-
Notifications
You must be signed in to change notification settings - Fork 0
Dnf
A system backend, alongside Homebrew, Pacman,
and APT. Reads what rpm/dnf has installed and audits it with the same
risk:dep model as tree. Selected automatically when dnf is the
available manager.
| Command | Used for |
|---|---|
rpm -qa --qf ... |
Every installed package in one call: name, version, url, vendor. |
rpm -qa [%{PROVIDENAME}] / [%{REQUIRENAME}]
|
The capability graph, resolved into dependency edges. |
dnf repoquery --userinstalled |
The user-installed (direct) set. |
dnf repoquery --installed %{from_repo} |
The origin repo per package (authoritative provenance where known). |
rpm -qa [%{FILENAMES}] |
The files each package ships (services / timers / auth config / setuid attribution). |
find /usr /opt -perm /6000 |
Setuid / setgid binaries. |
| `rpm -qa % | PREIN?... |
rpm -q %{PREIN}... |
A third-party package's scriptlet bodies, for static analysis. |
| `rpm -qa % | RSAHEADER?... |
rpm -Va |
Installed files whose content no longer matches (digest). |
/etc/yum.repos.d/*.repo |
Configured repos (enabled ones, and gpgcheck=0 / http://). |
dnf check-update |
Version drift (best-effort, needs metadata). |
Direct roots are the user-installed packages (dnf repoquery --userinstalled;
if dnf is unavailable every package is treated as direct). Edges come from the
RPM capability graph: each package's Requires are resolved through a
capability -> providing package map built from every package's Provides
(which covers package names, sonames, and standard-path files). Build-time
rpmlib(...) pseudo-capabilities and self-edges are dropped.
| Signal | Severity | Meaning |
|---|---|---|
third-party-source (repo / vendor) |
Medium | Not from a distribution repo. The origin repo is authoritative when known (so a copr / rpmfusion build flags even though it keeps a Fedora Project vendor); otherwise the vendor decides (a non-distro vendor, or local .rpm for an empty vendor / a sideloaded package). |
unsigned |
High | No header signature. Suppressed when almost every package is unsigned (an image built with --nogpgcheck), so it only fires as the exception. |
install-script (runs code at install) |
Info | Ships an rpm scriptlet (%pre/%post/%preun/%postun). Analyzed as shell, or as Lua when the scriptlet uses the embedded interpreter (-p <lua>). |
held (version locked) |
Low | Pinned by the dnf versionlock plugin (/etc/dnf/plugins/versionlock.list), so excluded from upgrades. |
foreign-arch (arch) |
Low | Installed only for a non-native architecture (a pure multilib package). |
orphan (not in any repo) |
Low | Installed but offered by no enabled repo (dnf repoquery --extras): removed upstream or a local build. Suppressed when repo metadata is unavailable. |
outdated (installed -> current) |
Low | Behind the repos (dnf check-update). |
The same file-derived signals as the apt backend, from each package's
FILENAMES: a systemd .service (installs-service, Info), a cron job or
.timer (installs-scheduled-task, Info), a sudoers.d / pam.d / PAM module
(modifies-auth, Info), and a setuid/setgid binary (setuid-binary (name), Low,
found via one find /usr /opt -perm /6000 and attributed to its owner).
For third-party packages (distribution scriptlets are review-gated),
postmortem runs the same analyzers as scan over the concatenated
scriptlet bodies (shell), which are what run on your machine at
install/upgrade/erase:
| Signal | Severity | Meaning |
|---|---|---|
install-remote-exec (pipe to shell) |
High | Pipes a download into a shell (curl ... | bash). |
install-ioc (...) |
varies | An IOC (IP / domain / URL) in a scriptlet. |
install-obfuscation (...) |
varies | Encoded / obfuscated payload. |
install-sensitive_api (...) |
varies | A sensitive shell primitive (exec, socket, decode, escalate, persist). |
Each package's URL (homepage) resolves to the source repo, pulling the same
stars/age/activity/language signals as tree --online.
Distribution packages mostly point at project sites, so they resolve to no
repository (reported as unchecked).
Machine-wide caveats surfaced as a gochi alert after loading:
| Caveat | Source |
|---|---|
N dnf repo(s) with gpgcheck=0 |
An enabled repo with signature checking disabled (the analog of apt's [trusted=yes]). |
N dnf repo(s) over http |
An enabled repo whose baseurl / metalink / mirrorlist is plain http://. |
N installed file(s) modified since install |
A packaged file whose content no longer matches the rpm database (rpm -Va digest mismatch); config / doc / ghost files are excluded. |
Same as system: --repos, --online, --depth, --json,
--no-progress.