install -Dm644 man/sysforge.1 "$pkgdir/usr/share/man/man1/sysforge.1"
    
      65
    
      66    # Shell completions (bash + zsh; both shells are optdeps)
    
      67    install -Dm644 completions/sysforge.bash \
    
      68        "$pkgdir/usr/share/bash-completion/completions/sysforge"
    
      69    install -Dm644 completions/_sysforge \
    
      70        "$pkgdir/usr/share/zsh/site-functions/_sysforge"
    
      71
    
      72    # Default config files
    
      73    local _conf="$pkgdir/etc/sysforge"
    
      74    install -Dm644 etc/sysforge/sysforge.toml               "$_conf/sysforge.toml"
    
      75    install -Dm644 etc/sysforge/profiles.toml               "$_conf/profiles.toml"
    
      76    install -Dm644 etc/sysforge/packages.toml               "$_conf/packages.toml"
    
      77    install -Dm644 etc/sysforge/kernel.toml                 "$_conf/kernel.toml"
    
      78    install -Dm644 etc/sysforge/toolchain.toml              "$_conf/toolchain.toml"
    
      79
    
      80    # bootstrap.toml is per-host (device, hostname, passwords) — ship as an
    
      81    # example template under /usr/share so iso-install.sh can detect a true
    
      82    # prior run instead of always seeing the package-installed default.
    
      83    install -Dm644 etc/sysforge/bootstrap.toml \
    
      84        "$pkgdir/usr/share/sysforge/bootstrap.toml.example"
    
      85
    
      86    # The sysforge group owns sysforge's writable runtime dirs so the
    
      87    # unprivileged build user (a member) can write state and the PGO cache
    
      88    # across runs. systemd-sysusers creates it before systemd-tmpfiles runs.
    
      89    install -Dm644 /dev/null "$pkgdir/usr/lib/sysusers.d/sysforge.conf"
    
      90    printf 'g sysforge -\n' > "$pkgdir/usr/lib/sysusers.d/sysforge.conf"
    
      91
    
      92    # State directory (pipeline state, build state, logs) + sentinel subdir
    
      93    # consumed by `sysforge update` from the libalpm hooks below.
    
      94    # /var/cache/sysforge holds the regenerable PGO profdata store, written by
    
      95    # the unprivileged toolchain build. All owned root:sysforge with setgid
    
      96    # (2775) so group members can write and new subdirs inherit the group —
    
      97    # the single ownership model shared with primitives/fs_provision.py.
    
      98    install -Dm644 /dev/null "$pkgdir/usr/lib/tmpfiles.d/sysforge.conf"
    
      99    {
    
      100        printf 'd /var/lib/sysforge 2775 root sysforge -\n'
    
      101        printf 'd /var/lib/sysforge/sentinels 2775 root sysforge -\n'
    
      102        printf 'd /var/cache/sysforge 2775 root sysforge -\n'
    
      103        printf 'd /var/cache/sysforge/llvm-pgo 2775 root sysforge -\n'
    
      104    } > "$pkgdir/usr/lib/tmpfiles.d/sysforge.conf"
    
      105
    
      106    # Pacman PostTransaction hooks: kernel/toolchain reminders +
    
      107    # build-state staleness signal consumed by `sysforge update`.
    
      108    install -Dm644 etc/pacman.d/hooks/sysforge-kernel.hook \
    
      109        "$pkgdir/usr/share/libalpm/hooks/sysforge-kernel.hook"
    
      110    install -Dm644 etc/pacman.d/hooks/sysforge-toolchain.hook \
    
      111        "$pkgdir/usr/share/libalpm/hooks/sysforge-toolchain.hook"
    
      112    install -Dm644 etc/pacman.d/hooks/sysforge-buildstate.hook \
    
      113        "$pkgdir/usr/share/libalpm/hooks/sysforge-buildstate.hook"
    
      114    install -Dm644 etc/pacman.d/hooks/sysforge-artifacts.hook \
    
      115        "$pkgdir/usr/share/libalpm/hooks/sysforge-artifacts.hook"
    
      116    install -Dm755 tools/pacman-hook-helper.sh \
    
      117        "$pkgdir/usr/lib/sysforge/pacman-hook-helper.sh"
    
      118}
    
      119

Changes since previous scan

--- PKGBUILD @ 2026-07-22 13:20
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Keith Raghubar <aur.archlinux.org.buckskin000@passmail.net>
 
 pkgname=sysforge
-pkgver=2.5.1
+pkgver=2.6.0
 pkgrel=1
 pkgdesc="Arch Linux build and maintenance suite for system setup and package management with compiler-optimized builds"
 arch=('any')
@@ -48,7 +48,7 @@
 validpgpkeys=('23774499080F9288FEFB49CE7AAE22E6E1B4B22C')
 source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz"
         "$pkgname-$pkgver.tar.gz.asc::$url/releases/download/v$pkgver/sysforge-$pkgver.tar.gz.asc")
-sha256sums=('baf98c36681ba41688f30317daee673e908b6c4776e17ad0aeb8a8f29f255d0a'
+sha256sums=('8a632d24f4a11e06c0ad64257e2cd864465fa4ca2b58333bb6dff0fd25e19caa'
             'SKIP')
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 17:30:22	MEDIUM	1
2026-07-25 15:29:50	MEDIUM	1
2026-07-22 13:20:28	CLEAN	0
2026-07-22 00:29:32	LOW	2
2026-07-21 21:18:19	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 15:55:03	MEDIUM	1
2026-07-17 00:06:16	LOW	2