pkg-patch-recovery 100/100

Is pkg-patch-recovery safe to install?

SaferSkills independently audited pkg-patch-recovery (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

packages/aur-package-management/.apm/skills/pkg-patch-recovery/SKILL.md · 1 file

packages/aur-package-management/.apm/skills/pkg-patch-recovery/SKILL.md2.2 KB · Markdown

name: pkg-patch-recovery

description: Recover from patch failures when an upstream Arch Linux package source changes. Use when .rej files appear, a patch fails to apply during sync-package.sh, updpkgsums reports checksum mismatches, or a build fails with patch-related errors — even if the user doesn't explicitly mention "patch" or ".rej."

allowed-tools: bash

compatibility: Requires bash, git, patch, and updpkgsums. Designed for the pngdeity aur repository.

Patch Recovery Workflow

When a patch fails to apply (.rej files appear or patch exits non-zero):

Identify the failing patch from the error output. Patches are listed in the source array of the PKGBUILD.

Clone upstream at the target version:

   git clone <upstream-repo-url> /tmp/upstream-recovery
   cd /tmp/upstream-recovery
   git checkout <target-tag-or-commit>

Attempt manual application:

   patch -p1 < /path/to/failing.patch

Resolve any .rej (reject) files by editing the affected source files. The .rej file shows the failed hunk in context. After resolving, delete all .rej files.

Generate a fresh patch:

   git diff > <package-dir>/<patch-name>.patch

Update the PKGBUILD source array to reference the regenerated patch if the filename changed.

Refresh checksums:

   updpkgsums

Run the full verification sequence:

   namcap PKGBUILD
   makepkg --printsrcinfo > .SRCINFO
   pkgctl build

Gotchas

If the upstream source has been substantially refactored, the patch may be obsolete. Verify whether the patch's purpose (bug fix, feature) has been addressed upstream before spending time on regeneration.
For packages using update.sh for transformations rather than .patch files (e.g., ranger-doas), this workflow does not apply. Consult the package's local AGENTS.md instead.
If updpkgsums fails, the upstream tarball may have been re-rolled. Verify the file content manually before committing new hashes.

When to Escalate

If a patch cannot be reconciled with upstream changes after 2-3 regeneration attempts, or if the patch addresses a security vulnerability, escalate to the user before proceeding.

pkg-patch-recovery— agent skill

Is pkg-patch-recovery safe to install?

Patch Recovery Workflow

Gotchas

When to Escalate

Audit the pieces. Scan the whole. Decide.