sysforge-git
maintainer FrostyMalice
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The .install script creates a runtime directory and a marker file for first-install notice, which is benign and self-cleaned by the application; no actual privilege escalation, setuid, or self-update occurs.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The .install script creates a runtime directory and a marker file for first-install notice, which is benign and self-cleaned by the application; no actual privilege escalation, setuid, or self-update occurs.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
.install:13
install -d -m 2775 /var/lib/sysforge 2>/dev/null || mkdir -p /var/lib/sysforge
PKGBUILD
1
# Maintainer: Keith Raghubar <aur.archlinux.org.buckskin000@passmail.net>
2
3
pkgname=sysforge-git
4
pkgver=2.6.0.r0.g0000000 # updated dynamically by pkgver()
5
pkgrel=1
6
pkgdesc="Arch Linux build and maintenance suite for system setup and package management with compiler-optimized builds (git)"
7
arch=('any')
8
url="https://github.com/KeithRaghubar/sysforge"
9
license=('MIT')
10
depends=(
11
'python>=3.11'
12
'git'
13
'sudo'
14
'gnupg'
15
'base-devel'
16
)
17
makedepends=(
18
'uv'
19
'python-installer'
20
)
21
optdepends=(
22
'bash-completion: bash tab completions'
23
'ccache: compiler cache support'
24
'sccache: Rust compiler cache support'
25
'uv: required for bootstrap pipeline (configure stage)'
26
'zsh: zsh shell support'
27
'glow: in-shell markdown rendering for docs'
28
'zsh-completions: additional zsh completions'
29
'clang: required for the LLVM build profile and sysforge run toolchain --compiler=llvm'
30
'lld: required for the optimized build profile (-fuse-ld=lld)'
31
'llvm: required for sysforge run toolchain --compiler=llvm (PGO bootstrap)'
32
'compiler-rt: required for sysforge run toolchain --compiler=llvm'
33
)
34
conflicts=('sysforge')
35
provides=('sysforge')
36
install=sysforge.install
37
backup=(
38
'etc/sysforge/sysforge.toml'
39
'etc/sysforge/profiles.toml'
40
'etc/sysforge/packages.toml'
41
'etc/sysforge/kernel.toml'
42
'etc/sysforge/toolchain.toml'
43
)
44
source=("$pkgname::git+$url.git")
45
sha256sums=('SKIP')
46
47
pkgver() {
48
cd "$srcdir/$pkgname"
49
git describe --long --tags 2>/dev/null \
50
| sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' \
51
|| printf "r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
52
}
53
54
build() {
55
cd "$srcdir/$pkgname"
56
uv build --wheel
57
}
58
59
package() {
60
cd "$srcdir/$pkgname"
61
python -m installer --destdir="$pkgdir" dist/*.whl
62
63
# Man page
64
install -Dm644 man/sysforge.1 "$pkgdir/usr/share/man/man1/sysforge.1"
65
66
# Shell completions (bash + zsh; both shells are optdeps)
67
install -Dm644 completions/sysforge.bash \
68
"$pkgdir/usr/share/bash-completion/completions/sysforge"
69
install -Dm644 completions/_sysforge \
70
"$pkgdir/usr/share/zsh/site-functions/_sysforge"
71
72
# Default config files
73
local _conf="$pkgdir/etc/sysforge"
74
install -Dm644 etc/sysforge/sysforge.toml "$_conf/sysforge.toml"
75
install -Dm644 etc/sysforge/profiles.toml "$_conf/profiles.toml"
76
install -Dm644 etc/sysforge/packages.toml "$_conf/packages.toml"
77
install -Dm644 etc/sysforge/kernel.toml "$_conf/kernel.toml"
78
install -Dm644 etc/sysforge/toolchain.toml "$_conf/toolchain.toml"
79
80
# bootstrap.toml is per-host (device, hostname, passwords) — ship as an
81
# example template under /usr/share so iso-install.sh can detect a true
82
# prior run instead of always seeing the package-installed default.
83
install -Dm644 etc/sysforge/bootstrap.toml \
84
"$pkgdir/usr/share/sysforge/bootstrap.toml.example"
85
86
# The sysforge group owns sysforge's writable runtime dirs so the
87
# unprivileged build user (a member) can write state and the PGO cache
88
# across runs. systemd-sysusers creates it before systemd-tmpfiles runs.
89
install -Dm644 /dev/null "$pkgdir/usr/lib/sysusers.d/sysforge.conf"
90
printf 'g sysforge -\n' > "$pkgdir/usr/lib/sysusers.d/sysforge.conf"
91
92
# State directory (pipeline state, build state, logs) + sentinel subdir
93
# consumed by `sysforge update` from the libalpm hooks below.
94
# /var/cache/sysforge holds the regenerable PGO profdata store, written by
95
# the unprivileged toolchain build. All owned root:sysforge with setgid
96
# (2775) so group members can write and new subdirs inherit the group —
97
# the single ownership model shared with primitives/fs_provision.py.
98
install -Dm644 /dev/null "$pkgdir/usr/lib/tmpfiles.d/sysforge.conf"
99
{
100
printf 'd /var/lib/sysforge 2775 root sysforge -\n'
101
printf 'd /var/lib/sysforge/sentinels 2775 root sysforge -\n'
102
printf 'd /var/cache/sysforge 2775 root sysforge -\n'
103
printf 'd /var/cache/sysforge/llvm-pgo 2775 root sysforge -\n'
104
} > "$pkgdir/usr/lib/tmpfiles.d/sysforge.conf"
105
106
# Pacman PostTransaction hooks: kernel/toolchain reminders +
107
# build-state staleness signal consumed by `sysforge update`.
108
install -Dm644 etc/pacman.d/hooks/sysforge-kernel.hook \
109
"$pkgdir/usr/share/libalpm/hooks/sysforge-kernel.hook"
110
install -Dm644 etc/pacman.d/hooks/sysforge-toolchain.hook \
111
"$pkgdir/usr/share/libalpm/hooks/sysforge-toolchain.hook"
112
install -Dm644 etc/pacman.d/hooks/sysforge-buildstate.hook \
113
"$pkgdir/usr/share/libalpm/hooks/sysforge-buildstate.hook"
114
install -Dm755 tools/pacman-hook-helper.sh \
115
"$pkgdir/usr/lib/sysforge/pacman-hook-helper.sh"
116
}
117
Changes since previous scan
--- PKGBUILD @ 2026-07-25 00:13+++ PKGBUILD @ 2026-08-03 00:08@@ -1,7 +1,7 @@ # Maintainer: Keith Raghubar <aur.archlinux.org.buckskin000@passmail.net> pkgname=sysforge-git-pkgver=2.5.1.r0.g0000000 # updated dynamically by pkgver()+pkgver=2.6.0.r0.g0000000 # updated dynamically by pkgver() pkgrel=1 pkgdesc="Arch Linux build and maintenance suite for system setup and package management with compiler-optimized builds (git)" arch=('any')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 17:30:22 | MEDIUM | 1 |
| 2026-07-25 15:29:50 | MEDIUM | 1 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 13:20:28 | MEDIUM | 1 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 21:18:19 | MEDIUM | 1 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |