Arch Linux User Repository

adguardhome.service checksum fails while building. Kindly fix this.

Hi @lyk,

I believe the sha256sums in the PKGBUILD are correct, they match exactly the ones you listed and the upstream checksums (https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.65/checksums.txt) as well. Maybe your download of AdGuardHome_linux_amd64.tar.gz got corrupted and you can try re-downloading?

Hi maintainer,

The package seems to have a checksum mismatch after the recent upstream update.

• Old version: 0.107.64-1
• New version: 0.107.65-1
• Error: Validation failed for AdGuardHome_linux_amd64.tar.gz (sha256sums in PKGBUILD needs updating)

Here's the error output for reference:

==> Validating source_x86_64 files with sha256sums...
    AdGuardHome_linux_amd64.tar.gz ... FAILED
==> ERROR: One or more files did not pass the validity check!

Could you please update the PKGBUILD with the new checksums? Thanks!

Update: The new checksum is:

sha256sums=('b472fa61b2251758403c4b6662d46b5b5b686b094d290a90acbaa93e19ec7640')
sha256sums_armv7h=('2a0af65aab6f42b31742d0eaecad3c31949421f456665033a5b55486c5f632bf')
sha256sums_aarch64=('75db417e441fa556a89befd888968d1841727190af624794ce63295c6bfbbb03')
sha256sums_i686=('5ce9b82fae95b497d653b8c914f90b29f07e8ec21aa50718b8640082aa427db6')
sha256sums_x86_64=('4962c19375da498d2e5b8ecf3777958240799c0c5cb2b137e3e1e90567131e5d')

I've adopted and updated the package to the latest upstream release (v0.107.64), fixed the previously mentioned packaging issues, and I rewrote the package source under 0BSD license.

0.107.53 version is available.

It's not recommended to install ../adguardhome.service directly. Instead, use source=("adguardhome.service"), with install -Dm644 "adguardhome.service" "${pkgdir}/usr/lib/systemd/system/adguardhome.service".

Also, post_remove() is generally not recommended when packaging and this package should provide and conflict adguardhome

I have a service file with DynamicUser which is also hardened:

➜  serverOS git:(master) cat /usr/lib/systemd/system/serverOS-AdGuardHome.service
[Unit]
Description=serverOS DNS
PartOf=network-online.target
RequiresMountsFor=/var/lib/private/adguardhome
After=serverOS-clash-meta.service
Before=NetworkManager-wait-online.service

[Service]
Nice=-1
DynamicUser=yes
StartLimitInterval=5
StateDirectory=serverOS-AdGuardHome
WorkingDirectory=/var/lib/private/serverOS-AdGuardHome
ExecStartPre=cp /var/lib/adguardhome/AdGuardHome /var/lib/private/serverOS-AdGuardHome/aghexec
ExecStart=/var/lib/private/serverOS-AdGuardHome/aghexec "-s" "run"
Restart=always
RestartSec=5

OOMPolicy=stop
OOMScoreAdjust=-500

SyslogIdentifier=AdGuardHome
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_RAW
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW

ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_PACKET AF_NETLINK AF_INET AF_INET6
RestrictNamespaces=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
SystemCallArchitectures=native

ProtectProc=invisible
ProcSubset=pid

SystemCallFilter=~@clock
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@debug
SystemCallFilter=~@module
SystemCallFilter=~@mount
SystemCallFilter=~@obsolete
SystemCallFilter=~@raw-io
SystemCallFilter=~@reboot
SystemCallFilter=~@swap

UMask=077

[Install]
WantedBy=multi-user.target

@procobain yes it does :)