systemd-liberated-libs-git

LOW
maintainer zeakz 16 votes base systemd-liberated-git scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The flagged pattern involves post-install service enabling and systemd re-execution, which is normal for systemd packages and not inherently malicious, though it performs privileged operations during install/upgrade.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves post-install service enabling and systemd re-execution, which is normal for systemd packages and not inherently malicious, though it performs privileged operations during install/upgrade.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • PKGBUILD:269 install -d -o root -g root -m 2755 "$pkgdir"/var/log/journal

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zeakz <zeakz@protonmail.com>
2# Based on systemd-git by Thorsten Toepper <atsutane-aur at freethoughts dot de>
3# Contributor: Yurii Kolesnykov <root@yurikoles.com>
4# Based on core/systemd by Christian Hesse <mail@eworm.de>
5#
6# Liberated systemd -- systemd fork with surveillance enablement removed.
7# Upstream fork: https://github.com/Jeffrey-Sardina/systemd
8
9pkgbase=systemd-liberated-git
10pkgname=('systemd-liberated-git'
11 'systemd-liberated-libs-git'
12 'systemd-liberated-resolvconf-git'
13 'systemd-liberated-sysvcompat-git'
14 'systemd-liberated-tests-git'
15 'systemd-liberated-ukify-git')
16pkgdesc='systemd fork with surveillance enablement removed (git version)'
17pkgver=262.r90699
18pkgrel=1
19arch=('x86_64')
20license=('LGPL-2.1-or-later')
21url='https://github.com/Jeffrey-Sardina/systemd'
22
23# Mirror fallback URLs — uncomment your preferred source if GitHub is unavailable
24_url="https://github.com/Jeffrey-Sardina/systemd"
25#_url="https://codeberg.org/Jeffrey-Sardina/systemd"
26#_url="https://gitea.com/Jeffrey-Sardina/systemd"
27
28# All known mirrors (used for automatic fallback cloning in prepare())
29_mirrors=(
30 "https://github.com/Jeffrey-Sardina/systemd"
31 "https://codeberg.org/Jeffrey-Sardina/systemd"
32 "https://gitea.com/Jeffrey-Sardina/systemd"
33)
34makedepends=('acl' 'apparmor' 'cryptsetup' 'docbook-xsl' 'gperf' 'lz4' 'xz' 'pam' 'libelf'
35 'intltool' 'iptables' 'kmod' 'libarchive' 'libcap' 'libidn2' 'libgcrypt'
36 'libmicrohttpd' 'libxcrypt' 'libxslt' 'util-linux' 'linux-api-headers'
37 'python-jinja' 'python-lxml' 'quota-tools' 'shadow' 'git'
38 'meson' 'libseccomp' 'pcre2' 'audit' 'kexec-tools' 'libxkbcommon'
39 'bash-completion' 'p11-kit' 'systemd' 'libfido2' 'tpm2-tss' 'rsync'
40 'bpf' 'libbpf' 'clang' 'llvm' 'curl' 'gnutls' 'python-pyelftools'
41 'libpwquality' 'qrencode' 'lib32-gcc-libs' 'python-pefile' 'linux-headers')
42conflicts=("mkinitcpio<38-1")
43options=('!strip')
44source=("${pkgbase}::git+${_url}"
45 '0001-Use-Arch-Linux-device-access-groups.patch'
46 # bootloader files
47 'arch.conf'
48 'loader.conf'
49 'splash-arch.bmp'::'https://gitlab.archlinux.org/archlinux/packaging/packages/systemd/-/raw/main/splash-arch.bmp'
50 # pam configuration
51 'systemd-user.pam'
52 # pacman / libalpm hooks
53 'systemd-hook'
54 '20-systemd-sysusers.hook'
55 '30-systemd-binfmt.hook'
56 '30-systemd-catalog.hook'
57 '30-systemd-daemon-reload-system.hook'
58 '30-systemd-daemon-reload-user.hook'
59 '30-systemd-hwdb.hook'
60 '30-systemd-restart-marked.hook'
61 '30-systemd-sysctl.hook'
62 '30-systemd-tmpfiles.hook'
63 '30-systemd-udev-reload.hook'
64 '30-systemd-update.hook')
65sha512sums=('SKIP'
66 '91112cd9aa7e396d6b77c2dc4418347df1febd747e38223bde98f8ffe5d619f82c8cc16a8b3debfba1633b4c48c255ebc11438da309262cfc73aa897451b5b87'
67 '61032d29241b74a0f28446f8cf1be0e8ec46d0847a61dadb2a4f096e8686d5f57fe5c72bcf386003f6520bc4b5856c32d63bf3efe7eb0bc0deefc9f68159e648'
68 '3194d1f8bff31b88a79657df83632b9224b66ca2cf8fd806a3ef35cf7a43f46c09c57f3dfd02256a99b6514a8f789b7d3bcfd7e17e00e34aa55ff0c6cedb5f01'
69 '5a1d78b5170da5abe3d18fdf9f2c3a4d78f15ba7d1ee9ec2708c4c9c2e28973469bc19386f70b3cf32ffafbe4fcc4303e5ebbd6d5187a1df3314ae0965b25e75'
70 '32580b82e97573d3e499821e2ce415ff134c0ec52c9b44a3c0862c4007d347f55636d6afac3dfc6831a9b384c7448075bdf3a12f369b4d8b62b24dfdb9c8a76a'
71 '05a3b19a2132c8c3048a66f2d06a9f8790e9c84c9ebdacc358456e38c5ebc8c02c542838f6aca3301f19ae83bc9fda66e701c682624dd5cf9fb119e452338a56'
72 '299dcc7094ce53474521356647bdd2fb069731c08d14a872a425412fcd72da840727a23664b12d95465bf313e8e8297da31259508d1c62cc2dcea596160e21c5'
73 '0d6bc3d928cfafe4e4e0bc04dbb95c5d2b078573e4f9e0576e7f53a8fab08a7077202f575d74a3960248c4904b5f7f0661bf17dbe163c524ab51dd30e3cb80f7'
74 '2b50b25e8680878f7974fa9d519df7e141ca11c4bfe84a92a5d01bb193f034b1726ea05b3c0030bad1fbda8dbb78bf1dc7b73859053581b55ba813c39b27d9dc'
75 'a436d3f5126c6c0d6b58c6865e7bd38dbfbfb7babe017eeecb5e9d162c21902cbf4e0a68cf3ac2f99815106f9fa003b075bd2b4eb5d16333fa913df6e2f3e32a'
76 '190112e38d5a5c0ca91b89cd58f95595262a551530a16546e1d84700fc9644aa2ca677953ffff655261e8a7bff6e6af4e431424df5f13c00bc90b77c421bc32d'
77 'a1661ab946c6cd7d3c6251a2a9fd68afe231db58ce33c92c42594aedb5629be8f299ba08a34713327b373a3badd1554a150343d8d3e5dfb102999c281bd49154'
78 'f6b154fdc612916d7788720cf703e34255b43ba2d19413de5f3f63f07508f4ce561ca138f987c2118c7128e1dfb01976b0ac7d5efee4d9ebaadd180e70fa013e'
79 '9426829605bbb9e65002437e02ed54e35c20fdf94706770a3dc1049da634147906d6b98bf7f5e7516c84068396a12c6feaf72f92b51bdf19715e0f64620319de'
80 'da7a97d5d3701c70dd5388b0440da39006ee4991ce174777931fea2aa8c90846a622b2b911f02ae4d5fffb92680d9a7e211c308f0f99c04896278e2ee0d9a4dc'
81 'a50d202a9c2e91a4450b45c227b295e1840cc99a5e545715d69c8af789ea3dd95a03a30f050d52855cabdc9183d4688c1b534eaa755ebe93616f9d192a855ee3'
82 '825b9dd0167c072ba62cabe0677e7cd20f2b4b850328022540f122689d8b25315005fa98ce867cf6e7460b2b26df16b88bb3b5c9ebf721746dce4e2271af7b97')
83
84pkgver() {
85 cd "$pkgbase"
86 # Strip everything from ~ or . onwards (e.g. "261~devel" -> "261")
87 local _major=$(sed 's/[~.].*//g' meson.version)
88 printf "%s.r%s" "${_major}" "$(git rev-list --count HEAD)"
89}
90
91prepare() {
92 # If the primary clone failed or is empty, try mirrors in order
93 if [[ ! -d "${pkgbase}/.git" ]]; then
94 echo "==> Primary source unavailable, trying mirrors..."
95 for _mirror in "${_mirrors[@]}"; do
96 echo " -> Trying ${_mirror}..."
97 if git clone "$_mirror" "${pkgbase}"; then
98 echo " -> Cloned from ${_mirror}"
99 break
100 fi
101 done
102 fi
103
104 cd "${pkgbase}"
105
106 # Replace cdrom/dialout/tape groups with optical/uucp/storage
107 patch -Np1 -i ../0001-Use-Arch-Linux-device-access-groups.patch
108}
109
110build() {
111 local _timeservers=({0..3}.arch.pool.ntp.org)
112 local _nameservers=(
113 # We use these public name services, ordered by their privacy policy (hopefully):
114 # * Quad9 (https://quad9.net/privacy/policy/)
115 '9.9.9.9#dns.quad9.net'
116 '2620:fe::9#dns.quad9.net'
117 # * Cloudflare (https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/)
118 '1.1.1.1#cloudflare-dns.com'
119 '2606:4700:4700::1111#cloudflare-dns.com'
120 # * Google (https://developers.google.com/speed/public-dns/privacy)
121 '8.8.8.8#dns.google'
122 '2001:4860:4860::8888#dns.google'
123 # You do not agree? Fine, change it in your local configuration.
124 )
125
126 local _meson_options=(
127 -Dversion-tag="${pkgver}-${pkgrel}-arch"
128 -Dvcs-tag=true
129 -Dshared-lib-tag="${pkgver}-${pkgrel}"
130
131 -Dapparmor=enabled
132 -Dbootloader=enabled
133 -Dxenctrl=disabled
134 -Dbpf-framework=enabled
135 -Dima=false
136 -Dinstall-tests=true
137 -Dlibidn2=enabled
138 -Dlz4=enabled
139 -Dman=enabled
140 -Dselinux=disabled
141 -Dsshdprivsepdir=/usr/share/empty.sshd
142 -Dvmlinux-h=provided
143 -Dvmlinux-h-path=/usr/src/linux/vmlinux.h
144
145 -Ddbuspolicydir=/usr/share/dbus-1/system.d
146 -Ddefault-dnssec=no
147 -Ddefault-kill-user-processes=false
148 -Ddefault-locale='C.UTF-8'
149 -Dlocalegen-path=/usr/bin/locale-gen
150 -Ddns-over-tls=openssl
151 -Dfallback-hostname='archlinux'
152 -Dnologin-path=/usr/bin/nologin
153 -Dntp-servers="${_timeservers[*]}"
154 -Ddns-servers="${_nameservers[*]}"
155 -Drpmmacrosdir=no
156 -Dsysvinit-path=
157 -Dsysvrcnd-path=
158
159 -Dsbat-distro='arch'
160 -Dsbat-distro-summary='Arch Linux AUR'
161 -Dsbat-distro-pkgname="${pkgname}"
162 -Dsbat-distro-version="${pkgver}"
163 -Dsbat-distro-url="https://aur.archlinux.org/pkgbase/systemd-liberated-git"
164 )
165
166 arch-meson "${pkgbase}" build "${_meson_options[@]}"
167
168 meson compile -C build
169}
170
171check() {
172 meson test -C build --print-errorlogs
173}
174
175package_systemd-liberated-git() {
176 pkgdesc='system and service manager — liberated fork (no surveillance, git version)'
177 license+=(
178 'CC0-1.0' # siphash
179 'GPL-2.0-or-later' # udev
180 'MIT-0' # documentation and config files
181 )
182 depends=("systemd-liberated-libs-git=${pkgver}"
183 'acl' 'libacl.so' 'bash' 'cryptsetup' 'libcryptsetup.so' 'dbus'
184 'dbus-units' 'kbd' 'kmod' 'hwdata' 'libcap' 'libcap.so'
185 'libgcrypt' 'libxcrypt' 'libcrypt.so' 'libidn2' 'lz4' 'pam'
186 'libelf' 'libseccomp' 'libseccomp.so' 'util-linux' 'libblkid.so'
187 'libmount.so' 'xz' 'pcre2' 'audit' 'libaudit.so'
188 'openssl' 'libcrypto.so' 'libssl.so')
189 provides=('nss-myhostname' "systemd-tools=${pkgver}" "udev=${pkgver}")
190 provides+=("systemd=${pkgver}" "systemd-git=${pkgver}")
191 replaces=('nss-myhostname' 'systemd-tools' 'udev')
192 conflicts=('nss-myhostname' 'systemd-tools' 'udev')
193 conflicts+=('systemd' 'systemd-git')
194 optdepends=('libmicrohttpd: systemd-journal-gatewayd and systemd-journal-remote'
195 'apparmor: additional security features'
196 'quota-tools: kernel-level quota management'
197 'systemd-liberated-sysvcompat-git: symlink package to provide sysvinit binaries'
198 "systemd-liberated-ukify-git=${pkgver}: combine kernel and initrd into a signed Unified Kernel Image"
199 'polkit: allow administration as unprivileged user'
200 'curl: systemd-journal-upload, machinectl pull-tar and pull-raw'
201 'gnutls: systemd-journal-gatewayd and systemd-journal-remote'
202 'qrencode: show QR codes'
203 'iptables: firewall features'
204 'libarchive: convert DDIs to tarballs'
205 'libbpf: support BPF programs'
206 'libpwquality: check password quality'
207 'libfido2: unlocking LUKS2 volumes with FIDO2 token'
208 'libp11-kit: support PKCS#11'
209 'tpm2-tss: unlocking LUKS2 volumes with TPM2')
210 backup=(etc/systemd/coredump.conf
211 etc/systemd/homed.conf
212 etc/systemd/journald.conf
213 etc/systemd/journal-remote.conf
214 etc/systemd/journal-upload.conf
215 etc/systemd/logind.conf
216 etc/systemd/networkd.conf
217 etc/systemd/oomd.conf
218 etc/systemd/pstore.conf
219 etc/systemd/resolved.conf
220 etc/systemd/sleep.conf
221 etc/systemd/system.conf
222 etc/systemd/timesyncd.conf
223 etc/systemd/user.conf
224 etc/udev/iocost.conf
225 etc/udev/udev.conf)
226 install=systemd.install
227
228 meson install -C build --no-rebuild --destdir "${pkgdir}"
229
230 # we'll create this on installation
231 # Remove only if it exists; upstream may or may not create it depending on meson flags
232 [[ -d "$pkgdir"/var/log/journal/remote ]] && rmdir "$pkgdir"/var/log/journal/remote
233
234 # runtime libraries shipped with systemd-liberated-libs-git
235 install -d -m0755 systemd-libs/lib/
236 mv "$pkgdir"/usr/lib/lib{nss,systemd,udev}*.so* systemd-libs/lib/
237 mv "$pkgdir"/usr/lib/pkgconfig systemd-libs/lib/pkgconfig
238 mv "$pkgdir"/usr/include systemd-libs/include
239 mv "$pkgdir"/usr/share/man/man3 systemd-libs/man3
240
241 # ukify shipped in separate package
242 install -d -m0755 systemd-ukify/{bin,systemd,man1,install.d}
243 mv "$pkgdir"/usr/bin/ukify systemd-ukify/bin/
244 mv "$pkgdir"/usr/lib/systemd/ukify systemd-ukify/systemd/
245 mv "$pkgdir"/usr/share/man/man1/ukify.1 systemd-ukify/man1/
246 mv "$pkgdir"/usr/lib/kernel/install.d/60-ukify.install systemd-ukify/install.d
247
248 # manpages shipped with systemd-liberated-sysvcompat-git
249 rm "$pkgdir"/usr/share/man/man8/{halt,poweroff,reboot,shutdown}.8
250
251 # executable (symlinks) shipped with systemd-liberated-sysvcompat-git
252 rm "$pkgdir"/usr/bin/{halt,init,poweroff,reboot,shutdown}
253
254 # files shipped with systemd-liberated-resolvconf-git
255 rm "$pkgdir"/usr/{bin/resolvconf,share/man/man1/resolvconf.1}
256
257 # tests shipped with systemd-liberated-tests-git
258 install -d -m0755 systemd-tests/
259 mv "$pkgdir"/usr/lib/systemd/tests systemd-tests/
260
261 # avoid a potential conflict with [core]/filesystem
262 rm "$pkgdir"/usr/share/factory/etc/{issue,nsswitch.conf}
263 sed -i -e '/^C \/etc\/nsswitch\.conf/d' \
264 -e '/^C \/etc\/issue/d' "$pkgdir"/usr/lib/tmpfiles.d/etc.conf
265
266 # ship default policy to leave services disabled
267 echo 'disable *' >"$pkgdir"/usr/lib/systemd/system-preset/99-default.preset
268
269 install -d -o root -g root -m 2755 "$pkgdir"/var/log/journal
270
271 # add example bootctl configuration
272 install -D -m0644 arch.conf "$pkgdir"/usr/share/systemd/bootctl/arch.conf
273 install -D -m0644 loader.conf "$pkgdir"/usr/share/systemd/bootctl/loader.conf
274 install -D -m0644 splash-arch.bmp "$pkgdir"/usr/share/systemd/bootctl/splash-arch.bmp
275
276 # pacman hooks
277 install -D -m0755 systemd-hook "$pkgdir"/usr/share/libalpm/scripts/systemd-hook
278 install -D -m0644 -t "$pkgdir"/usr/share/libalpm/hooks *.hook
279
280 # overwrite the systemd-user PAM configuration with our own
281 install -D -m0644 systemd-user.pam "$pkgdir"/usr/lib/pam.d/systemd-user
282
283 # create a directory for cryptsetup keys
284 install -d -m0700 "$pkgdir"/etc/cryptsetup-keys.d
285
286 # handle uncommon license
287 install -d -m0755 "$pkgdir/usr/share/licenses/$pkgbase"
288 ln -s -t "$_" /usr/share/doc/systemd/LICENSES/MIT-0.txt
289}
290
291package_systemd-liberated-libs-git() {
292 pkgdesc='systemd client libraries — liberated fork (git version)'
293 depends=('glibc' 'gcc-libs' 'libcap' 'libgcrypt' 'lz4' 'xz' 'zstd')
294 license+=(
295 'CC0-1.0' # siphash
296 'GPL-2.0-or-later WITH Linux-syscall-note' # src/basic/linux/*
297 )
298 provides=('libsystemd' 'libsystemd.so' 'libudev.so')
299 provides+=("systemd-libs=${pkgver}" "systemd-libs-git=${pkgver}")
300 conflicts=('libsystemd' 'systemd-libs' 'systemd-libs-git')
301 replaces=('libsystemd')
302
303 install -d -m0755 "$pkgdir"/usr/share/man
304 mv systemd-libs/lib "$pkgdir"/usr/lib
305 mv systemd-libs/include "$pkgdir"/usr/include
306 mv systemd-libs/man3 "$pkgdir"/usr/share/man/man3
307}
308
309package_systemd-liberated-resolvconf-git() {
310 pkgdesc='systemd resolvconf replacement — liberated fork (git version)'
311 depends=("systemd-liberated-git=${pkgver}")
312 provides=('openresolv' 'resolvconf')
313 provides+=("systemd-resolvconf=${pkgver}" "systemd-resolvconf-git=${pkgver}")
314 conflicts=('resolvconf' 'systemd-resolvconf' 'systemd-resolvconf-git')
315
316 install -d -m0755 "$pkgdir"/usr/bin
317 ln -s resolvectl "$pkgdir"/usr/bin/resolvconf
318
319 install -d -m0755 "$pkgdir"/usr/share/man/man1
320 ln -s resolvectl.1.gz "$pkgdir"/usr/share/man/man1/resolvconf.1.gz
321}
322
323package_systemd-liberated-sysvcompat-git() {
324 pkgdesc='sysvinit compat for systemd — liberated fork (git version)'
325 conflicts=('sysvinit' 'systemd-sysvcompat' 'systemd-sysvcompat-git')
326 depends=("systemd-liberated-git=${pkgver}")
327 provides=("systemd-sysvcompat=${pkgver}" "systemd-sysvcompat-git=${pkgver}")
328
329 install -D -m0644 -t "$pkgdir"/usr/share/man/man8 \
330 build/man/{halt,poweroff,reboot,shutdown}.8
331
332 install -d -m0755 "$pkgdir"/usr/bin
333 ln -s ../lib/systemd/systemd "$pkgdir"/usr/bin/init
334 for tool in halt poweroff reboot shutdown; do
335 ln -s systemctl "$pkgdir"/usr/bin/$tool
336 done
337}
338
339package_systemd-liberated-tests-git() {
340 pkgdesc='systemd tests — liberated fork (git version)'
341 conflicts=('systemd-tests' 'systemd-tests-git')
342 provides=("systemd-tests=${pkgver}" "systemd-tests-git=${pkgver}")
343 depends=("systemd=${pkgver}")
344
345 install -d -m0755 "$pkgdir"/usr/lib/systemd
346 mv systemd-tests/tests "$pkgdir"/usr/lib/systemd/tests
347}
348
349package_systemd-liberated-ukify-git() {
350 pkgdesc='Combine kernel and initrd into a signed UKI — liberated fork (git version)'
351 conflicts=('systemd-ukify' 'systemd-ukify-git')
352 provides=('ukify')
353 provides+=("systemd-ukify=${pkgver}" "systemd-ukify-git=${pkgver}")
354 depends=("systemd-liberated-git=${pkgver}" 'binutils' 'python-cryptography' 'python-pefile')
355 optdepends=('python-pillow: Show the size of splash image'
356 'sbsigntools: Sign the embedded kernel')
357
358 install -d -m0755 "$pkgdir"/usr/{lib/kernel,share/man}
359 mv systemd-ukify/bin "$pkgdir"/usr/bin
360 mv systemd-ukify/systemd "$pkgdir"/usr/lib/systemd
361 mv systemd-ukify/man1 "$pkgdir"/usr/share/man/man1
362 mv systemd-ukify/install.d "$pkgdir"/usr/lib/kernel/install.d
363}
364
365# vim:ft=sh syn=sh et sw=2:
366

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion