nrpe

• Category: adapted/ (plain local-tracked directory, not a submodule). Forked from the official Arch packaging repo (gitlab.archlinux.org/archlinux/packaging/packages/nrpe, maintainer Jonathan Steel) – not currently synced to the live [extra] mirror this host uses (pacman -Si nrpe finds nothing), fetched via pkgctl/its raw GitLab URLs directly. There’s also an unrelated AUR nrpe (maintainer gijsdebeer, not us) – deliberately NOT used as the base, since the user specifically wanted the official packaging repo’s version.
• Deviation from upstream, explicitly requested: --enable-command-args added to build()’s ./configure call, plus a sed in package() flipping the shipped /etc/nrpe/nrpe.cfg’s dont_blame_nrpe=0 -> dont_blame_nrpe=1. Per NRPE’s own SECURITY.md, BOTH are required together for clients to be able to supply command arguments to checks – the compile-time flag alone does nothing without the runtime directive, and vice versa. NRPE’s own docs call this a real security risk (clients can execute arbitrary command arguments on this host) – enabled anyway because it was asked for explicitly by name (dont_blame_nrpe), not discovered or defaulted to.
• Verified end-to-end after publish by downloading the actual built package from the repo and checking the real binary/config, not just trusting the build log: nrpe --help prints NRPE’s own “POSSIBLE SECURITY RISK - COMMAND ARGUMENTS ARE SUPPORTED!” banner (gated behind #ifdef ENABLE_COMMAND_ARGUMENTS in src/nrpe.c, so this is a reliable compile-time signal), and the packaged nrpe.cfg has dont_blame_nrpe=1.
• Bash command substitution (--enable-bash-command-substitution, an even higher-risk option per the same SECURITY.md) was NOT enabled – only asked for dont_blame_nrpe/command-args specifically.
• 2026-10-12: first build+publish, clean, x86_64 only (matches upstream’s own arch=(x86_64)). pkgrel 1 (fresh local fork, not a resign of an existing build – plain integer, not the local-install/-style X.Y scheme, since this is a real PKGBUILD fork we maintain, not someone else’s exact binary).