blob: 19092755e81bc3d487d4ab2a4b7bc4b73d914720 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
# Maintainer: Viet Anh Nguyen <vietanh.dev@gmail.com>
#
# AUR package for the Bulwark CLI. Built from the tagged source tarball (AUR
# prefers source builds; a -bin variant would shadow the GitHub release .deb we
# already ship). Only `bulwarkctl` is packaged — the Tauri GUI needs WebKitGTK and
# is distributed as Flatpak/Snap/AppImage instead.
pkgname=bulwarkctl
pkgver=0.8.8
pkgrel=1
pkgdesc="Linux host security and misconfiguration scanner (CLI)"
arch=('x86_64')
url="https://github.com/vietanhdev/bulwark"
license=('Apache-2.0')
depends=('gcc-libs')
makedepends=('cargo')
# !lto is required, not cosmetic. libsqlite3-sys builds SQLite from source (the
# workspace enables its `bundled` feature), and makepkg enables LTO by default, so
# the cc crate compiles sqlite3.c into LTO-bytecode objects that rustc's lld link
# cannot resolve — the build dies with "undefined symbol: sqlite3_bind_null" even
# though the bundled feature is active. Disabling LTO makes the C objects linkable.
options=('!lto')
# ClamAV powers the optional antivirus scan; everything else works without it and
# Bulwark prints a distro-aware install hint when it is absent.
optdepends=('clamav: antivirus scanning support')
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
sha256sums=('729385e9796116d0cba5d0c9fb2955accad2ff9181cbd9d97c202bb494f7a535')
prepare() {
cd "bulwark-$pkgver"
export RUSTUP_TOOLCHAIN=stable
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
}
build() {
cd "bulwark-$pkgver"
export RUSTUP_TOOLCHAIN=stable
export CARGO_TARGET_DIR=target
# -p bulwarkctl: build only the CLI and its library, never the Tauri GUI member
# (which would need WebKitGTK).
cargo build --frozen --release -p bulwarkctl
}
package() {
cd "bulwark-$pkgver"
install -Dm0755 "target/release/bulwarkctl" "$pkgdir/usr/bin/bulwarkctl"
# The rule pack is load-bearing, not dressing: on an installed system
# resolve_rules_dir falls back to /usr/share/bulwark/rules, so a package without
# it fails on every invocation.
install -d "$pkgdir/usr/share/bulwark"
cp -r rules decoders log-rules "$pkgdir/usr/share/bulwark/"
find "$pkgdir/usr/share/bulwark" -type f -exec chmod 0644 {} +
find "$pkgdir/usr/share/bulwark" -type d -exec chmod 0755 {} +
install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
install -Dm0644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
}
|