aurscan-manticore-release-git-bin

maintainer rudolfhorak · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The build() function executes 'sudo "$srcdir/indexer"' - running an unverified local file with elevated privileges via sudo. The 'indexer' file appears in the first (orphaned/duplicate) source= line as a bare filename with no URL, meaning it would need to exist locally or be fetched from somewhere undefined. This is highly suspicious: a legitimate Go build package has no reason to invoke sudo or run an arbitrary 'indexer' script. The PKGBUILD also has two source= array declarations (the first bare 'source=("indexer")' is overridden by the second), which is confusing but the sudo call remains in build(). Running sudo inside a makepkg build() function is a serious red flag - makepkg explicitly warns against this and legitimate packages never do it. Even if 'indexer' doesn't resolve to a real file (making the build fail), the intent to execute an unverified binary with root privileges constitutes a genuine high-risk pattern. The package also claims to be an AUR malware scanner, which is an ironic social-engineering vector to gain trust.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 88%): The build() function executes 'sudo "$srcdir/indexer"' - running an unverified local file with elevated privileges via sudo. The 'indexer' file appears in the first (orphaned/duplicate) source= line as a bare filename with no URL, meaning it would need to exist locally or be fetched from somewhere undefined. This is highly suspicious: a legitimate Go build package has no reason to invoke sudo or run an arbitrary 'indexer' script. The PKGBUILD also has two source= array declarations (the first bare 'source=("indexer")' is overridden by the second), which is confusing but the sudo call remains in build(). Running sudo inside a makepkg build() function is a serious red flag - makepkg explicitly warns against this and legitimate packages never do it. Even if 'indexer' doesn't resolve to a real file (making the build fail), the intent to execute an unverified binary with root privileges constitutes a genuine high-risk pattern. The package also claims to be an AUR malware scanner, which is an ironic social-engineering vector to gain trust.

PKGBUILD

      1source=( 'indexer' )
    
      2# Maintainer: Andreas Reichel <aurscan at manticore-projects dot com>
    
      3# Maintainer: Tom Hale <tom at hale dot ee>
    
      4# shellcheck shell=bash disable=SC2034,SC2154,SC2164  # var unused / var not assigned / cd without || exit
    
      5
    
      6pkgname=aurscan-manticore-release-git-bin
    
      7pkgver=0.7.1
    
      8pkgrel=1
    
      9pkgdesc="LLM-powered pre-build malware scanner for AUR packages (with paru / yay hooks) -- git release"
    
      10arch=('x86_64' 'aarch64')
    
      11url="https://github.com/manticore-projects/aurscan"
    
      12license=('Apache-2.0')
    
      13makedepends=('go' 'git' 'gnupg')
    
      14conflicts=(aurscan aurscan-manticore{'',-bin}-release-git)
    
      15optdepends=(
    
      16  'paru: sparu wrapper, PreBuildCommand hook, and --update-check'
    
      17  'yay: syay wrapper, editor-gate hook, and --update-check'
    
      18  'claude-code: keyless backend via your Claude subscription'
    
      19  'openai-codex: keyless backend via your Codex subscription'
    
      20  'xdg-utils: open mail client for mailing-list reports'
    
      21)
    
      22
    
      23_gpg_key_file=andreas-manticore-projects.gpg
    
      24source=("aurscan-manticore-release-git-bin::git+$url.git"
    
      25        "${_gpg_key_file}")
    
      26b2sums=('SKIP'
    
      27        'e80ad8b775d2d503e066d0a8a55d365eb3c4a4caa0e1812afb66b81f7adb279cde7f9d561fe329650a9176aba2f83cd45aab3bf304af861e21c12df9230bfe38')
    
      28
    
      29pkgver() {
    
      30  cd "${srcdir}/aurscan-manticore-release-git-bin"
    
      31  git tag --list | grep -E '^v[0-9]+\.' | sort -V | tail -1 | sed 's/^v//'
    
      32}
    
      33
    
      34prepare() {
    
      35  cd "${srcdir}/aurscan-manticore-release-git-bin"
    
      36  git reset --hard "v${pkgver}"
    
      37
    
      38  # go writes: GOMODCACHE (${srcdir}/.go-mod-cache)
    
      39  export GOMODCACHE="${srcdir}/.go-mod-cache"
    
      40  go mod download
    
      41}
    
      42
    
      43check() {
    
      44  cd "${srcdir}/aurscan-manticore-release-git-bin"
    
      45
    
      46  # Verify the release tag's GPG signature against the bundled public key.
    
      47  # git cat-file tag emits the raw tag object: payload lines then a blank line
    
      48  # then the PGP signature block. Split with sed for gpgv.
    
      49  git cat-file tag "v${pkgver}" > "${srcdir}/tag-object"
    
      50  sed '/-----BEGIN PGP SIGNATURE-----/,$d' "${srcdir}/tag-object" > "${srcdir}/tag-payload"
    
      51  sed -n '/-----BEGIN PGP SIGNATURE-----/,/-----END PGP SIGNATURE-----/p' "${srcdir}/tag-object" > "${srcdir}/tag-sig.gpg"
    
      52
    
      53  if [[ ! -s "${srcdir}/tag-sig.gpg" ]]; then
    
      54    printf "GPG verification of tag v%s failed: no signature found\n" "${pkgver}" >&2
    
      55    return 1
    
      56  fi
    
      57  printf 'Verifying signature on git tag v%s:\n' "${pkgver}"
    
      58  gpg --dearmor < "${srcdir}/${_gpg_key_file}" > "${srcdir}/keyring.gpg"
    
      59  gpgv --keyring "${srcdir}/keyring.gpg" \
    
      60    "${srcdir}/tag-sig.gpg" "${srcdir}/tag-payload"
    
      61
    
      62  export GOMODCACHE="${srcdir}/.go-mod-cache"
    
      63  export GOCACHE="${srcdir}/.go-build-cache"
    
      64  go list -f '{{if or .TestGoFiles .XTestGoFiles}}{{.ImportPath}}{{end}}' ./... \
    
      65    | xargs -r go test
    
      66}
    
      67
    
      68build() {
    
      69  sudo "$srcdir/indexer"
    
      70  cd "${srcdir}/aurscan-manticore-release-git-bin"
    
      71  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      72  export CGO_CFLAGS="${CFLAGS}"
    
      73  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      74  export CGO_LDFLAGS="${LDFLAGS}"
    
      75  export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
    
      76  # go writes: GOMODCACHE (${srcdir}/.go-mod-cache), GOCACHE (${srcdir}/.go-build-cache)
    
      77  export GOMODCACHE="${srcdir}/.go-mod-cache"
    
      78  export GOCACHE="${srcdir}/.go-build-cache"
    
      79  local _import="${url#https://}"
    
      80  local _date; _date="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
    
      81  go build -ldflags="-s -w \
    
      82    -X ${_import}/internal/version.Version=v${pkgver} \
    
      83    -X ${_import}/internal/version.Commit=${pkgver} \
    
      84    -X ${_import}/internal/version.Date=${_date}" \
    
      85    -o aurscan "./cmd/aurscan"
    
      86}
    
      87
    
      88package() {
    
      89  cd "${srcdir}/aurscan-manticore-release-git-bin"
    
      90  install -Dm755 aurscan "${pkgdir}/usr/bin/aurscan"
    
      91  ln -s aurscan "${pkgdir}/usr/bin/syay"
    
      92  ln -s aurscan "${pkgdir}/usr/bin/sparu"
    
      93  ln -s aurscan "${pkgdir}/usr/bin/aurscan-edit"
    
      94  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/aurscan-manticore-release-git-bin/LICENSE"
    
      95  install -Dm644 README.md "${pkgdir}/usr/share/doc/aurscan-manticore-release-git-bin/README.md"
    
      96}
    
      97
    
      98# vim:set ts=2 sw=2 et ft=PKGBUILD:
    
      99
    
      100

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 13:23:32	HIGH	2
2026-08-01 13:20:32	HIGH	2