Skip to content

pkgbuild: provenance #390

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KSXGitHub merged 7 commits into from
Apr 8, 2026
+30 −0
Merged

pkgbuild: provenance #390

Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
67cb05b
build(pkgbuild): add optional provenance verification to -bin package
claude Apr 8, 2026
929d3c7
build(pkgbuild): drop redundant comments above prepare()
claude Apr 8, 2026
7772949
build(pkgbuild): skip provenance check for the man page
claude Apr 8, 2026
a30fa97
build(pkgbuild): prefix advisory warnings with `hint:`
claude Apr 8, 2026
986c8e9
build(pkgbuild): use `plain` for the hint follow-up lines
claude Apr 8, 2026
647f54f
build(pkgbuild): make provenance verification opt-out via env var
claude Apr 8, 2026
ae96a3b
build(pkgbuild): reword hint for provenance skip escape hatch
claude Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions template/parallel-disk-usage-bin/PKGBUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,27 @@ sha1sums=(
SKIP # for the license file
)

prepare() {
if ! command -v gh > /dev/null 2>&1; then
warning 'GitHub CLI (gh) not found, skipping provenance verification.'
plain 'hint: install the github-cli package to enable cryptographic verification of release artifacts.'
return 0
fi

if ! gh auth status > /dev/null 2>&1; then
warning 'gh is not authenticated, skipping provenance verification.'
plain 'hint: run `gh auth login` (or set GH_TOKEN) to enable cryptographic verification of release artifacts.'
return 0
fi

msg2 'Verifying build provenance with gh attestation...'
local _repo='KSXGitHub/parallel-disk-usage'
gh attestation verify --repo "$_repo" "pdu-$_checksum"
gh attestation verify --repo "$_repo" "completion.$pkgver.bash"
gh attestation verify --repo "$_repo" "completion.$pkgver.fish"
gh attestation verify --repo "$_repo" "completion.$pkgver.zsh"
Comment thread
KSXGitHub marked this conversation as resolved.
Outdated
}

package() {
install -Dm755 "pdu-$_checksum" "$pkgdir/usr/bin/pdu"
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
Expand Down