From d52d7debb709af4e00acbb3c55b26008be509a30 Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Sun, 10 May 2026 21:52:33 +0000 Subject: [PATCH] aur: bring AUR packaging to .deb parity Three changes folded together close the AUR-side parity gap with the .deb packaging: - PKGBUILD now ships fips.nft baseline and fips-firewall.service, with fips.nft marked as backup so operator edits survive upgrades. - PKGBUILD-git mirrors the release PKGBUILD: installs fips-gateway (was missing entirely), ships fips.nft and fips-firewall.service, and tracks the same backup() set. - packaging/aur/README.md documents the gateway, firewall service, and nft baseline that ship as of this revision. AUR users now receive the same artifact set as .deb users. --- packaging/aur/PKGBUILD | 4 +++- packaging/aur/PKGBUILD-git | 6 +++++- packaging/aur/README.md | 16 ++++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/packaging/aur/PKGBUILD b/packaging/aur/PKGBUILD index 84aead6..2f9e810 100644 --- a/packaging/aur/PKGBUILD +++ b/packaging/aur/PKGBUILD @@ -10,7 +10,7 @@ depends=('gcc-libs' 'glibc') makedepends=('cargo') optdepends=('systemd-resolved: .fips DNS resolution') conflicts=('fips-git') -backup=('etc/fips/fips.yaml' 'etc/fips/hosts') +backup=('etc/fips/fips.yaml' 'etc/fips/hosts' 'etc/fips/fips.nft') install=fips.install source=("$pkgname-$pkgver.tar.gz::https://github.com/jmcorgan/fips/archive/v$pkgver.tar.gz" "fips.sysusers" @@ -51,10 +51,12 @@ package() { install -Dm0644 packaging/debian/fips.service "$pkgdir/usr/lib/systemd/system/fips.service" install -Dm0644 packaging/debian/fips-dns.service "$pkgdir/usr/lib/systemd/system/fips-dns.service" install -Dm0644 packaging/debian/fips-gateway.service "$pkgdir/usr/lib/systemd/system/fips-gateway.service" + install -Dm0644 packaging/debian/fips-firewall.service "$pkgdir/usr/lib/systemd/system/fips-firewall.service" # Config files (from packaging/common/) install -Dm0600 packaging/common/fips.yaml "$pkgdir/etc/fips/fips.yaml" install -Dm0644 packaging/common/hosts "$pkgdir/etc/fips/hosts" + install -Dm0644 packaging/common/fips.nft "$pkgdir/etc/fips/fips.nft" # System integration (from local source files in $srcdir) install -Dm0644 "$srcdir/fips.sysusers" "$pkgdir/usr/lib/sysusers.d/fips.conf" diff --git a/packaging/aur/PKGBUILD-git b/packaging/aur/PKGBUILD-git index 492b475..39dad6c 100644 --- a/packaging/aur/PKGBUILD-git +++ b/packaging/aur/PKGBUILD-git @@ -11,7 +11,7 @@ makedepends=('cargo' 'git') optdepends=('systemd-resolved: .fips DNS resolution') provides=('fips') conflicts=('fips') -backup=('etc/fips/fips.yaml' 'etc/fips/hosts') +backup=('etc/fips/fips.yaml' 'etc/fips/hosts' 'etc/fips/fips.nft') install=fips.install source=("fips::git+https://github.com/jmcorgan/fips.git" "fips.sysusers" @@ -52,14 +52,18 @@ package() { install -Dm0755 target/release/fips "$pkgdir/usr/bin/fips" install -Dm0755 target/release/fipsctl "$pkgdir/usr/bin/fipsctl" install -Dm0755 target/release/fipstop "$pkgdir/usr/bin/fipstop" + install -Dm0755 target/release/fips-gateway "$pkgdir/usr/bin/fips-gateway" # Systemd service files (from packaging/debian/ -- correct /usr/bin/ paths) install -Dm0644 packaging/debian/fips.service "$pkgdir/usr/lib/systemd/system/fips.service" install -Dm0644 packaging/debian/fips-dns.service "$pkgdir/usr/lib/systemd/system/fips-dns.service" + install -Dm0644 packaging/debian/fips-gateway.service "$pkgdir/usr/lib/systemd/system/fips-gateway.service" + install -Dm0644 packaging/debian/fips-firewall.service "$pkgdir/usr/lib/systemd/system/fips-firewall.service" # Config files (from packaging/common/) install -Dm0600 packaging/common/fips.yaml "$pkgdir/etc/fips/fips.yaml" install -Dm0644 packaging/common/hosts "$pkgdir/etc/fips/hosts" + install -Dm0644 packaging/common/fips.nft "$pkgdir/etc/fips/fips.nft" # System integration (from local source files in $srcdir) install -Dm0644 "$srcdir/fips.sysusers" "$pkgdir/usr/lib/sysusers.d/fips.conf" diff --git a/packaging/aur/README.md b/packaging/aur/README.md index 8da8bd4..4d51357 100644 --- a/packaging/aur/README.md +++ b/packaging/aur/README.md @@ -23,6 +23,22 @@ Both PKGBUILDs reference files from `packaging/debian/` (service files) and `packaging/common/` (config files) at build time. These are pulled from the source tree during `package()`, not from this directory. +### What Gets Installed + +Both PKGBUILDs install the same payload, kept at parity with the Debian +package: + +- Binaries: `fips`, `fipsctl`, `fipstop`, `fips-gateway` +- Systemd units: `fips.service`, `fips-dns.service`, `fips-gateway.service`, + `fips-firewall.service` +- Config: `/etc/fips/fips.yaml`, `/etc/fips/hosts`, `/etc/fips/fips.nft` +- sysusers/tmpfiles fragments for the `fips` group and `/run/fips/` + +The `fips.nft` baseline is shipped as a conffile (listed in `backup=()`) so +operator edits to the nftables ruleset survive package upgrades. +`fips-firewall.service` is shipped disabled by default, matching the Debian +package: operators opt in by enabling it explicitly. + ## Local Build and Validation Build and validate the `-git` package locally using the Makefile target: