{"id":13717628,"url":"https://github.com/kpcyrd/pacman-bintrans","last_synced_at":"2025-10-11T05:17:22.776Z","repository":{"id":40519839,"uuid":"399127157","full_name":"kpcyrd/pacman-bintrans","owner":"kpcyrd","description":"Experimental pacman integration for Reproducible Builds and Binary Transparency (with sigstore/rekor)","archived":false,"fork":false,"pushed_at":"2024-07-23T21:00:45.000Z","size":3354,"stargazers_count":86,"open_issues_count":6,"forks_count":4,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-09-15T13:54:28.824Z","etag":null,"topics":["archlinux","binary-transparency","security","supply-chain","supply-chain-security"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kpcyrd.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["kpcyrd"]}},"created_at":"2021-08-23T14:05:51.000Z","updated_at":"2025-05-12T23:16:15.000Z","dependencies_parsed_at":"2024-01-17T09:21:12.952Z","dependency_job_id":"c75fd509-ba2a-47c4-a0cb-12352b5743a2","html_url":"https://github.com/kpcyrd/pacman-bintrans","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/kpcyrd/pacman-bintrans","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kpcyrd%2Fpacman-bintrans","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kpcyrd%2Fpacman-bintrans/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kpcyrd%2Fpacman-bintrans/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kpcyrd%2Fpacman-bintrans/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kpcyrd","download_url":"https://codeload.github.com/kpcyrd/pacman-bintrans/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kpcyrd%2Fpacman-bintrans/sbom","scorecard":{"id":568893,"data":{"date":"2025-08-11","repo":{"name":"github.com/kpcyrd/pacman-bintrans","commit":"5b647db68da849b3cba33b023d88ad64706a713e"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.1,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Code-Review","score":1,"reason":"Found 1/10 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/rust.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rust.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/kpcyrd/pacman-bintrans/rust.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rust.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/kpcyrd/pacman-bintrans/rust.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rust.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/kpcyrd/pacman-bintrans/rust.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rust.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/kpcyrd/pacman-bintrans/rust.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rust.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/kpcyrd/pacman-bintrans/rust.yml/main?enable=pin","Info:   0 out of   3 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   2 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: GNU General Public License v3.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":8,"reason":"5 out of the last 5 releases have a total of 5 signed artifacts.","details":["Info: signed release artifact: pacman-bintrans-0.5.0.tar.gz.asc: https://github.com/kpcyrd/pacman-bintrans/releases/tag/v0.5.0","Info: signed release artifact: pacman-bintrans-0.4.0.tar.gz.asc: https://github.com/kpcyrd/pacman-bintrans/releases/tag/v0.4.0","Info: signed release artifact: pacman-bintrans-0.3.0.tar.gz.asc: https://github.com/kpcyrd/pacman-bintrans/releases/tag/v0.3.0","Info: signed release artifact: pacman-bintrans-0.2.0.tar.gz.asc: https://github.com/kpcyrd/pacman-bintrans/releases/tag/v0.2.0","Info: signed release artifact: pacman-bintrans-0.1.1.tar.gz.asc: https://github.com/kpcyrd/pacman-bintrans/releases/tag/v0.1.1","Warn: release artifact v0.5.0 does not have provenance: https://api.github.com/repos/kpcyrd/pacman-bintrans/releases/166791692","Warn: release artifact v0.4.0 does not have provenance: https://api.github.com/repos/kpcyrd/pacman-bintrans/releases/83799261","Warn: release artifact v0.3.0 does not have provenance: https://api.github.com/repos/kpcyrd/pacman-bintrans/releases/72675112","Warn: release artifact v0.2.0 does not have provenance: https://api.github.com/repos/kpcyrd/pacman-bintrans/releases/56190068","Warn: release artifact v0.1.1 does not have provenance: https://api.github.com/repos/kpcyrd/pacman-bintrans/releases/48348855"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 27 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":0,"reason":"12 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-wq9x-qwcq-mmgf","Warn: Project is vulnerable to: RUSTSEC-2024-0365","Warn: Project is vulnerable to: RUSTSEC-2024-0421 / GHSA-h97m-ww89-6jmq","Warn: Project is vulnerable to: RUSTSEC-2022-0090 / GHSA-jw36-hf63-69r9","Warn: Project is vulnerable to: RUSTSEC-2025-0004 / GHSA-rpmj-rpgj-qmpm","Warn: Project is vulnerable to: GHSA-4fcv-w3qc-ppgg","Warn: Project is vulnerable to: RUSTSEC-2025-0022","Warn: Project is vulnerable to: GHSA-4p46-pwfr-66x6","Warn: Project is vulnerable to: RUSTSEC-2025-0009","Warn: Project is vulnerable to: GHSA-c86p-w88r-qvqr","Warn: Project is vulnerable to: GHSA-rr8g-9fpq-6wmg","Warn: Project is vulnerable to: RUSTSEC-2025-0023"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-20T15:46:48.347Z","repository_id":40519839,"created_at":"2025-08-20T15:46:48.347Z","updated_at":"2025-08-20T15:46:48.347Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279002130,"owners_count":26083307,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-09T02:00:07.460Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["archlinux","binary-transparency","security","supply-chain","supply-chain-security"],"created_at":"2024-08-03T00:01:24.969Z","updated_at":"2025-10-11T05:17:22.760Z","avatar_url":"https://github.com/kpcyrd.png","language":"Rust","funding_links":["https://github.com/sponsors/kpcyrd"],"categories":["Point-of-use validations"],"sub_categories":["Vulnerability information exchange"],"readme":"# pacman-bintrans\n\nThis is an **experimental** implementation of binary transparency for pacman,\nthe Arch Linux package manager. This project was originally heavily inspired by\n[prior work][1] by Mozilla and then re-implemented with the rekor transparency\nlog of [sigstore][2].\n\n[1]: https://wiki.mozilla.org/Security/Binary_Transparency\n[2]: https://www.sigstore.dev/how-it-works\n\nCryptographic signatures prove that a message originates from somebody with\ncontrol over the private key, but it's impossible to prove that the private key\ndidn't sign additional messages. In update security this means a signed update\nis a strong indicator the update is authentic, but you can't be sure this\nupdate is the same update everybody else got. Somebody in control of the update\nkey could craft a malicious update, sign it and feed it specifically to you.\nThis attack is much less likely to get noticed than pushing a malicious update\nto all users.\n\nBecause transparency logs work best with a \"single-purpose key\", meaning the\nkey is only ever used to sign Arch Linux packages, we're creating a special\n\"transparency key\". The operator needs to sign every Arch Linux package and\nupload the signature to the transparency log. They also need to maintain an\naudit log that tracks why each signature was created.\n\nAn external auditor could then fetch all signatures from sigstore and check if\nthey belong to officially released packages.\n\n# Usage\n\npacman-bintrans integrates into pacman by registering it as a custom transport\nin `/etc/pacman.conf`:\n\n    XferCommand = /usr/bin/pacman-bintrans -O %o %u --transparency-url https://pacman-bintrans.vulns.xyz/sigs/ --pubkey 'RWSC6c8TVaOYGoe60E+sPiPgumSQENiSNJrBOH6IUYdfmY9xIDJCFXa2'\n\nTo verify everything is working correctly you can clear your download cache\nwith `pacman -Scc` and then try to re-download and reinstall a package with\n`pacman -Suy filesystem`.\n\npacman still verifies pgp signatures, but in addition also runs `rekor-cli\nverify` on each package to ensure it has been properly logged in the sigstore\ntransparency log.\n\n# Verifying Reproducible Builds\n\nArch Linux has multiple [independent\nrebuilders](https://github.com/kpcyrd/rebuilderd). A rebuilder tracks all\npre-compiled packages in Arch Linux, downloads the source code and attempts to\ncompile them again and expects the resulting package to be bit-for-bit\nidentical with the official, pre-compiled package. Arch Linux supports this by\npublishing [BUILDINFO](https://archlinux.org/pacman/BUILDINFO.5.html) files\nthat describe the build environment. A rebuilder can use this file to setup an\nalmost identical build environment that matches all compiler and library\nversions of the original build environment. At the time of writing this works\nwith about 86% of all packages in Arch Linux. Software shouldn't attempt to\ntrack anything of the build environment that can't reasonably be normalized,\nfor example by probing the current date/time or by testing for cpu features\nlike SSE/AVX at build time instead of runtime.\n\nTo query a rebuilder for every update you're about to install you can add\n`--rebuilder \u003curl\u003e`, this option can be set multiple times:\n\n    --rebuilder https://reproducible.archlinux.org/\n    --rebuilder https://r-b.engineering.nyu.edu/\n    --rebuilder https://wolfpit.net/rebuild/\n    --rebuilder https://rebuilder.pitastrudl.me\n\nThe full command could look like this:\n\n    XferCommand = /usr/bin/pacman-bintrans -O %o %u --transparency-url https://pacman-bintrans.vulns.xyz/sigs/ --pubkey 'RWSC6c8TVaOYGoe60E+sPiPgumSQENiSNJrBOH6IUYdfmY9xIDJCFXa2' --rebuilder https://reproducible.archlinux.org/ --rebuilder https://r-b.engineering.nyu.edu/ --rebuilder https://wolfpit.net/rebuild/\n\nTo configure a threshold of required successful builds for every update you can\nuse this option:\n\n    --required-rebuild-confirms 2\n\n🚧 **But wait!** 🚧 Rejecting all packages that haven't been reproduced by at\nleast two other parties is a really exciting goal with massive security\nbenefits, unfortunately there are still too many unreproducible packages and\nnobody has managed to build a useful system with _only reproducible software_\n**yet**. If you use `--required-rebuild-confirms` with anything higher than `0`\nyour update system is eventually going to stop working because pacman can't\ndownload any unreproducible updates anymore (this may even include critical\nsecurity updates).\n\n# Generating transparency proofs\n\nThis section is intended for package maintainers that are planning to run\npackage repositories with binary transparency enabled.\n\n    cd pacman-bintrans-sign\n    cargo run --release -- -v \\\n        --repo-url 'https://ftp.halifax.rwth-aachen.de/archlinux/$repo/os/$arch' --repo-name core --architecture x86_64 \\\n        --signature-dir ../www/ --pubkey-path ~/keys/minisign.pub --seckey-path ~/keys/seckey\n\n## Searching the transparency log\n\nThere's a command to list all signatures that have been logged so far:\n\n    cd pacman-bintrans-monitor\n    cargo run\n\n## Fetching with a proxy\n\nIt's possible to make all requests through a proxy (eg. Tor) with the `--proxy\n\u003cvalue\u003e` flag for privacy reasons. This includes the package download, the\nconnection to the `--transparency-url`, the connection to the transparency log\nand the connections to any rebuilders.\n\n    XferCommand = /usr/bin/pacman-bintrans --proxy 'socks5h://127.0.0.1:9050' --bypass-proxy-for-pkgs -O %o %u --transparency-url https://pacman-bintrans.vulns.xyz/sigs/ --pubkey 'RWSC6c8TVaOYGoe60E+sPiPgumSQENiSNJrBOH6IUYdfmY9xIDJCFXa2'\n\nTo speed up upgrades you can use `--bypass-proxy-for-pkgs` so the packages are\ndownloaded directly, but the extra security checks run through the proxy.\n\n## Acknowledgments\n\nCurrent development is crowd-funded through [GitHub sponsors](https://github.com/sponsors/kpcyrd).\n\nInitial development in 2021 was funded by Google and The Linux Foundation.\n\n# License\n\nGPLv3+\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkpcyrd%2Fpacman-bintrans","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkpcyrd%2Fpacman-bintrans","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkpcyrd%2Fpacman-bintrans/lists"}