◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

systemd-ukify-selinux

maintainer IooNag · 19 votes · base systemd-selinux · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The flagged privileged install refers to standard systemd operations like enabling services and managing system users, which are normal for a system package and not malicious.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged privileged install refers to standard systemd operations like enabling services and managing system users, which are normal for a system package and not malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • PKGBUILD:300 install -d -o root -g root -m 2755 "$pkgdir"/var/log/journal

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Christian Hesse <mail@eworm.de>
2# SELinux Maintainer: Nicolas Iooss (nicolas <dot> iooss <at> m4x <dot> org)
3# SELinux Contributor: Timothée Ravier <tim@siosm.fr>
4# SELinux Contributor: Nicky726 <Nicky726@gmail.com>
5#
6# This PKGBUILD is maintained on https://github.com/archlinuxhardened/selinux.
7# If you want to help keep it up to date, please open a Pull Request there.
8
9# ➡️ Pushing pre-releases to [core-testing] can cause havoc, especially
10# as all [core] packages are built there, and may be moved before.
11# Anyway, pre-release packages may be available in my personal testing
12# repository. Brave souls add it with:
13# [eworm-testing]
14# SigLevel = Required
15# Server = https://pkgbuild.com/~eworm/$repo/$arch/
16
17pkgbase=systemd-selinux
18pkgname=('systemd-selinux'
19 'systemd-libs-selinux'
20 'systemd-resolvconf-selinux'
21 'systemd-sysvcompat-selinux'
22 'systemd-tests-selinux'
23 'systemd-ukify-selinux')
24# Upstream versioning is incompatible with pacman's version comparisons, one
25# way or another. We use proper version for pacman here (no dash for rc
26# release!), and change in source array below.
27pkgver=261.2
28pkgrel=1
29arch=('x86_64' 'aarch64')
30license=('LGPL-2.1-or-later')
31url='https://www.github.com/systemd/systemd'
32groups=('selinux')
33makedepends=('acl' 'apparmor' 'cryptsetup' 'docbook-xsl' 'gperf' 'lz4' 'xz' 'pam-selinux' 'libelf'
34 'intltool' 'iptables' 'kmod' 'libarchive' 'libidn2' 'libgcrypt'
35 'libmicrohttpd' 'libxcrypt' 'libxslt' 'util-linux' 'linux-api-headers'
36 'python-jinja' 'python-lxml' 'quota-tools' 'shadow-selinux' 'git'
37 'meson' 'libseccomp' 'pcre2' 'audit' 'kexec-tools' 'libxkbcommon'
38 'bash-completion' 'p11-kit' 'systemd' 'libfido2' 'tpm2-tss' 'rsync'
39 'bpf' 'libbpf' 'clang' 'llvm' 'curl' 'gnutls' 'python-pyelftools'
40 'libpwquality' 'qrencode' 'lib32-gcc-libs' 'python-pefile' 'linux-headers' 'libselinux')
41conflicts=("mkinitcpio<38-1")
42validpgpkeys=('63CDA1E5D3FC22B998D20DD6327F26951A015CC4' # Lennart Poettering <lennart@poettering.net>
43 'A9EA9081724FFAE0484C35A1A81CEA22BC8C7E2E' # Luca Boccassi <luca.boccassi@gmail.com>
44 '9A774DB5DB996C154EBBFBFDA0099A18E29326E1' # Yu Watanabe <watanabe.yu+github@gmail.com>
45 '5C251B5FC54EB2F80F407AAAC54CA336CFEB557E') # Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
46# For pacman's version comparisons $pkgver is missing the dash that would be
47# in an upstream rc version so add it back when fetching the tag from github.
48source=("git+https://github.com/systemd/systemd#tag=v${pkgver/rc/-rc}?signed"
49 '0001-Use-Arch-Linux-device-access-groups.patch'
50 # bootloader files
51 'arch.conf'
52 'loader.conf'
53 'splash-arch.bmp::https://raw.githubusercontent.com/archlinux/svntogit-packages/391c1f5d4a18d08be809caa08c769ef9cded28db/trunk/splash-arch.bmp'
54 # pam configuration
55 'systemd-user.pam'
56 # pacman / libalpm hooks
57 'systemd-hook'
58 '20-systemd-sysusers.hook'
59 '21-systemd-tmpfiles.hook'
60 '25-systemd-binfmt.hook'
61 '25-systemd-catalog.hook'
62 '25-systemd-hwdb.hook'
63 '25-systemd-sysctl.hook'
64 '30-systemd-daemon-reload-system.hook'
65 '30-systemd-daemon-reload-user.hook'
66 '35-systemd-enqueue-marked.hook'
67 '35-systemd-udev-reload.hook'
68 '35-systemd-update.hook')
69sha512sums=('1c2a3aed0b7c613040722ef1bd063a1f35d2f3993e0f678701ef5e4d42d31628804df477158e5fa2bb47e523a9969d01cfb7622762cf32ff44e0367e5f432368'
70 'ddb9401e47d0bf01874f255803a4b2167ec631484189d29d03694101fd9c77724e735f16d99c5f4ffd8061ae78839b2826ff0e0a925a6f0dbca25f2cfb271a82'
71 '61032d29241b74a0f28446f8cf1be0e8ec46d0847a61dadb2a4f096e8686d5f57fe5c72bcf386003f6520bc4b5856c32d63bf3efe7eb0bc0deefc9f68159e648'
72 '3194d1f8bff31b88a79657df83632b9224b66ca2cf8fd806a3ef35cf7a43f46c09c57f3dfd02256a99b6514a8f789b7d3bcfd7e17e00e34aa55ff0c6cedb5f01'
73 '5a1d78b5170da5abe3d18fdf9f2c3a4d78f15ba7d1ee9ec2708c4c9c2e28973469bc19386f70b3cf32ffafbe4fcc4303e5ebbd6d5187a1df3314ae0965b25e75'
74 '30a408b5491ea59ec6ff6e773ea587fe12900c9b8169a0e16451d1cc6a452f2424e6ce1ee595448ff009b88fcbadf4cc4ae70a553235bae4a31aa1ec12a0c777'
75 'f2f9c8de7fc10c84f8ad4b3286c6878d35cf80ac9841a55759db46f40e69b012b2d6a6638fb107a442c6e545558f864af1477f701bc0693dc452772be232b7a7'
76 '299dcc7094ce53474521356647bdd2fb069731c08d14a872a425412fcd72da840727a23664b12d95465bf313e8e8297da31259508d1c62cc2dcea596160e21c5'
77 'da7a97d5d3701c70dd5388b0440da39006ee4991ce174777931fea2aa8c90846a622b2b911f02ae4d5fffb92680d9a7e211c308f0f99c04896278e2ee0d9a4dc'
78 '0d6bc3d928cfafe4e4e0bc04dbb95c5d2b078573e4f9e0576e7f53a8fab08a7077202f575d74a3960248c4904b5f7f0661bf17dbe163c524ab51dd30e3cb80f7'
79 '2b50b25e8680878f7974fa9d519df7e141ca11c4bfe84a92a5d01bb193f034b1726ea05b3c0030bad1fbda8dbb78bf1dc7b73859053581b55ba813c39b27d9dc'
80 'a1661ab946c6cd7d3c6251a2a9fd68afe231db58ce33c92c42594aedb5629be8f299ba08a34713327b373a3badd1554a150343d8d3e5dfb102999c281bd49154'
81 '9426829605bbb9e65002437e02ed54e35c20fdf94706770a3dc1049da634147906d6b98bf7f5e7516c84068396a12c6feaf72f92b51bdf19715e0f64620319de'
82 'a436d3f5126c6c0d6b58c6865e7bd38dbfbfb7babe017eeecb5e9d162c21902cbf4e0a68cf3ac2f99815106f9fa003b075bd2b4eb5d16333fa913df6e2f3e32a'
83 '190112e38d5a5c0ca91b89cd58f95595262a551530a16546e1d84700fc9644aa2ca677953ffff655261e8a7bff6e6af4e431424df5f13c00bc90b77c421bc32d'
84 '51ebf20a1c93c2a86e8ced0d68e91f4a2bf6a537a2d674e05da69961d5861213159e28f228ffdc897bed721abd61ff133f49aeb0a9ebbbe76020c5b847c2a2df'
85 'a50d202a9c2e91a4450b45c227b295e1840cc99a5e545715d69c8af789ea3dd95a03a30f050d52855cabdc9183d4688c1b534eaa755ebe93616f9d192a855ee3'
86 '825b9dd0167c072ba62cabe0677e7cd20f2b4b850328022540f122689d8b25315005fa98ce867cf6e7460b2b26df16b88bb3b5c9ebf721746dce4e2271af7b97')
87
88_meson_version="${pkgver}-${pkgrel}"
89_systemd_src_dir="${pkgbase/-selinux}"
90
91if ((_systemd_UPSTREAM)); then
92 _meson_version="${pkgver}"
93fi
94
95# Some heuristics to detect that we are building on OBS, with no network access. Skip
96# git verification, and use the OBS-provided tarball instead. The sources will be
97# unpacked by OBS in $package-$version/
98# SELinux package maintenance note: ignore this, as skipping any form of validation is dangerous
99#if [ -f /.build/build.dist ] && [ -d /usr/src/packages/SOURCES ] && [ -d /usr/src/packages/BUILD ] && [ -d /usr/src/packages/OTHER ]; then
100# source[0]="$(find . -name "${pkgbase}-${pkgver}.tar.*" -print -quit)"
101# sha512sums[0]='SKIP'
102# _systemd_src_dir="${pkgbase}-${pkgver}"
103#fi
104
105_backports=(
106)
107
108_reverts=(
109)
110
111prepare() {
112 cd "${_systemd_src_dir}"
113
114 # return if not a git repository
115 if ! git status >/dev/null 2>&1; then
116 return
117 fi
118
119 local _c _l
120 for _c in "${_backports[@]}"; do
121 if [[ "${_c}" == *..* ]]; then _l='--reverse'; else _l='--max-count=1'; fi
122 git log --oneline "${_l}" "${_c}"
123 git cherry-pick --mainline 1 --no-commit "${_c}"
124 done
125 for _c in "${_reverts[@]}"; do
126 if [[ "${_c}" == *..* ]]; then _l='--reverse'; else _l='--max-count=1'; fi
127 git log --oneline "${_l}" "${_c}"
128 git revert --mainline 1 --no-commit "${_c}"
129 done
130
131 # Replace cdrom/dialout/tape groups with optical/uucp/storage
132 patch -Np1 -i ../0001-Use-Arch-Linux-device-access-groups.patch
133}
134
135build() {
136 local _timeservers=({0..3}.arch.pool.ntp.org)
137 local _nameservers=(
138 # We use these public name services, ordered by their privacy policy (hopefully):
139 # * Quad9 (https://quad9.net/privacy/policy/)
140 '9.9.9.9#dns.quad9.net'
141 '2620:fe::9#dns.quad9.net'
142 # * Cloudflare (https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/)
143 '1.1.1.1#cloudflare-dns.com'
144 '2606:4700:4700::1111#cloudflare-dns.com'
145 # * Google (https://developers.google.com/speed/public-dns/privacy)
146 '8.8.8.8#dns.google'
147 '2001:4860:4860::8888#dns.google'
148 # You do not agree? Fine, change it in your local configuration.
149 )
150
151 local _meson_options=(
152 -Dversion-tag="${_meson_version}-arch"
153 -Dvcs-tag=false
154 -Dshared-lib-tag="${_meson_version}"
155 -Dmode=release
156
157 -Dapparmor=enabled
158 -Dbootloader=enabled
159 -Dxenctrl=disabled
160 -Dbpf-framework=enabled
161 -Dima=false
162 -Dinstall-tests=true
163 -Dlibidn2=enabled
164 -Dlz4=enabled
165 -Dman=enabled
166 -Dselinux=enabled
167 -Dsshdprivsepdir=/usr/share/empty.sshd
168 -Dsysupdated=enabled
169 -Dvmlinux-h=provided
170 -Dvmlinux-h-path=/usr/src/linux/vmlinux.h
171
172 -Dcompat-sysv-interfaces=false
173 -Ddbuspolicydir=/usr/share/dbus-1/system.d
174 -Ddefault-dnssec=no
175 -Ddefault-kill-user-processes=false
176 -Ddefault-locale='C.UTF-8'
177 -Dlocalegen-path=/usr/bin/locale-gen
178 -Ddns-over-tls=openssl
179 -Dfallback-hostname='archlinux'
180 -Dnologin-path=/usr/bin/nologin
181 -Dntp-servers="${_timeservers[*]}"
182 -Ddns-servers="${_nameservers[*]}"
183 -Drpmmacrosdir=no
184
185 -Dsbat-distro='arch'
186 -Dsbat-distro-summary='Arch Linux'
187 -Dsbat-distro-pkgname="${pkgname}"
188 -Dsbat-distro-version="${pkgver}"
189 -Dsbat-distro-url="https://aur.archlinux.org/packages/${pkgname}/"
190 )
191
192 arch-meson "${_systemd_src_dir}" build "${_meson_options[@]}" $MESON_EXTRA_CONFIGURE_OPTIONS
193
194 meson compile -C build
195}
196
197check() {
198 meson test -C build --print-errorlogs
199}
200
201package_systemd-selinux() {
202 pkgdesc='system and service manager with SELinux support'
203 license+=(
204 'CC0-1.0' # siphash
205 'GPL-2.0-or-later' # udev
206 'MIT-0' # documentation and config files
207 )
208 depends=(
209 "systemd-libs-selinux=${pkgver}"
210 'acl' 'bash' 'cryptsetup' 'dbus'
211 'dbus-units' 'kbd' 'kmod' 'hwdata'
212 'libgcrypt' 'libxcrypt' 'libidn2' 'lz4' 'pam-selinux'
213 'libelf' 'libseccomp' 'util-linux-selinux' 'xz' 'pcre2' 'audit'
214 'openssl')
215 provides=('nss-myhostname' "systemd-tools=$pkgver" "udev=$pkgver"
216 "${pkgname/-selinux}=${pkgver}-${pkgrel}")
217 conflicts=('nss-myhostname' 'systemd-tools' 'udev'
218 "${pkgname/-selinux}" 'selinux-systemd')
219 optdepends=(
220 'apparmor: additional security features'
221 'curl: systemd-journal-upload, machinectl pull-tar and pull-raw'
222 'gnutls: systemd-journal-gatewayd and systemd-journal-remote'
223 'iptables: firewall features'
224 'libarchive: convert DDIs to tarballs'
225 'libbpf: support BPF programs'
226 'libfido2: unlocking LUKS2 volumes with FIDO2 token'
227 'libmicrohttpd: systemd-journal-gatewayd and systemd-journal-remote'
228 'libp11-kit: support PKCS#11'
229 'libpwquality: check password quality'
230 'polkit: allow administration as unprivileged user'
231 'qemu-base: systemd-vmspawn'
232 'qrencode: show QR codes'
233 'quota-tools: kernel-level quota management'
234 'systemd-sysvcompat: symlink package to provide sysvinit binaries'
235 'systemd-ukify: combine kernel and initrd into a signed Unified Kernel Image'
236 'tpm2-tss: unlocking LUKS2 volumes with TPM2')
237 backup=(etc/systemd/coredump.conf
238 etc/systemd/homed.conf
239 etc/systemd/journald.conf
240 etc/systemd/journal-remote.conf
241 etc/systemd/journal-upload.conf
242 etc/systemd/logind.conf
243 etc/systemd/networkd.conf
244 etc/systemd/oomd.conf
245 etc/systemd/pstore.conf
246 etc/systemd/resolved.conf
247 etc/systemd/sleep.conf
248 etc/systemd/system.conf
249 etc/systemd/timesyncd.conf
250 etc/systemd/user.conf
251 etc/udev/iocost.conf
252 etc/udev/udev.conf)
253 install=systemd.install
254
255 meson install -C build --no-rebuild --destdir "$pkgdir" --quiet
256
257 # runtime libraries shipped with systemd-libs
258 install -d -m0755 systemd-libs/lib/
259 mv "$pkgdir"/usr/lib/lib{nss,systemd,udev}*.so* systemd-libs/lib/
260 mv "$pkgdir"/usr/lib/pkgconfig systemd-libs/lib/pkgconfig
261 mv "$pkgdir"/usr/include systemd-libs/include
262 mv "$pkgdir"/usr/share/man/man3 systemd-libs/man3
263 install -d -m0755 systemd-libs/man8/
264 mv "$pkgdir"/usr/share/man/man8/*nss* systemd-libs/man8/
265
266 # ukify shipped in separate package
267 install -d -m0755 systemd-ukify/{bin,systemd,man1,install.d}
268 mv "$pkgdir"/usr/bin/ukify systemd-ukify/bin/
269 mv "$pkgdir"/usr/lib/systemd/ukify systemd-ukify/systemd/
270 mv "$pkgdir"/usr/share/man/man1/ukify.1 systemd-ukify/man1/
271 # we move the ukify hook itself, but keep 90-uki-copy.install in place,
272 # because there are other ways to generate UKIs w/o ukify, e.g. w/ mkinitcpio
273 mv "$pkgdir"/usr/lib/kernel/install.d/60-ukify.install systemd-ukify/install.d
274
275 # manpages shipped with systemd-sysvcompat
276 rm "$pkgdir"/usr/share/man/man1/init.1
277 rm "$pkgdir"/usr/share/man/man8/{halt,poweroff,reboot,shutdown}.8
278
279 # executable (symlinks) shipped with systemd-sysvcompat
280 rm "$pkgdir"/usr/bin/{halt,init,poweroff,reboot,shutdown}
281
282 # files shipped with systemd-resolvconf
283 rm "$pkgdir"/usr/{bin/resolvconf,share/man/man1/resolvconf.1}
284
285 # tests shipped with systemd-tests (for upstream)
286 install -d -m0755 systemd-tests/
287 mv "$pkgdir"/usr/lib/systemd/tests systemd-tests/
288
289 # avoid a potential conflict with [core]/filesystem
290 rm "$pkgdir"/usr/share/factory/etc/{issue,nsswitch.conf}
291 sed -i -e '/^C \/etc\/nsswitch\.conf/d' \
292 -e '/^C \/etc\/issue/d' "$pkgdir"/usr/lib/tmpfiles.d/etc.conf
293
294 # ship default policy to leave services disabled
295 echo 'disable *' >"$pkgdir"/usr/lib/systemd/system-preset/99-default.preset
296
297 # The group 'systemd-journal' is allocated dynamically and may have varying
298 # gid on different systems. Let's install with gid 0 (root), systemd-tmpfiles
299 # will fix the permissions for us. (see /usr/lib/tmpfiles.d/systemd.conf)
300 install -d -o root -g root -m 2755 "$pkgdir"/var/log/journal
301
302 # add example bootctl configuration
303 install -D -m0644 arch.conf "$pkgdir"/usr/share/systemd/bootctl/arch.conf
304 install -D -m0644 loader.conf "$pkgdir"/usr/share/systemd/bootctl/loader.conf
305 install -D -m0644 splash-arch.bmp "$pkgdir"/usr/share/systemd/bootctl/splash-arch.bmp
306
307 # pacman hooks
308 install -D -m0755 systemd-hook "$pkgdir"/usr/share/libalpm/scripts/systemd-hook
309 install -D -m0644 -t "$pkgdir"/usr/share/libalpm/hooks *.hook
310
311 # overwrite the systemd-user PAM configuration with our own
312 install -D -m0644 systemd-user.pam "$pkgdir"/usr/lib/pam.d/systemd-user
313
314 # create a directory for cryptsetup keys
315 install -d -m0700 "$pkgdir"/etc/cryptsetup-keys.d
316
317 # handle uncommon license
318 install -d -m0755 "$pkgdir/usr/share/licenses/$pkgbase"
319 ln -s -t "$_" /usr/share/doc/systemd/LICENSES/MIT-0.txt
320
321 # symlink kernel-install to installkernel
322 ln -s kernel-install "$pkgdir"/usr/bin/installkernel
323 ln -s kernel-install.8.gz "$pkgdir"/usr/share/man/man8/installkernel.8.gz
324}
325
326package_systemd-libs-selinux() {
327 pkgdesc='systemd client libraries with SELinux support'
328 depends=('glibc' 'libgcc' 'libgcc_s.so' 'libgcrypt' 'lz4' 'xz' 'zstd' 'libselinux')
329 license+=(
330 'CC0-1.0' # siphash
331 'GPL-2.0-or-later WITH Linux-syscall-note' # src/basic/linux/*
332 )
333 provides=('libsystemd' 'libsystemd.so' 'libudev.so'
334 'libsystemd-selinux'
335 "${pkgname/-selinux}=${pkgver}-${pkgrel}")
336 conflicts=('libsystemd' 'libsystemd-selinux' "${pkgname/-selinux}")
337 replaces=('libsystemd-selinux')
338
339 install -d -m0755 "$pkgdir"/usr/share/man
340 mv systemd-libs/lib "$pkgdir"/usr/lib
341 mv systemd-libs/include "$pkgdir"/usr/include
342 mv systemd-libs/man3 "$pkgdir"/usr/share/man/man3
343 mv systemd-libs/man8 "$pkgdir"/usr/share/man/man8
344}
345
346package_systemd-resolvconf-selinux() {
347 pkgdesc='systemd resolvconf replacement with SELinux support (for use with systemd-resolved)'
348 depends=("systemd-selinux=${pkgver}")
349 provides=('openresolv' 'resolvconf' "${pkgname/-selinux}=${pkgver}-${pkgrel}")
350 conflicts=('resolvconf' "${pkgname/-selinux}=${pkgver}-${pkgrel}")
351
352 install -d -m0755 "$pkgdir"/usr/bin
353 ln -s resolvectl "$pkgdir"/usr/bin/resolvconf
354
355 install -d -m0755 "$pkgdir"/usr/share/man/man1
356 ln -s resolvectl.1.gz "$pkgdir"/usr/share/man/man1/resolvconf.1.gz
357}
358
359package_systemd-sysvcompat-selinux() {
360 pkgdesc='sysvinit compat for systemd with SELinux support'
361 conflicts=('sysvinit' "${pkgname/-selinux}" 'selinux-systemd-sysvcompat')
362 depends=("systemd-selinux=${pkgver}")
363 provides=("${pkgname/-selinux}=${pkgver}-${pkgrel}"
364 "selinux-systemd-sysvcompat=${pkgver}-${pkgrel}")
365
366 install -D -m0644 -t "$pkgdir"/usr/share/man/man1 \
367 build/man/init.1
368 install -D -m0644 -t "$pkgdir"/usr/share/man/man8 \
369 build/man/{halt,poweroff,reboot,shutdown}.8
370
371 install -d -m0755 "$pkgdir"/usr/bin
372 ln -s ../lib/systemd/systemd "$pkgdir"/usr/bin/init
373 for tool in halt poweroff reboot shutdown; do
374 ln -s systemctl "$pkgdir"/usr/bin/$tool
375 done
376}
377
378package_systemd-tests-selinux() {
379 pkgdesc='systemd tests with SELinux support'
380 provides=("${pkgname/-selinux}=${pkgver}-${pkgrel}")
381 depends=("systemd-selinux=${pkgver}")
382
383 install -d -m0755 "$pkgdir"/usr/lib/systemd
384 mv systemd-tests/tests "$pkgdir"/usr/lib/systemd/tests
385}
386
387package_systemd-ukify-selinux() {
388 pkgdesc='Combine kernel and initrd into a signed Unified Kernel Image with SELinux support'
389 provides=('ukify' "${pkgname/-selinux}=${pkgver}-${pkgrel}")
390 depends=("systemd-selinux=${pkgver}" 'binutils' 'python-cryptography' 'python-pefile')
391 optdepends=('python-pillow: Show the size of splash image'
392 'sbsigntools: Sign the embedded kernel')
393
394 install -d -m0755 "$pkgdir"/usr/{lib/kernel,share/man}
395 mv systemd-ukify/bin "$pkgdir"/usr/bin
396 mv systemd-ukify/systemd "$pkgdir"/usr/lib/systemd
397 mv systemd-ukify/man1 "$pkgdir"/usr/share/man/man1
398 mv systemd-ukify/install.d "$pkgdir"/usr/lib/kernel/install.d
399}
400
401# vim:ft=sh syn=sh et sw=2:
402

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -24,7 +24,7 @@
# Upstream versioning is incompatible with pacman's version comparisons, one
# way or another. We use proper version for pacman here (no dash for rc
# release!), and change in source array below.
-pkgver=259.3
+pkgver=261.2
pkgrel=1
arch=('x86_64' 'aarch64')
license=('LGPL-2.1-or-later')
@@ -63,16 +63,16 @@
'25-systemd-sysctl.hook'
'30-systemd-daemon-reload-system.hook'
'30-systemd-daemon-reload-user.hook'
- '35-systemd-restart-marked.hook'
+ '35-systemd-enqueue-marked.hook'
'35-systemd-udev-reload.hook'
'35-systemd-update.hook')
-sha512sums=('78885e2f6e95bc99007493c97bc97ac93f27e6b18218097dd4a3a9d1edb8cb7c8ae130e15b71685fc3ee0324d8006721ae48097ec7a1878d46e9f4fa66604055'
+sha512sums=('1c2a3aed0b7c613040722ef1bd063a1f35d2f3993e0f678701ef5e4d42d31628804df477158e5fa2bb47e523a9969d01cfb7622762cf32ff44e0367e5f432368'
'ddb9401e47d0bf01874f255803a4b2167ec631484189d29d03694101fd9c77724e735f16d99c5f4ffd8061ae78839b2826ff0e0a925a6f0dbca25f2cfb271a82'
'61032d29241b74a0f28446f8cf1be0e8ec46d0847a61dadb2a4f096e8686d5f57fe5c72bcf386003f6520bc4b5856c32d63bf3efe7eb0bc0deefc9f68159e648'
'3194d1f8bff31b88a79657df83632b9224b66ca2cf8fd806a3ef35cf7a43f46c09c57f3dfd02256a99b6514a8f789b7d3bcfd7e17e00e34aa55ff0c6cedb5f01'
'5a1d78b5170da5abe3d18fdf9f2c3a4d78f15ba7d1ee9ec2708c4c9c2e28973469bc19386f70b3cf32ffafbe4fcc4303e5ebbd6d5187a1df3314ae0965b25e75'
'30a408b5491ea59ec6ff6e773ea587fe12900c9b8169a0e16451d1cc6a452f2424e6ce1ee595448ff009b88fcbadf4cc4ae70a553235bae4a31aa1ec12a0c777'
- '05a3b19a2132c8c3048a66f2d06a9f8790e9c84c9ebdacc358456e38c5ebc8c02c542838f6aca3301f19ae83bc9fda66e701c682624dd5cf9fb119e452338a56'
+ 'f2f9c8de7fc10c84f8ad4b3286c6878d35cf80ac9841a55759db46f40e69b012b2d6a6638fb107a442c6e545558f864af1477f701bc0693dc452772be232b7a7'
'299dcc7094ce53474521356647bdd2fb069731c08d14a872a425412fcd72da840727a23664b12d95465bf313e8e8297da31259508d1c62cc2dcea596160e21c5'
'da7a97d5d3701c70dd5388b0440da39006ee4991ce174777931fea2aa8c90846a622b2b911f02ae4d5fffb92680d9a7e211c308f0f99c04896278e2ee0d9a4dc'
'0d6bc3d928cfafe4e4e0bc04dbb95c5d2b078573e4f9e0576e7f53a8fab08a7077202f575d74a3960248c4904b5f7f0661bf17dbe163c524ab51dd30e3cb80f7'
@@ -81,7 +81,7 @@
'9426829605bbb9e65002437e02ed54e35c20fdf94706770a3dc1049da634147906d6b98bf7f5e7516c84068396a12c6feaf72f92b51bdf19715e0f64620319de'
'a436d3f5126c6c0d6b58c6865e7bd38dbfbfb7babe017eeecb5e9d162c21902cbf4e0a68cf3ac2f99815106f9fa003b075bd2b4eb5d16333fa913df6e2f3e32a'
'190112e38d5a5c0ca91b89cd58f95595262a551530a16546e1d84700fc9644aa2ca677953ffff655261e8a7bff6e6af4e431424df5f13c00bc90b77c421bc32d'
- 'f6b154fdc612916d7788720cf703e34255b43ba2d19413de5f3f63f07508f4ce561ca138f987c2118c7128e1dfb01976b0ac7d5efee4d9ebaadd180e70fa013e'
+ '51ebf20a1c93c2a86e8ced0d68e91f4a2bf6a537a2d674e05da69961d5861213159e28f228ffdc897bed721abd61ff133f49aeb0a9ebbbe76020c5b847c2a2df'
'a50d202a9c2e91a4450b45c227b295e1840cc99a5e545715d69c8af789ea3dd95a03a30f050d52855cabdc9183d4688c1b534eaa755ebe93616f9d192a855ee3'
'825b9dd0167c072ba62cabe0677e7cd20f2b4b850328022540f122689d8b25315005fa98ce867cf6e7460b2b26df16b88bb3b5c9ebf721746dce4e2271af7b97')
@@ -103,8 +103,6 @@
#fi
_backports=(
- # nspawn: allow cachestat systemcall
- '93101e7ef04fe43c9c13b405047c36850a2f5382'
)
_reverts=(
@@ -112,9 +110,6 @@
prepare() {
cd "${_systemd_src_dir}"
-
- # Replace cdrom/dialout/tape groups with optical/uucp/storage
- patch -Np1 -i ../0001-Use-Arch-Linux-device-access-groups.patch
# return if not a git repository
if ! git status >/dev/null 2>&1; then
@@ -132,6 +127,9 @@
git log --oneline "${_l}" "${_c}"
git revert --mainline 1 --no-commit "${_c}"
done
+
+ # Replace cdrom/dialout/tape groups with optical/uucp/storage
+ patch -Np1 -i ../0001-Use-Arch-Linux-device-access-groups.patch
}
build() {
@@ -171,6 +169,7 @@
-Dvmlinux-h=provided
-Dvmlinux-h-path=/usr/src/linux/vmlinux.h
+ -Dcompat-sysv-interfaces=false
-Ddbuspolicydir=/usr/share/dbus-1/system.d
-Ddefault-dnssec=no
-Ddefault-kill-user-processes=false
@@ -182,8 +181,6 @@
-Dntp-servers="${_timeservers[*]}"
-Ddns-servers="${_nameservers[*]}"
-Drpmmacrosdir=no
- -Dsysvinit-path=
- -Dsysvrcnd-path=
-Dsbat-distro='arch'
-Dsbat-distro-summary='Arch Linux'
@@ -208,32 +205,35 @@
'GPL-2.0-or-later' # udev
'MIT-0' # documentation and config files
)
- depends=("systemd-libs-selinux=${pkgver}"
- 'acl' 'bash' 'cryptsetup' 'libcryptsetup.so' 'dbus'
- 'dbus-units' 'kbd' 'kmod' 'hwdata'
- 'libgcrypt' 'libxcrypt' 'libcrypt.so' 'libidn2' 'lz4' 'pam-selinux'
- 'libelf' 'libseccomp' 'util-linux-selinux' 'xz' 'pcre2' 'audit'
- 'openssl' 'libcrypto.so' 'libssl.so')
+ depends=(
+ "systemd-libs-selinux=${pkgver}"
+ 'acl' 'bash' 'cryptsetup' 'dbus'
+ 'dbus-units' 'kbd' 'kmod' 'hwdata'
+ 'libgcrypt' 'libxcrypt' 'libidn2' 'lz4' 'pam-selinux'
+ 'libelf' 'libseccomp' 'util-linux-selinux' 'xz' 'pcre2' 'audit'
+ 'openssl')
provides=('nss-myhostname' "systemd-tools=$pkgver" "udev=$pkgver"
"${pkgname/-selinux}=${pkgver}-${pkgrel}")
conflicts=('nss-myhostname' 'systemd-tools' 'udev'
"${pkgname/-selinux}" 'selinux-systemd')
- optdepends=('libmicrohttpd: systemd-journal-gatewayd and systemd-journal-remote'
- 'apparmor: additional security features'
- 'quota-tools: kernel-level quota management'
- 'systemd-sysvcompat-selinux: symlink package to provide sysvinit binaries'
- 'systemd-ukify-selinux: combine kernel and initrd into a signed Unified Kernel Image'
- 'polkit: allow administration as unprivileged user'
- 'curl: systemd-journal-upload, machinectl pull-tar and pull-raw'
- 'gnutls: systemd-journal-gatewayd and systemd-journal-remote'
- 'qrencode: show QR codes'
- 'iptables: firewall features'
- 'libarchive: convert DDIs to tarballs'
- 'libbpf: support BPF programs'
- 'libpwquality: check password quality'
- 'libfido2: unlocking LUKS2 volumes with FIDO2 token'
- 'libp11-kit: support PKCS#11'
- 'tpm2-tss: unlocking LUKS2 volumes with TPM2')
+ optdepends=(
+ 'apparmor: additional security features'
+ 'curl: systemd-journal-upload, machinectl pull-tar and pull-raw'
+ 'gnutls: systemd-journal-gatewayd and systemd-journal-remote'
+ 'iptables: firewall features'
+ 'libarchive: convert DDIs to tarballs'
+ 'libbpf: support BPF programs'
+ 'libfido2: unlocking LUKS2 volumes with FIDO2 token'
+ 'libmicrohttpd: systemd-journal-gatewayd and systemd-journal-remote'
+ 'libp11-kit: support PKCS#11'
+ 'libpwquality: check password quality'
+ 'polkit: allow administration as unprivileged user'
+ 'qemu-base: systemd-vmspawn'
+ 'qrencode: show QR codes'
+ 'quota-tools: kernel-level quota management'
+ 'systemd-sysvcompat: symlink package to provide sysvinit binaries'
+ 'systemd-ukify: combine kernel and initrd into a signed Unified Kernel Image'
+ 'tpm2-tss: unlocking LUKS2 volumes with TPM2')
backup=(etc/systemd/coredump.conf
etc/systemd/homed.conf
etc/systemd/journald.conf
@@ -254,15 +254,14 @@
meson install -C build --no-rebuild --destdir "$pkgdir" --quiet
- # we'll create this on installation
- rmdir "$pkgdir"/var/log/journal/remote
-
# runtime libraries shipped with systemd-libs
install -d -m0755 systemd-libs/lib/
mv "$pkgdir"/usr/lib/lib{nss,systemd,udev}*.so* systemd-libs/lib/
mv "$pkgdir"/usr/lib/pkgconfig systemd-libs/lib/pkgconfig
mv "$pkgdir"/usr/include systemd-libs/include
mv "$pkgdir"/usr/share/man/man3 systemd-libs/man3
+ install -d -m0755 systemd-libs/man8/
+ mv "$pkgdir"/usr/share/man/man8/*nss* systemd-libs/man8/
# ukify shipped in separate package
install -d -m0755 systemd-ukify/{bin,systemd,man1,install.d}
@@ -274,6 +273,7 @@
mv "$pkgdir"/usr/lib/kernel/install.d/60-ukify.install systemd-ukify/install.d
# manpages shipped with systemd-sysvcompat
+ rm "$pkgdir"/usr/share/man/man1/init.1
rm "$pkgdir"/usr/share/man/man8/{halt,poweroff,reboot,shutdown}.8
# executable (symlinks) shipped with systemd-sysvcompat
@@ -325,7 +325,7 @@
package_systemd-libs-selinux() {
pkgdesc='systemd client libraries with SELinux support'
- depends=('glibc' 'gcc-libs' 'libgcrypt' 'lz4' 'xz' 'zstd' 'libselinux')
+ depends=('glibc' 'libgcc' 'libgcc_s.so' 'libgcrypt' 'lz4' 'xz' 'zstd' 'libselinux')
license+=(
'CC0-1.0' # siphash
'GPL-2.0-or-later WITH Linux-syscall-note' # src/basic/linux/*
@@ -340,6 +340,7 @@
mv systemd-libs/lib "$pkgdir"/usr/lib
mv systemd-libs/include "$pkgdir"/usr/include
mv systemd-libs/man3 "$pkgdir"/usr/share/man/man3
+ mv systemd-libs/man8 "$pkgdir"/usr/share/man/man8
}
package_systemd-resolvconf-selinux() {
@@ -362,6 +363,8 @@
provides=("${pkgname/-selinux}=${pkgver}-${pkgrel}"
"selinux-systemd-sysvcompat=${pkgver}-${pkgrel}")
+ install -D -m0644 -t "$pkgdir"/usr/share/man/man1 \
+ build/man/init.1
install -D -m0644 -t "$pkgdir"/usr/share/man/man8 \
build/man/{halt,poweroff,reboot,shutdown}.8

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 21:18:45 MEDIUM 1
2026-06-18 16:11:54 CLEAN 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion