GithubSoar

FAQ

Frequently Asked Questions & Misc

Broken & Not Statically Linked

  1. There's an automated CI which checks for these

  2. aarch64-Linux : https://github.com/Azathothas/Toolpacks/blob/main/aarch64-Linux/BUILD_ERROR.log.md

  3. x86_64-Linux : https://github.com/Azathothas/Toolpacks/blob/main/x86_64-Linux/BUILD_ERROR.log.md

  4. So if it's already there, it will eventually be fixed.

  • Title: Summary of Issue along with Binary & Platfrom Name

  • Description: Show the crash/segfault screenshot or provide file/ldd/readelf output along with what would be the correct behaviour

  • Tag: BUG + $PLATFORM

Baseutils

Essentially Baseutils is a collection of Bins from CoreUtils + BusyBox + FindUtils + OpenSSH + Procps + ToyBox + UtilLinux + XZ-Utils & More. Mostly meant for restricted environments like ephemeral AWS Lambda, Google Cloud Functions or anywhere really where there's a lack of coreutils or no privs to use pkg managers. This could also be theoretically used to bootstrap a linux distro, however, some binaries may not work as we haven't tested all of them comprehensively. Stability & Reliability isn't Guaranteed.

UPX

  • Binaries are also packed using upx --best after a CI Build is Complete.

  • These can be downloaded by either using soar add "${BIN}" --prefer-upx or by simply adding a .upx to any binary.

  • There is no entry for UPX Binaries in METADATA & also no CHECKSUMS

  • UPX Binaries can still be decompressed upx -d $BIN.upx & then checked for original CHECKSUMS

  • Note: If a build was completed recently, it's UPX packed version may need some time to show up (Because it's done as post-build)

    • Hence, raw binary may be a newer version while it's UPX may still be from the old one. In this case, using UPX to decompress & verify checksum will fail.

    • UPX counterparts generally take 5-10 hrs to show up, packed fresh from the latest batch.

  • Note: ALL Binaries may NOT have UPX Versions

  • Note: AntiVirus Systems often detectUPX as malicious, It is a known issue: https://github.com/upx/upx/issues/437

Setup & Configure Local Build Environment

!#Automatically picks up correct $ARCH & $IMAGE based on Host
sudo podman run --detach --privileged --network="bridge" --publish "22222:22" --systemd="always" --ulimit="host" --volume="/tmp:/tmp" --tz="UTC" --pull="always" --name="toolpacker-dbg" "docker.io/azathothas/ubuntu-systemd-base:$(uname -m)"

!#Add SSH Keys (Replace with yours)
sudo podman exec -it -u "runner" "toolpacker-dbg" bash -c 'bash <(curl -qfsSL "https://pub.ajam.dev/repos/Azathothas/Arsenal/misc/Linux/install_dev_tools.sh")'
sudo podman exec -it -u "runner" "toolpacker-dbg" bash -c 'sudo curl -qfsSL "https://github.com/Azathothas.keys" | sudo sort -u -o "/etc/ssh/authorized_keys" ; sudo systemctl restart sshd'

!#SSH IN
echo -e "\n[+] HOST_IP : $(ip -4 addr show $(ip route | grep default | awk '{print $5}') | grep -oP '(?<=inet\s)\d+(\.\d+){3}')\n"
ssh "runner@$HOST_IP" -p "22222" -o "StrictHostKeyChecking=no" -i "$PATH_TO_SSH_KEY"
#After SSH, the source script sets up ENV & PATH
source <(curl -qfsSL "https://raw.githubusercontent.com/Azathothas/Toolpacks/main/.github/scripts/$(uname -m)_Linux/env.sh")

!#STOP/DEL
sudo podman stop "toolpacker-dbg"
sudo podman rm "toolpacker-dbg" --force 2>/dev/null

Why not host on GitHub?

@Azathothas used to do just that back when there were only a few hundred binaries. All binaries were hosted on GitHub along with weekly releases containing all Binaries packed in tar/7z.

  1. Because GitHub has very conservative limits: https://docs.github.com/en/repositories/working-with-files/managing-large-files/about-large-files-on-github

  2. CloudFlare R2 is a geo-distributed storage bucket & can scale up infinitely.

@Azathothas did an indepth comparision & analysis a while ago, you can read it here: https://ajam.dev/affordable-performant-s3-compatible-storage-providers

  1. Last but not least, to avoid https://docs.pkgforge.dev/orgs/pkgforge-core/projects/pkgcache/dmca-or-copyright-cease-and-desist

Android Deprecation

Android Support was deprecated on Nov 18, 2024

  1. Android is weird & very different from Linux.

  2. Android has known issues that are won't fix | by design

  3. Android binaries CAN NOT BE COMPILED STATICALLY without significant efforts & manual patching for each & every binary. This is not Automatable.

  4. bin.pkgforge.dev/arm64_v8a_Android only ever provided Tools/Pkgs (Only for arm64-v8a) that @Azathothas personally used to use but which weren't already available in termux-pkgs or broken.

  5. Termux already ports thousands of packages, Check the Issues for your pkg. There's also a near-complete list of all packages officially available on Termux: https://termux-packages.ajam.dev/

  6. Check @leleliu008's project https://github.com/leleliu008/ndk-pkg, if you still don't want to use Termux.

Windows Deprecation

Windows Support was deprecated on Nov 18, 2024

  1. Windows is centralized & thus benefits from central App Stores like the Windows Store & WinGet

  2. It has some of the same issues, Android has, i.e. can't be fully statically linked.

  3. There already exist UniGetUI , which is a pretty & mature wrapper around WinGet, Scoop, Chocolatey, Pip, Npm, .NET Tool, PowerShell Gallery and more

More Architectures & OS

  • We would like to build binaries for other architectures like riscv64, and the BSD Family of OSes, however our time & especially RESOURCES are limited.

  • If you would like to see additional build targets prioritized, donating a Dedicated Build Server would be the optimal encouragement.

  • Note: 32-Bit Binaries will likely never be Supported/Added since that's now ancient and even embedded devices now ship with 64-Bit ARCH

bin.pkgforge.dev

There's no public source code for the web frontend powering https://bin.pkgforge.dev/

Public Tools Search

Public Code Search

  • GitHub Search: NOT user:Azathothas NOT user:xplshn NOT user:metis-os NOT user:pkgforge NOT user:pkgforge-community NOT user:pkgforge-dev NOT user:pkgforge-security NOT is:fork pkgforge.dev

  • Google|Bing|Baidu: "*pkgforge.dev" -site:pkgforge.dev -site:ajam.dev

History & Lore

@Azathothas used to be bug bounty hunter, a long time ago in another life. He often had to set up pentesting environments on remote Servers, at that time there used to be https://github.com/six2dez/reconftw, which installed a bunch of tools (often installing go/rust just to install the tools), this made the setup time awfully slow & frustrated him.

Eventually, ~ July, 2023, he would start modifying the setup scripts, as well as maintaining some homegrown scripts by himself. In the best of case, it was simply a wrapper around eget, to just fetch a precompiled binary from GitHub. In the worst of cases, it was installing go/rust toolchains, same as reconftw was doing just to install the tools. So he started creating repos on GitHub to build & release these binaries using GH's CI, and then using eget to pull them. The number of repos grew, and it was harder and harder to maintain each, thus ToolPacks was created to centralize them all. You can find all the several iterations this repository went through over the years, on the web-archive.

@Azathothas recommends reading these articles if you need a technical justification:

A special mention to @pwnwriter who reached out to @Azathothas, and created the very first Package manager Hysp ~ Nov 17, 2023 . Sadly, Hysp was archived on May 26, 2024.

Another mention to @Xplshn who created a package manager in sh called bdl ~ Dec 20, 2023, which later turned into the Golang BigDL ~ Feb 5, 2024, which again turned into Dbin ~ Aug 23, 2024.

Seeing all these efforts, and some encouragements on Lobsters, @Azathothas approached @QaidVoid and Soar received it's first commit on Oct 3, 2024. One thing led to another, and the PkgForge Organization came into being on Nov 4, 2024 to do everything officially and have more control over the direction of all our projects.

PreviousPackage-RequestNextDMCA | Copyright (Cease & Desist)

Last updated