bread/packaging/arch/PKGBUILD
Breadway 89c5849539 Fix audit findings: path traversal, exec shell, glob dup, dead bread-sync, version drift
- modules_mgmt.rs: reject module names containing path separators, `..`,
  or absolute paths before joining onto modules_dir (install_from_local,
  remove_module, read_module_manifest); adds canonicalized containment
  check as defense in depth. Manifest-supplied names and CLI args were
  previously joined unsanitized, allowing path traversal on install/remove.
- breadd/src/lua/mod.rs: bread.exec now runs via `sh -c` instead of
  `sh -lc`; no documented reason was found for login-shell semantics.
- Unify the two independently hand-written glob matchers (subscription
  dispatch in breadd/src/core/subscriptions.rs vs. the CLI --filter path
  in breadd/src/ipc/mod.rs) into one implementation in
  bread-shared/src/glob.rs, used by both call sites.
- Remove the dead bread-sync/ tree (already excluded from the workspace
  and fully unreferenced) and its stale PKGBUILD deps (libgit2, git
  optdepend) and packaging docs mention.
- Correct the version-number transposition bug ("6.2.0" instead of
  "0.6.2"/"0.6.6") across bread-shared, breadd, and bread-cli Cargo.toml,
  and fix PKGBUILD's stale pkgver, so Cargo.toml/doctor/PKGBUILD all agree
  with the latest git tag (v0.6.6).
2026-07-17 03:20:14 +08:00

39 lines
1.2 KiB
Bash

# Maintainer: Breadway <rileyhorsham@gmail.com>
pkgname=bread
pkgver=0.6.6
pkgrel=1
pkgdesc="A reactive automation fabric for Linux desktops"
arch=('x86_64')
url="https://github.com/Breadway/bread"
license=('MIT')
# mlua builds Lua from vendored C source. makepkg's default -flto=auto would
# emit GCC LTO bitcode into liblua5.4.a, which the Rust (lld) link can't read,
# leaving all lua_* symbols undefined. Disable LTO for a clean static link.
options=(!lto !debug)
depends=('glibc')
optdepends=(
'libnotify: desktop notifications via bread.notify()'
'upower: D-Bus battery events (sysfs polling used otherwise)'
)
makedepends=('rust' 'cargo')
source=("${pkgname}-${pkgver}.tar.gz")
sha256sums=('SKIP')
build() {
cd "${srcdir}/${pkgname}-${pkgver}"
cargo build --release --locked
}
check() {
cd "${srcdir}/${pkgname}-${pkgver}"
cargo test --release --locked --workspace
}
package() {
cd "${srcdir}/${pkgname}-${pkgver}"
install -Dm755 target/release/breadd "${pkgdir}/usr/bin/breadd"
install -Dm755 target/release/bread "${pkgdir}/usr/bin/bread"
install -Dm644 packaging/systemd/breadd.service "${pkgdir}/usr/lib/systemd/user/breadd.service"
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
}