falco

MEDIUM
maintainer k0ste 0 votes scanned 2026-08-19 13:41:59.633391
View on AUR
Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:22 source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${pkgname}/tar.gz/refs/tags/${pkgver}"
Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Shalygin Konstantin <k0ste@k0ste.ru>
2# Contributor: Shalygin Konstantin <k0ste@k0ste.ru>
3# Contributor: Kris Nóva <kris@nivenly.com> R.I.P.
4
5pkgname='falco'
6pkgver='0.44.1'
7_rules_ver='5.1.0'
8_libs_ver='0.25.4'
9_driver_ver='10.2.0'
10_ctl_ver='0.13.0'
11pkgrel='2'
12pkgdesc='Falco is a cloud native runtime security tool for Linux operating systems'
13arch=('x86_64' 'aarch64')
14url="https://${pkgname}.org/"
15_uri="github.com/${pkgname}security"
16license=('Apache2.0')
17depends=('curl' 'zlib' 'jsoncpp>=1.9.5' 'libssh2' 'e2fsprogs' 're2' 'onetbb>=2022.1.0' 'yaml-cpp>=0.9.0' 'libbpf' 'libelf' 'openssl' 'brotli')
18makedepends=('cmake' 'cxxopts>=3.3.1' 'clang' 'jemalloc' 'go>=1.25.7' 'git' 'bpf' 'gperftools' 'cpp-httplib>=0.23.1' 'nlohmann-json>=3.11.3' 'uthash>=1.9.8' 'valijson>=1.0.2')
19checkdepends=('cppcheck')
20backup=("etc/${pkgname}/${pkgname}.yaml"
21 "etc/${pkgname}/${pkgname}_rules.yaml")
22source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${pkgname}/tar.gz/refs/tags/${pkgver}"
23 "rules-${_rules_ver}.tar.gz::https://codeload.${_uri}/rules/tar.gz/refs/tags/${pkgname}-rules-${_rules_ver}"
24 "libs-${_libs_ver}.tar.gz::https://codeload.${_uri}/libs/tar.gz/refs/tags/${_libs_ver}"
25 "libs-${_driver_ver}-driver.tar.gz::https://codeload.${_uri}/libs/tar.gz/refs/tags/${_driver_ver}+driver"
26 "${pkgname}ctl-${_ctl_ver}.tar.gz::https://codeload.${_uri}/${pkgname}ctl/tar.gz/refs/tags/v${_ctl_ver}"
27 "${pkgname}.service"
28 "${pkgname}.sysusers")
29sha256sums=('661d0dc62f0eb82352f8b176e423bd34fdc44ca4c98b3f329fd73d984f0c50f5'
30 '8b1a9e61030e88ca3e8727cfe20bab8f662d6e2e6b13178e2be57d38e025af24'
31 '272a5a0c05e7c10a658ed9649023e6179061a4ab29e012602893586ac64b5938'
32 '0e585f5fc2b76696ef2cb902f0901ea39a2f2df87e1f091f3348f968b9085f39'
33 '804a37e6372201ee21d3bc99ffea6079484b557ece0aa17719dbc6e8cb2b5fec'
34 '842dc610acb6d9df53bb0b225fda96ddb1e1b2560c9fd511fafefbe2ab9c22a6'
35 'ce971a3f52ab84182146da14651eabbac9b33157bacebe5efc087f461d18bc49')
36
37prepare() {
38 export GOPATH="${srcdir}/gopath"
39 export GOBIN="${GOPATH}/bin"
40 export GOCACHE="${srcdir}/cache/go-cache"
41 export GOMODCACHE="${srcdir}/cache/go"
42 export GOTMPDIR="${GOPATH}/tmp"
43 mkdir -p "${GOPATH}/src/${_uri}"
44 mkdir -p "${GOTMPDIR}"
45 eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
46 ln -snf "${srcdir}/${pkgname}ctl-${_ctl_ver}" "${GOPATH}/src/${_uri}/${pkgname}ctl"
47
48 # Use distro FORTIFY_SOURCE
49 sed --in-place \
50 --expression 's|-D_FORTIFY_SOURCE=2||g' \
51 "${pkgname}-${pkgver}/cmake/modules/CompilerFlags.cmake"
52
53 # Do not listen 0.0.0.0/0 by default!
54 sed --in-place \
55 --expression 's|listen_address: 0.0.0.0|listen_address: 127.0.0.1|g' \
56 "${pkgname}-${pkgver}/${pkgname}.yaml"
57
58 cmake -B "skeleton-build" -S "${pkgname}-${pkgver}" \
59 -Wno-author \
60 -D CMAKE_BUILD_TYPE="Release" \
61 -D FETCHCONTENT_FULLY_DISCONNECTED=On \
62 -D DRIVER_SOURCE_DIR="${srcdir}/libs-${_driver_ver}-driver/driver" \
63 -D DRIVER_VERSION="${_driver_ver}" \
64 -D FALCOSECURITY_LIBS_SOURCE_DIR="${srcdir}/libs-${_libs_ver}" \
65 -D FALCOSECURITY_LIBS_VERSION="${_libs_ver}" \
66 -D FALCOSECURITY_RULES_FALCO_PATH="${srcdir}/rules-${pkgname}-rules-${_rules_ver}/rules/${pkgname}_rules.yaml" \
67 -D USE_BUNDLED_DEPS=Off \
68 -D USE_BUNDLED_CPPHTTPLIB=Off \
69 -D USE_BUNDLED_DRIVER=Off \
70 -D USE_BUNDLED_JSONCPP=Off \
71 -D USE_BUNDLED_LIBBPF=Off \
72 -D USE_BUNDLED_LIBELF=Off \
73 -D USE_BUNDLED_MODERN_BPF=Off \
74 -D USE_BUNDLED_NLOHMANN_JSON=Off \
75 -D USE_BUNDLED_OPENSSL=Off \
76 -D USE_BUNDLED_RE2=Off \
77 -D USE_BUNDLED_TBB=Off \
78 -D USE_BUNDLED_UTHASH=Off \
79 -D USE_BUNDLED_VALIJSON=Off \
80 -D USE_BUNDLED_YAMLCPP=Off \
81 -D USE_BUNDLED_ZLIB=Off \
82 -D USE_BUNDLED_GTEST=Off \
83 -D USE_BUNDLED_JEMALLOC=Off \
84 -D BUILD_DRIVER=Off \
85 -D USE_JEMALLOC=Off \
86 -D BUILD_FALCO_MODERN_BPF=On \
87 -D FALCO_VERSION="${pkgver}"
88 cmake --build "skeleton-build" --target "ProbeSkeleton"
89}
90
91build() {
92 cmake -B "build" -S "${pkgname}-${pkgver}" \
93 -Wno-author \
94 -D CMAKE_BUILD_TYPE="Release" \
95 -D FETCHCONTENT_FULLY_DISCONNECTED=On \
96 -D DRIVER_SOURCE_DIR="${srcdir}/libs-${_driver_ver}-driver/driver" \
97 -D DRIVER_VERSION="${_driver_ver}" \
98 -D FALCOSECURITY_LIBS_SOURCE_DIR="${srcdir}/libs-${_libs_ver}" \
99 -D FALCOSECURITY_LIBS_VERSION="${_libs_ver}" \
100 -D FALCOSECURITY_RULES_FALCO_PATH="${srcdir}/rules-${pkgname}-rules-${_rules_ver}/rules/${pkgname}_rules.yaml" \
101 -D USE_BUNDLED_DEPS=Off \
102 -D USE_BUNDLED_CPPHTTPLIB=Off \
103 -D USE_BUNDLED_DRIVER=Off \
104 -D USE_BUNDLED_JSONCPP=Off \
105 -D USE_BUNDLED_LIBBPF=Off \
106 -D USE_BUNDLED_LIBELF=Off \
107 -D USE_BUNDLED_MODERN_BPF=Off \
108 -D USE_BUNDLED_NLOHMANN_JSON=Off \
109 -D USE_BUNDLED_OPENSSL=Off \
110 -D USE_BUNDLED_RE2=Off \
111 -D USE_BUNDLED_TBB=Off \
112 -D USE_BUNDLED_UTHASH=Off \
113 -D USE_BUNDLED_VALIJSON=Off \
114 -D USE_BUNDLED_YAMLCPP=Off \
115 -D USE_BUNDLED_GPERFTOOLS=Off \
116 -D USE_BUNDLED_ZLIB=Off \
117 -D USE_BUNDLED_GTEST=Off \
118 -D USE_BUNDLED_JEMALLOC=Off \
119 -D CMAKE_INSTALL_PREFIX="/usr" \
120 -D CMAKE_INSTALL_LIBDIR="lib" \
121 -D MODERN_BPF_SKEL_DIR="${srcdir}/skeleton-build/skel_dir" \
122 -D BUILD_FALCO_UNIT_TESTS=Off \
123 -D ENABLE_BENCHMARKS=Off \
124 -D BUILD_DRIVER=Off \
125 -D USE_JEMALLOC=Off \
126 -D BUILD_FALCO_MODERN_BPF=On \
127 -D USE_GPERFTOOLS=On \
128 -D ADD_FALCOCTL_DEPENDENCY=Off \
129 -D FALCO_VERSION="${pkgver}"
130 cmake --build "build" --target "falco"
131
132 cd "${GOPATH}/src/${_uri}/${pkgname}ctl"
133 eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
134 GOOS="${GOHOSTOS}" GOARCH="${GOHOSTARCH}" \
135 go build \
136 -buildmode="pie" \
137 -trimpath \
138 -mod="readonly" \
139 -modcacherw \
140 -ldflags "-linkmode external -extldflags '${LDFLAGS}' \
141 -X ${_uri}/${pkgname}ctl/cmd/version.semVersion=${_ctl_ver} \
142 -X ${_uri}/${pkgname}ctl/cmd/version.gitCommit=$(git rev-parse HEAD) \
143 -X ${_uri}/${pkgname}ctl/cmd/version.buildDate=$(date -u '+%Y%m%d-%H:%M:%S' --date=@${SOURCE_DATE_EPOCH})"
144}
145
146check() {
147 cmake --build "build" --target "cppcheck"
148 cd "${GOPATH}/src/${_uri}/${pkgname}ctl"
149 TMPDIR="${GOPATH}/tmp" go test -modcacherw -cover ./...
150}
151
152package() {
153 DESTDIR="${pkgdir}" cmake --install "build" --config "release"
154 install -Dm0644 "${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
155 install -Dm0644 "${pkgname}.service" -t "${pkgdir}/usr/lib/systemd/system"
156 install -Dm0644 "${pkgname}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
157 # Some compiled stuff from Internet
158 rm -rf "${pkgdir}/usr/share/${pkgname}/plugins"
159}
160

Changes since previous scan

--- PKGBUILD @ 2026-08-16 00:03
+++ PKGBUILD @ 2026-08-19 13:41
@@ -1,67 +1,160 @@
-# Maintainer: brokenpip3 <brokenpip3[at]gmail[dot]com>
-# https://github.com/brokenpip3/my-pkgbuilds
+# Maintainer: Shalygin Konstantin <k0ste@k0ste.ru>
+# Contributor: Shalygin Konstantin <k0ste@k0ste.ru>
# Contributor: Kris Nóva <kris@nivenly.com> R.I.P.
-pkgbase=falco
-pkgname=falco
-provides=(falco)
-conflicts=(falco-bin)
-backup=('etc/falco/falco_rules.yaml' 'etc/falco/falco.yaml')
-pkgver=0.40.0
-pkgrel=1
-pkgdesc="Cloud native runtime security. Modern ebpf and config files"
-arch=(x86_64)
-license=(Apache)
-makedepends=(cmake git c-ares jq grpc yaml-cpp clang linux-headers llvm nlohmann-json cpp-httplib cxxopts)
-optdepends=(
- "falco-probe-ebpf: ebpf probe"
- "falco-module-dkms: dkms module"
- "falcoctl: administrative tooling for Falco"
- "falcosidekick: connect Falco to your ecosystem"
-)
-url="https://github.com/falcosecurity/falco"
-_rules_tag="falco-rules-3.2.0"
-source_x86_64=(
- "falco-${pkgver}.tar.gz::$url/archive/refs/tags/$pkgver.tar.gz"
- "git+https://github.com/falcosecurity/rules#tag=${_rules_tag}"
- "falco-modern-bpf.service"
-)
-sha256sums_x86_64=('8009dc87263ebd9c55811ef2f90f0a4c0faf494baef1edf1f91c83d701e751f1'
- 'e2c117951ccbab473569894bd22aa95aac3704e52aefd7023563806eb9f5e98c'
- '0709add709184db8a275a5c7c6b6b4123b6dc418e72f7c9d4ab6dcc1d5ab2644')
+pkgname='falco'
+pkgver='0.44.1'
+_rules_ver='5.1.0'
+_libs_ver='0.25.4'
+_driver_ver='10.2.0'
+_ctl_ver='0.13.0'
+pkgrel='2'
+pkgdesc='Falco is a cloud native runtime security tool for Linux operating systems'
+arch=('x86_64' 'aarch64')
+url="https://${pkgname}.org/"
+_uri="github.com/${pkgname}security"
+license=('Apache2.0')
+depends=('curl' 'zlib' 'jsoncpp>=1.9.5' 'libssh2' 'e2fsprogs' 're2' 'onetbb>=2022.1.0' 'yaml-cpp>=0.9.0' 'libbpf' 'libelf' 'openssl' 'brotli')
+makedepends=('cmake' 'cxxopts>=3.3.1' 'clang' 'jemalloc' 'go>=1.25.7' 'git' 'bpf' 'gperftools' 'cpp-httplib>=0.23.1' 'nlohmann-json>=3.11.3' 'uthash>=1.9.8' 'valijson>=1.0.2')
+checkdepends=('cppcheck')
+backup=("etc/${pkgname}/${pkgname}.yaml"
+ "etc/${pkgname}/${pkgname}_rules.yaml")
+source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${pkgname}/tar.gz/refs/tags/${pkgver}"
+ "rules-${_rules_ver}.tar.gz::https://codeload.${_uri}/rules/tar.gz/refs/tags/${pkgname}-rules-${_rules_ver}"
+ "libs-${_libs_ver}.tar.gz::https://codeload.${_uri}/libs/tar.gz/refs/tags/${_libs_ver}"
+ "libs-${_driver_ver}-driver.tar.gz::https://codeload.${_uri}/libs/tar.gz/refs/tags/${_driver_ver}+driver"
+ "${pkgname}ctl-${_ctl_ver}.tar.gz::https://codeload.${_uri}/${pkgname}ctl/tar.gz/refs/tags/v${_ctl_ver}"
+ "${pkgname}.service"
+ "${pkgname}.sysusers")
+sha256sums=('661d0dc62f0eb82352f8b176e423bd34fdc44ca4c98b3f329fd73d984f0c50f5'
+ '8b1a9e61030e88ca3e8727cfe20bab8f662d6e2e6b13178e2be57d38e025af24'
+ '272a5a0c05e7c10a658ed9649023e6179061a4ab29e012602893586ac64b5938'
+ '0e585f5fc2b76696ef2cb902f0901ea39a2f2df87e1f091f3348f968b9085f39'
+ '804a37e6372201ee21d3bc99ffea6079484b557ece0aa17719dbc6e8cb2b5fec'
+ '842dc610acb6d9df53bb0b225fda96ddb1e1b2560c9fd511fafefbe2ab9c22a6'
+ 'ce971a3f52ab84182146da14651eabbac9b33157bacebe5efc087f461d18bc49')
prepare() {
- cd "${srcdir}/falco-${pkgver}"
- [[ -d build ]] || mkdir build
- [[ -d skeleton ]] || mkdir skeleton
- cd skeleton
- cmake .. -DUSE_BUNDLED_DEPS=false \
- -DBUILD_FALCO_MODERN_BPF=ON \
- -DCREATE_TEST_TARGETS=Off \
- -DFALCO_VERSION=${pkgver}
- make ProbeSkeleton
+ export GOPATH="${srcdir}/gopath"
+ export GOBIN="${GOPATH}/bin"
+ export GOCACHE="${srcdir}/cache/go-cache"
+ export GOMODCACHE="${srcdir}/cache/go"
+ export GOTMPDIR="${GOPATH}/tmp"
+ mkdir -p "${GOPATH}/src/${_uri}"
+ mkdir -p "${GOTMPDIR}"
+ eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
+ ln -snf "${srcdir}/${pkgname}ctl-${_ctl_ver}" "${GOPATH}/src/${_uri}/${pkgname}ctl"
+
+ # Use distro FORTIFY_SOURCE
+ sed --in-place \
+ --expression 's|-D_FORTIFY_SOURCE=2||g' \
+ "${pkgname}-${pkgver}/cmake/modules/CompilerFlags.cmake"
+
+ # Do not listen 0.0.0.0/0 by default!
+ sed --in-place \
+ --expression 's|listen_address: 0.0.0.0|listen_address: 127.0.0.1|g' \
+ "${pkgname}-${pkgver}/${pkgname}.yaml"
+
+ cmake -B "skeleton-build" -S "${pkgname}-${pkgver}" \
+ -Wno-author \
+ -D CMAKE_BUILD_TYPE="Release" \
+ -D FETCHCONTENT_FULLY_DISCONNECTED=On \
+ -D DRIVER_SOURCE_DIR="${srcdir}/libs-${_driver_ver}-driver/driver" \
+ -D DRIVER_VERSION="${_driver_ver}" \
+ -D FALCOSECURITY_LIBS_SOURCE_DIR="${srcdir}/libs-${_libs_ver}" \
+ -D FALCOSECURITY_LIBS_VERSION="${_libs_ver}" \
+ -D FALCOSECURITY_RULES_FALCO_PATH="${srcdir}/rules-${pkgname}-rules-${_rules_ver}/rules/${pkgname}_rules.yaml" \
+ -D USE_BUNDLED_DEPS=Off \
+ -D USE_BUNDLED_CPPHTTPLIB=Off \
+ -D USE_BUNDLED_DRIVER=Off \
+ -D USE_BUNDLED_JSONCPP=Off \
+ -D USE_BUNDLED_LIBBPF=Off \
+ -D USE_BUNDLED_LIBELF=Off \
+ -D USE_BUNDLED_MODERN_BPF=Off \
+ -D USE_BUNDLED_NLOHMANN_JSON=Off \
+ -D USE_BUNDLED_OPENSSL=Off \
+ -D USE_BUNDLED_RE2=Off \
+ -D USE_BUNDLED_TBB=Off \
+ -D USE_BUNDLED_UTHASH=Off \
+ -D USE_BUNDLED_VALIJSON=Off \
+ -D USE_BUNDLED_YAMLCPP=Off \
+ -D USE_BUNDLED_ZLIB=Off \
+ -D USE_BUNDLED_GTEST=Off \
+ -D USE_BUNDLED_JEMALLOC=Off \
+ -D BUILD_DRIVER=Off \
+ -D USE_JEMALLOC=Off \
+ -D BUILD_FALCO_MODERN_BPF=On \
+ -D FALCO_VERSION="${pkgver}"
+ cmake --build "skeleton-build" --target "ProbeSkeleton"
}
build() {
- cd "${srcdir}/falco-${pkgver}/build"
- cmake .. \
- -DCMAKE_BUILD_TYPE=Release \
- -DCMAKE_INSTALL_PREFIX=/usr \
- -DUSE_BUNDLED_DEPS=false \
- -DBUILD_FALCO_MODERN_BPF=ON \
- -DMODERN_BPF_SKEL_DIR=${srcdir}/falco-${pkgver}/skeleton/skel_dir \
- -DBUILD_DRIVER=Off \
- -DBUILD_BPF=Off \
- -DFALCO_VERSION=${pkgver}
- make falco -j6
+ cmake -B "build" -S "${pkgname}-${pkgver}" \
+ -Wno-author \
+ -D CMAKE_BUILD_TYPE="Release" \
+ -D FETCHCONTENT_FULLY_DISCONNECTED=On \
+ -D DRIVER_SOURCE_DIR="${srcdir}/libs-${_driver_ver}-driver/driver" \
+ -D DRIVER_VERSION="${_driver_ver}" \
+ -D FALCOSECURITY_LIBS_SOURCE_DIR="${srcdir}/libs-${_libs_ver}" \
+ -D FALCOSECURITY_LIBS_VERSION="${_libs_ver}" \
+ -D FALCOSECURITY_RULES_FALCO_PATH="${srcdir}/rules-${pkgname}-rules-${_rules_ver}/rules/${pkgname}_rules.yaml" \
+ -D USE_BUNDLED_DEPS=Off \
+ -D USE_BUNDLED_CPPHTTPLIB=Off \
+ -D USE_BUNDLED_DRIVER=Off \
+ -D USE_BUNDLED_JSONCPP=Off \
+ -D USE_BUNDLED_LIBBPF=Off \
+ -D USE_BUNDLED_LIBELF=Off \
+ -D USE_BUNDLED_MODERN_BPF=Off \
+ -D USE_BUNDLED_NLOHMANN_JSON=Off \
+ -D USE_BUNDLED_OPENSSL=Off \
+ -D USE_BUNDLED_RE2=Off \
+ -D USE_BUNDLED_TBB=Off \
+ -D USE_BUNDLED_UTHASH=Off \
+ -D USE_BUNDLED_VALIJSON=Off \
+ -D USE_BUNDLED_YAMLCPP=Off \
+ -D USE_BUNDLED_GPERFTOOLS=Off \
+ -D USE_BUNDLED_ZLIB=Off \
+ -D USE_BUNDLED_GTEST=Off \
+ -D USE_BUNDLED_JEMALLOC=Off \
+ -D CMAKE_INSTALL_PREFIX="/usr" \
+ -D CMAKE_INSTALL_LIBDIR="lib" \
+ -D MODERN_BPF_SKEL_DIR="${srcdir}/skeleton-build/skel_dir" \
+ -D BUILD_FALCO_UNIT_TESTS=Off \
+ -D ENABLE_BENCHMARKS=Off \
+ -D BUILD_DRIVER=Off \
+ -D USE_JEMALLOC=Off \
+ -D BUILD_FALCO_MODERN_BPF=On \
+ -D USE_GPERFTOOLS=On \
+ -D ADD_FALCOCTL_DEPENDENCY=Off \
+ -D FALCO_VERSION="${pkgver}"
+ cmake --build "build" --target "falco"
+
+ cd "${GOPATH}/src/${_uri}/${pkgname}ctl"
+ eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
+ GOOS="${GOHOSTOS}" GOARCH="${GOHOSTARCH}" \
+ go build \
+ -buildmode="pie" \
+ -trimpath \
+ -mod="readonly" \
+ -modcacherw \
+ -ldflags "-linkmode external -extldflags '${LDFLAGS}' \
+ -X ${_uri}/${pkgname}ctl/cmd/version.semVersion=${_ctl_ver} \
+ -X ${_uri}/${pkgname}ctl/cmd/version.gitCommit=$(git rev-parse HEAD) \
+ -X ${_uri}/${pkgname}ctl/cmd/version.buildDate=$(date -u '+%Y%m%d-%H:%M:%S' --date=@${SOURCE_DATE_EPOCH})"
+}
+
+check() {
+ cmake --build "build" --target "cppcheck"
+ cd "${GOPATH}/src/${_uri}/${pkgname}ctl"
+ TMPDIR="${GOPATH}/tmp" go test -modcacherw -cover ./...
}
package() {
- install -Dm755 "${srcdir}/falco-${pkgver}/build/userspace/falco/falco" "${pkgdir}/usr/bin/falco"
- install -Dm644 "${srcdir}/falco-${pkgver}/falco.yaml" "${pkgdir}/etc/falco/falco.yaml"
- install -Dm644 "${srcdir}/rules/rules/falco_rules.yaml" "${pkgdir}/etc/falco/falco_rules.yaml"
- install -d "${pkgdir}/etc/falco/rules.d"
- sed -i 's#probe: ${HOME}/.falco/falco-bpf.o#probe: /usr/share/falco/falco-bpf.o#' "${pkgdir}/etc/falco/falco.yaml"
- install -Dm644 "falco-modern-bpf.service" "${pkgdir}/usr/lib/systemd/system/falco-modern-bpf.service"
+ DESTDIR="${pkgdir}" cmake --install "build" --config "release"
+ install -Dm0644 "${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm0644 "${pkgname}.service" -t "${pkgdir}/usr/lib/systemd/system"
+ install -Dm0644 "${pkgname}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
+ # Some compiled stuff from Internet
+ rm -rf "${pkgdir}/usr/share/${pkgname}/plugins"
}

Scan history

Scanned at (UTC)SeverityRules
2026-08-19 13:41:59 Medium 2
2026-08-16 00:03:42 Clean 2
2026-08-15 15:30:38 Medium 1
2026-08-15 13:30:33 Medium 1
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion