Add sif to MacPorts

I use MacPorts instead of Homebrew and would like to have sif added to MacPorts.

I may try to package sif and make a PR to add it to MacPorts myself.

@x86pup

@x86pup if you can do it yourself i would really appreciate it! if not let me know and i can try to take care of it

Assign this to me and I'll give it a shot :3

done <3

@x86pup

hey @x86pup - any update here?

@vmfunc

Claude finished @vmfunc's task in 2m 32s —— View job

MacPorts Packaging Guide for sif

Read project structure to understand build system and dependencies
Research MacPorts packaging requirements
Write detailed steps for packaging sif in MacPorts

Hey @x86pup! Here's a full breakdown of what you'll need to do to add sif to MacPorts.

Overview

sif is a Go binary (Go 1.25+, module path github.com/dropalldatabases/sif) distributed with a bundled modules/ directory that must ship alongside the binary. It already has MacPorts-friendly traits: supports DESTDIR, PREFIX, and BINDIR in its Makefile, and releases pre-built macOS binaries for both amd64 and arm64.

Step 1: Prerequisites

A MacPorts installation (for local testing)
A GitHub account to submit a PR to macports-ports
Familiarity with Tcl (Portfiles are Tcl scripts, but you mostly copy patterns)

# Install the tools you'll need
sudo port install PortLint PortIndex

Step 2: Clone the macports-ports tree

git clone https://github.com/macports/macports-ports.git
cd macports-ports

Create the port directory. MacPorts organizes ports by category — sif fits under security:

mkdir -p security/sif
touch security/sif/Portfile

Step 3: Write the Portfile

There are two approaches:

Approach A: Fetch pre-built release binaries (recommended to start)

This is simpler and avoids the complexity of vendoring 400+ Go module dependencies. MacPorts generally prefers building from source, but binary ports are acceptable for complex projects.

# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4

PortSystem          1.0

name                sif
version             X.Y.Z
categories          security net
maintainers         {github.com/x86pup @x86pup} openmaintainer
description         Fast, concurrent recon-to-exploitation scanner
long_description    sif is a modular pentesting toolkit: subdomain enum, port scan, \
                    web crawler, nuclei integration, framework/CVE detection, \
                    JS secret extraction, CORS/XSS/redirect probes, cloud and \
                    takeover checks — all in one static binary with no runtime deps.

homepage            https://github.com/vmfunc/sif
license             BSD
platforms           darwin

use_configure       no

# Select the right binary for the current architecture
if {${build_arch} eq "arm64"} {
    distfiles       sif-macos-arm64.tar.gz
    checksums       rmd160  FILL_IN_RIPEMD160 \
                    sha256  FILL_IN_SHA256 \
                    size    FILL_IN_SIZE
} else {
    distfiles       sif-macos-amd64.tar.gz
    checksums       rmd160  FILL_IN_RIPEMD160 \
                    sha256  FILL_IN_SHA256 \
                    size    FILL_IN_SIZE
}

master_sites        https://github.com/vmfunc/sif/releases/download/v${version}/

# Tell MacPorts not to try to strip/configure/build
build               {}

destroot {
    # Install the binary
    xinstall -m 0755 ${worksrcpath}/sif ${destroot}${prefix}/bin/sif

    # Install built-in modules to a standard location
    xinstall -d ${destroot}${prefix}/share/${name}/modules
    fs-traverse f ${worksrcpath}/modules {
        if {[file isfile $f]} {
            set rel [string range $f [string length ${worksrcpath}/modules/] end]
            set dst ${destroot}${prefix}/share/${name}/modules/${rel}
            xinstall -d [file dirname $dst]
            xinstall -m 0644 $f $dst
        }
    }

    # Create a symlink so sif finds modules next to the binary
    # (sif looks for a 'modules/' dir in the same directory as the executable)
    ln -s ${prefix}/share/${name}/modules ${destroot}${prefix}/bin/modules
}

notes "
sif built-in modules are installed to:
  ${prefix}/share/sif/modules/

You can add your own modules to:
  ~/.config/sif/modules/
"

Approach B: Build from source (long-term goal)

This uses the MacPorts golang portgroup. The challenge with sif is its ~400 transitive Go dependencies — each must be declared in go.vendors. A tool called port2go or manual inspection of go.mod/go.sum can help generate these entries, but it's significant work.

The skeleton would look like:

PortSystem          1.0
PortGroup           golang 1.0

go.setup            github.com/dropalldatabases/sif X.Y.Z v
# Note: repo lives at github.com/vmfunc/sif but the module path differs

categories          security net
maintainers         {github.com/x86pup @x86pup} openmaintainer
...

go.vendors          github.com/charmbracelet/lipgloss \
                        lock vX.Y.Z \
                        rmd160 ... sha256 ... \
                    github.com/gocolly/colly \
                        lock v2.3.0 \
                        rmd160 ... sha256 ... \
                    # ... (400+ entries)

Start with Approach A — you can always migrate to B later.

Step 4: Get checksums

For each tarball in the release, you need rmd160, sha256, and size. Run:

# Download the tarballs
curl -LO https://github.com/vmfunc/sif/releases/download/vX.Y.Z/sif-macos-amd64.tar.gz
curl -LO https://github.com/vmfunc/sif/releases/download/vX.Y.Z/sif-macos-arm64.tar.gz

# Generate checksums (macOS)
openssl dgst -ripemd160 sif-macos-amd64.tar.gz
openssl dgst -sha256    sif-macos-amd64.tar.gz
ls -l sif-macos-amd64.tar.gz  # for size in bytes

Fill those values into FILL_IN_* in the Portfile.

Step 5: Important caveat — the modules directory symlink

sif's loader looks for modules at {directory_of_binary}/modules. When installed to /opt/local/bin/sif, it checks /opt/local/bin/modules/. The destroot block above handles this by symlinking /opt/local/bin/modules → /opt/local/share/sif/modules. This is a non-standard approach — some MacPorts reviewers may ask for an alternative.

A cleaner long-term fix would be a small patch to internal/modules/loader.go to also check ${prefix}/share/sif/modules (hardcoded at build time via -ldflags "-X ..." or an env var). Consider filing a separate issue/PR in this repo to add a configurable or compile-time modules search path — that would make packaging much cleaner.

Step 6: Test the port locally

# From the macports-ports root
sudo port install --source security/sif
sudo port lint security/sif

# Verify it works
sif -h

Step 7: Submit to MacPorts

Fork macports/macports-ports
Push your security/sif/Portfile on a branch
Open a PR — the title convention is <name>: new port
One of the MacPorts team members will review and merge

The MacPorts Guide — Creating a Port is the canonical reference if you get stuck.

@x86pup

hey @x86pup - it's been a couple months. still up for doing the macports port? the writeup above has everything you'd need.

if you can't get to it no worries, just say so and i'll unassign + pick it up. keeping it open for now.

Generated by Claude Code

Hi, sorry for the delay. Lots of personal things have been coming up and haven't had time but I still wanted to do this.

I made a PR here: macports/macports-ports#34250

Tested this locally on my arm64 Mac.

It targets v2026.6.10 since that's the newest release, and packaging that tag needs two workarounds I'd rather not carry long term.

The first is the bundled modules. At that tag the loader only looks for modules/ next to the executable and in the working directory, so an installed copy at /opt/local/bin/sif finds none of them. The port installs them to ${prefix}/share/sif/modules and patches loader.go to check there as a last resort.

The second is the module path. go.mod at that tag still says github.com/dropalldatabases/sif, so the Portfile has to override the Go package ID while fetching from vmfunc/sif.

Both of these are already fixed on main. 356b16f (#316) embeds the modules in the binary, which makes a packaged build self-contained, and the rename has landed. I tested this: a binary built from main and run from a directory with no modules/ anywhere near it loads 238 modules, while v2026.6.10 in the same situation loads zero.

Are there plans to tag a release off main? There are 275 commits since v2026.6.10. Once one exists I'll bump the port to it and drop both the patch and the share/sif/modules install, and MacPorts users will get 238 modules instead of 8. There's no urgency here, the port works as it stands.

Separately, I noticed while testing that every run prints this to stderr:

WARNING: sonic/ast only supports (go1.17~1.26 and amd64 CPU) or (go1.20~1.26 and arm64 CPU), but your environment is not suitable and will fallback to encoding/json

That's bytedance/sonic v1.15.0 (indirect) not knowing about Go 1.27. It's harmless since it falls back to encoding/json, but MacPorts ships Go 1.27 so every MacPorts user will see it on every invocation. I can file that as its own issue if you'd like.

@vmfunc

@vmfunc The port has been merged macports/macports-ports#34250 (comment) 🎉

My comments about making a new release and the issue still stand at the moment though.

Navigation Menu

Repository navigation

Add sif to MacPorts #125

MacPorts Packaging Guide for sif

Overview

Step 1: Prerequisites

Step 2: Clone the macports-ports tree

Step 3: Write the Portfile

Approach A: Fetch pre-built release binaries (recommended to start)

Approach B: Build from source (long-term goal)

Step 4: Get checksums

Step 5: Important caveat — the modules directory symlink

Step 6: Test the port locally

Step 7: Submit to MacPorts

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Add sif to MacPorts #125

Description

Activity

vmfunc commented on Jun 11, 2026

x86pup commented on Jun 11, 2026

vmfunc commented on Jun 11, 2026

vmfunc commented on Jun 23, 2026

claude commented on Jun 23, 2026

MacPorts Packaging Guide for sif

Overview

Step 1: Prerequisites

Step 2: Clone the macports-ports tree

Step 3: Write the Portfile

Approach A: Fetch pre-built release binaries (recommended to start)

Approach B: Build from source (long-term goal)

Step 4: Get checksums

Step 5: Important caveat — the modules directory symlink

Step 6: Test the port locally

Step 7: Submit to MacPorts

vmfunc commented on Aug 22, 2026

x86pup commented on Aug 26, 2026

x86pup commented on Aug 27, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions