archcanary
LOW
maintainer musdus
0 votes
scanned 2026-08-24 09:22:42.972537
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: musqz <gummy-fang-deputy@duck.com>
2
pkgname=archcanary
3
pkgver=0.1.29
4
pkgrel=1
5
pkgdesc="Layered security detection stack for Arch Linux — malicious AUR packages, systemd/eBPF persistence, npm/bun cache poisoning, kernel module tampering"
6
arch=('any')
7
url="https://github.com/musqz/archcanary"
8
license=('MIT')
9
depends=('bash' 'pacman')
10
optdepends=(
11
'yad: GTK GUI frontend (archcanary-gui)'
12
'libnotify: desktop alerts on infected scan result'
13
'polkit: GUI privilege escalation for root checks'
14
'bpf: bpftool for eBPF rootkit detection'
15
'yay: AUR helper with Lua hook support'
16
'paru: AUR helper with PreBuildCommand hook support'
17
'bash-completion: tab-completion for archcanary/canary flags'
18
)
19
backup=('etc/archcanary/dkms_allowlist.conf'
20
'etc/archcanary/systemd_allowlist.conf'
21
'etc/archcanary/bpftool_allowlist.conf'
22
'etc/archcanary/autostart_allowlist.conf')
23
install=archcanary.install
24
source=("$pkgname-$pkgver.tar.gz::https://github.com/musqz/$pkgname/archive/v$pkgver.tar.gz")
25
sha256sums=('4a043acdc8eafdcdcc8b13adeb26cd38e54c0b54ea6f12e3feed5655beae107c')
26
27
package() {
28
cd "$srcdir/$pkgname-$pkgver"
29
30
# Stamp the real version into the placeholder install.sh normally sed's at
31
# install time — package() bypasses install.sh entirely, so without this
32
# every installed copy keeps the literal "@VERSION@" and -V/About show
33
# "unknown" (archcanary-gui's About dialog runs `archcanary --version`).
34
sed -i "s/@VERSION@/$pkgver/" archcanary.sh
35
sed -i "s/@VERSION@/$pkgver/" man/archcanary.1
36
37
# Main user-facing binaries
38
install -Dm755 archcanary.sh "$pkgdir/usr/bin/archcanary"
39
install -Dm755 archcanary-gui.sh "$pkgdir/usr/bin/archcanary-gui"
40
41
# Man page
42
install -Dm644 man/archcanary.1 "$pkgdir/usr/share/man/man1/archcanary.1"
43
44
# Bash completion (archcanary + canary alias)
45
install -Dm644 configs/archcanary-completion.bash \
46
"$pkgdir/usr/share/bash-completion/completions/archcanary"
47
ln -sf archcanary "$pkgdir/usr/share/bash-completion/completions/canary"
48
49
# System lib: scanner + root helper + threat lists (used by the root scan)
50
install -dm755 "$pkgdir/usr/lib/archcanary"
51
install -m755 archcanary.sh "$pkgdir/usr/lib/archcanary/archcanary.sh"
52
install -m755 lib/archcanary-root-helper "$pkgdir/usr/lib/archcanary/root-helper"
53
for _list in package_list.txt malicious_npm_packages.txt \
54
chaos_rat_packages.txt malicious_russian_spam_packages.txt \
55
community_reports.txt; do
56
install -Dm644 "lists/$_list" "$pkgdir/usr/lib/archcanary/$_list"
57
done
58
install -Dm644 configs/lynis-custom.prf \
59
"$pkgdir/usr/lib/archcanary/lynis-custom.prf"
60
install -Dm644 configs/audit-rules.conf \
61
"$pkgdir/usr/lib/archcanary/audit-rules.conf"
62
63
# Polkit policy (authorises root-helper via pkexec)
64
install -Dm644 configs/org.archcanary.policy \
65
"$pkgdir/usr/share/polkit-1/actions/org.archcanary.policy"
66
67
# Desktop entry
68
install -Dm644 configs/archcanary.desktop \
69
"$pkgdir/usr/share/applications/archcanary.desktop"
70
71
# Systemd system units (root scan: weekly timer + pacman-triggered path;
72
# scan-all-homes: opt-in weekly sweep of every real local user's home)
73
for _unit in systemd/system/archcanary.service \
74
systemd/system/archcanary.timer \
75
systemd/system/archcanary.path \
76
systemd/system/archcanary-onchange.service \
77
systemd/system/archcanary-scan-all-homes.service \
78
systemd/system/archcanary-scan-all-homes.timer; do
79
install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/system/$(basename "$_unit")"
80
done
81
82
# Systemd user units (user-scope scan + result notifier)
83
for _unit in systemd/user/archcanary-user.service \
84
systemd/user/archcanary-user.timer \
85
systemd/user/archcanary-notify.path \
86
systemd/user/archcanary-notify.service; do
87
install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/user/$(basename "$_unit")"
88
done
89
90
# Allowlists — seeded as commented templates; users edit in place. pacman's
91
# backup=() array (see above) preserves local edits across upgrades.
92
install -dm755 "$pkgdir/etc/archcanary"
93
cat > "$pkgdir/etc/archcanary/dkms_allowlist.conf" << 'EOF'
94
# DKMS modules to skip during --check-kmod (system-wide allowlist).
95
# One module name per line. Everything after # is a comment.
96
# Add modules that are known-good but not tracked by pacman.
97
#
98
# Common examples (uncomment as needed):
99
# tuxedo-drivers # TUXEDO Computers hardware driver
100
# v4l2loopback # virtual camera (OBS, video conferencing)
101
# vboxdrv # VirtualBox host kernel module
102
# vmmon # VMware Workstation
103
EOF
104
105
cat > "$pkgdir/etc/archcanary/systemd_allowlist.conf" << 'EOF'
106
# systemd units to skip during the systemd persistence check (--check-systemd),
107
# system-wide allowlist. One unit name per line. Everything after # is a comment.
108
# Add units that are known-good but not tracked by pacman and not vetted by the
109
# standard-prefix check (e.g. a self-hosted app installed from an upstream
110
# binary release rather than a package). A .timer is matched by its OWN name,
111
# not its target .service — allowlist both if you want to silence both findings.
112
#
113
# Example:
114
# forgejo.service # self-hosted git, installed from upstream binary release
115
# forgejo.timer # only needed if forgejo also ships a persistent timer
116
EOF
117
118
cat > "$pkgdir/etc/archcanary/bpftool_allowlist.conf" << 'EOF'
119
# eBPF loader binaries to skip during the bpftool LSM-loader check
120
# (--check-bpftool), system-wide allowlist. One binary basename per line.
121
# Everything after # is a comment.
122
# Add loaders that are known-good but not pacman-owned (a self-built or
123
# manually-installed security/monitoring tool that legitimately loads LSM
124
# eBPF hooks) — matched against the basename of /proc/<pid>/exe.
125
#
126
# Example:
127
# falco # runtime security monitoring, installed from upstream binary release
128
EOF
129
130
cat > "$pkgdir/etc/archcanary/autostart_allowlist.conf" << 'EOF'
131
# Names to skip during the XDG autostart check (--check-autostart),
132
# system-wide allowlist. One entry per line. Everything after # is a
133
# comment. Covers two separate findings within the same check, each with
134
# its own matching rule:
135
#
136
# 1. .desktop Exec= names that are known-good but can't be resolved via
137
# $PATH or a standard system prefix — e.g. a package-private helper
138
# binary the non-PATH fallback (search of /usr/lib, /usr/libexec) still
139
# can't find, or an AppImage/Flatpak export. Matched against the bare
140
# Exec= value exactly as written in the .desktop file (not a resolved
141
# path) — usually just a command name.
142
#
143
# 2. User systemd service ExecStart= binaries unowned by pacman. Matched
144
# against the ExecStart binary's exact, full path (NOT its basename —
145
# a basename match would let an unrelated binary sharing that name
146
# anywhere on disk slip through undetected). Useful for a package that
147
# ships its user unit via /etc/skel (copied into ~/.config/systemd/user/
148
# at account creation, so pacman never tracks that specific copy even
149
# though the binary itself is a normal pacman-owned file).
150
#
151
# Examples:
152
# zeitgeist-datahub # desktop activity logging, ships in a non-PATH libdir
153
# /usr/bin/eos-update-notifier # EndeavourOS update notifier, user unit ships via /etc/skel
154
EOF
155
}
156
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-24 09:22:42 | Low | 1 |