diff options
| author | Danilo M. <danix@danix.xyz> | 2026-06-26 10:48:14 +0200 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-06-26 10:48:14 +0200 |
| commit | 56788f66c7ea10b5aac5005e6f2110508fd46167 (patch) | |
| tree | f6ec02e97dbf912963c6259628a40b7cbefcf86f | |
| parent | c9d1296ec6cde63bc4b818901cc2e0a85abbf8bf (diff) | |
| download | slackware-pentesting-suite-56788f66c7ea10b5aac5005e6f2110508fd46167.tar.gz slackware-pentesting-suite-56788f66c7ea10b5aac5005e6f2110508fd46167.zip | |
feroxbuster: switch vendor tarball to reproducible tar.gz
Regenerate the vendored crates with cargo-vendor-filterer and a
SOURCE_DATE_EPOCH pinned to the release tag commit date, producing a
byte-for-byte reproducible tar.gz. Update the second source URL and
MD5SUM_x86_64 accordingly, unpack .tar.gz in the SlackBuild, and document
the exact generation command in the package README.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
| -rw-r--r-- | feroxbuster/README | 19 | ||||
| -rw-r--r-- | feroxbuster/feroxbuster.SlackBuild | 2 | ||||
| -rw-r--r-- | feroxbuster/feroxbuster.info | 4 |
3 files changed, 21 insertions, 4 deletions
diff --git a/feroxbuster/README b/feroxbuster/README index abfd92a..277c41d 100644 --- a/feroxbuster/README +++ b/feroxbuster/README @@ -14,12 +14,29 @@ there. Because SlackBuilds.org build hosts have no network access at build time, this script does not let cargo fetch crates from the network. Instead, a prebuilt vendored-crates tarball -(feroxbuster-$VERSION-vendor.tar.xz) is downloaded as a second source +(feroxbuster-$VERSION-vendor.tar.gz) is downloaded as a second source and extracted alongside the upstream source. The build then runs cargo in fully offline mode against those vendored crates. The vendored tarball is generated from the upstream Cargo.lock at the matching release tag, so the dependency set is reproducible. +The vendored tarball is regenerated per version with +cargo-vendor-filterer. SOURCE_DATE_EPOCH is pinned to the release tag's +commit date so the archive is byte-for-byte reproducible: + + tar xf feroxbuster-2.13.1.tar.gz && cd feroxbuster-2.13.1 + export SOURCE_DATE_EPOCH="$(date -u -d 2025-12-13T14:09:44Z +%s)" + cargo vendor-filterer \ + --platform=x86_64-unknown-linux-gnu \ + --prefix=vendor \ + --format=tar.gz \ + feroxbuster-2.13.1-vendor.tar.gz + +The tag commit date comes from the GitHub API, field +.commit.committer.date of: + api.github.com/repos/epi052/feroxbuster/commits/v2.13.1 +Then update MD5SUM_x86_64 for the new tarball in feroxbuster.info. + The sample configuration is installed to: /etc/feroxbuster/ferox-config.toml.new Rename it to ferox-config.toml to use it (it is shipped as .new so your diff --git a/feroxbuster/feroxbuster.SlackBuild b/feroxbuster/feroxbuster.SlackBuild index b6e0134..1c7151f 100644 --- a/feroxbuster/feroxbuster.SlackBuild +++ b/feroxbuster/feroxbuster.SlackBuild @@ -75,7 +75,7 @@ cd $PRGNAM-$VERSION # Unpack the vendored crates alongside the source. The tarball extracts to # a top-level vendor/ directory. rm -rf vendor -tar xvf $CWD/$VENDOR.tar.xz +tar xvf $CWD/$VENDOR.tar.gz chown -R root:root . find -L . \ diff --git a/feroxbuster/feroxbuster.info b/feroxbuster/feroxbuster.info index c13fdb1..7d0d90e 100644 --- a/feroxbuster/feroxbuster.info +++ b/feroxbuster/feroxbuster.info @@ -4,9 +4,9 @@ HOMEPAGE="https://github.com/epi052/feroxbuster" DOWNLOAD="UNSUPPORTED" MD5SUM="" DOWNLOAD_x86_64="https://github.com/epi052/feroxbuster/archive/v2.13.1/feroxbuster-2.13.1.tar.gz \ - https://packages.danix.xyz/sbo/feroxbuster/feroxbuster-2.13.1-vendor.tar.xz" + https://packages.danix.xyz/sbo/feroxbuster/feroxbuster-2.13.1-vendor.tar.gz" MD5SUM_x86_64="dc0bfa007f22815875b8094d954c4f60 \ - 3cc65fe23ae6abe30e3299e48f99dccc" + 1ecbe3e0b6737669548afd595381979d" REQUIRES="rust-opt" MAINTAINER="danix" EMAIL="danix@danix.xyz" |