falco

LOW
maintainer k0ste 0 votes scanned 2026-10-03 00:23:04.761738
View on AUR
Why flagged

The package downloads source tarballs from GitHub's codeload service, which is a legitimate and common practice for AUR packages; all sources are verified via provided sha256sums and used to build the software from official project repositories, posing no executable risk or supply-chain threat.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source tarballs from GitHub's codeload service, which is a legitimate and common practice for AUR packages; all sources are verified via provided sha256sums and used to build the software from official project repositories, posing no executable risk or supply-chain threat.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:25 source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${pkgname}/tar.gz/refs/tags/${pkgver}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Shalygin Konstantin <k0ste@k0ste.ru>
2# Contributor: Shalygin Konstantin <k0ste@k0ste.ru>
3# Contributor: Kris Nóva <kris@nivenly.com> R.I.P.
4
5pkgname='falco'
6pkgver='0.45.0'
7_rules_ver='5.2.0'
8_libs_ver='0.26.0'
9_driver_ver='11.0.0'
10_ctl_ver='0.14.2'
11_p_container_ver='0.7.5'
12pkgrel='1'
13pkgdesc='Falco is a cloud native runtime security tool for Linux operating systems'
14arch=('x86_64' 'aarch64')
15url="https://${pkgname}.org/"
16_uri="github.com/${pkgname}security"
17license=('Apache2.0')
18depends=('curl' 'zlib' 'jsoncpp>=1.9.5' 'libssh2' 'e2fsprogs' 're2' 'onetbb>=2022.1.0' 'yaml-cpp>=0.9.0'
19 'libbpf' 'libelf' 'openssl' 'brotli')
20makedepends=('cmake' 'cxxopts>=3.3.1' 'clang' 'jemalloc' 'go>=1.25.7' 'git' 'bpf' 'gperftools'
21 'cpp-httplib>=0.23.1' 'nlohmann-json>=3.11.3' 'uthash>=1.9.8' 'valijson>=1.0.2')
22checkdepends=('cppcheck')
23backup=("etc/${pkgname}/${pkgname}.yaml"
24 "etc/${pkgname}/${pkgname}_rules.yaml")
25source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${pkgname}/tar.gz/refs/tags/${pkgver}"
26 "rules-${_rules_ver}.tar.gz::https://codeload.${_uri}/rules/tar.gz/refs/tags/${pkgname}-rules-${_rules_ver}"
27 "libs-${_libs_ver}.tar.gz::https://codeload.${_uri}/libs/tar.gz/refs/tags/${_libs_ver}"
28 "libs-${_driver_ver}-driver.tar.gz::https://codeload.${_uri}/libs/tar.gz/refs/tags/${_driver_ver}+driver"
29 "${pkgname}ctl-${_ctl_ver}.tar.gz::https://codeload.${_uri}/${pkgname}ctl/tar.gz/refs/tags/v${_ctl_ver}"
30 "plugins-plugins-container-v${_p_container_ver}.tar.gz::https://codeload.${_uri}/plugins/tar.gz/refs/tags/plugins/container/v${_p_container_ver}"
31 "${pkgname}.service"
32 "${pkgname}.sysusers"
33 "${pkgname}.tmpfiles")
34sha256sums=('6982fc2d00444b35c89b863ca70827383e68be8fd08c3d1551315c909da8c0ee'
35 'b9c16a1de507744a99d67717df3ecaa767782dd95fa73d027775cd576bcfbdc1'
36 '430b90236a345f913387adb4c042e7d9140b4fec128f7ef863b7e53f2fdd5e35'
37 '4120c6363fbbad75a48e8425447f89fb30c3ee2aa5537d2112486dddfcc0e336'
38 '2ac3bd90913933e7fb6f9a722e1b8999dedaaab158c1ea073405d28c491112c1'
39 '820d66250f4537acb1e121cca86b7ce9c47ac7d3e87b16de03047eedd29ebc7f'
40 '64edf36a93fceb949d186505d703c1fb49a47892b63d77d49f4db92ee69df535'
41 'ce971a3f52ab84182146da14651eabbac9b33157bacebe5efc087f461d18bc49'
42 '5c7f1ba69b9af0e919deea901b8b9dfc1fa8d9e287b0c5a189e7dca9956558e1')
43
44prepare() {
45 export GOPATH="${srcdir}/gopath"
46 export GOBIN="${GOPATH}/bin"
47 export GOCACHE="${srcdir}/cache/go-cache"
48 export GOMODCACHE="${srcdir}/cache/go"
49 export GOTMPDIR="${GOPATH}/tmp"
50 mkdir -p "${GOPATH}/src/${_uri}"
51 mkdir -p "${GOTMPDIR}"
52 eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
53 ln -snf "${srcdir}/${pkgname}ctl-${_ctl_ver}" "${GOPATH}/src/${_uri}/${pkgname}ctl"
54
55 # Use distro FORTIFY_SOURCE
56 sed --in-place \
57 --expression 's|-D_FORTIFY_SOURCE=2||g' \
58 "${pkgname}-${pkgver}/cmake/modules/CompilerFlags.cmake"
59
60 # Do not listen 0.0.0.0/0 by default!
61 sed --in-place \
62 --expression 's|listen_address: 0.0.0.0|listen_address: 127.0.0.1|g' \
63 "${pkgname}-${pkgver}/${pkgname}.yaml"
64
65 # plugin/container golang code - set flags for cache
66 sed --in-place \
67 --expression 's|CGO_ENABLED=1||g' \
68 --expression 's|ldflags="-s -w"|ldflags "-linkmode external -extldflags '\''${LDFLAGS}'\''"|g' \
69 --expression 's|go build|go build -trimpath -mod=readonly -modcacherw|g' \
70 "plugins-plugins-container-v${_p_container_ver}/plugins/container/go-worker/Makefile"
71
72 # plugin/container CXX - remove 'fix for legacy compatibility'
73 sed --in-place \
74 --expression 's|-static-libgcc -static-libstdc++||g' \
75 "plugins-plugins-container-v${_p_container_ver}/plugins/container/CMakeLists.txt"
76
77 # plugin/container CXX - do not strip, save debug symbols
78 sed --in-place \
79 --expression 's| -s||g' \
80 "plugins-plugins-container-v${_p_container_ver}/plugins/container/cmake/modules/compiler.cmake"
81}
82
83build() {
84 # This is CMake prepare for plugin/container - very req plugin due hardcode in falco_rules.yaml file
85 cmake -B "plugin-container-build" -S "plugins-plugins-container-v${_p_container_ver}/plugins/container" \
86 -Wno-author \
87 -D CMAKE_BUILD_TYPE="Release" \
88 -D CMAKE_C_FLAGS="${CFLAGS} ${DEBUG_CFLAGS}" \
89 -D CMAKE_EXE_LINKER_FLAGS="${LDFLAGS}" \
90 -D CMAKE_SHARED_LINKER_FLAGS="${LDFLAGS}" \
91 -D LIBS_DIR="${srcdir}/libs-${_libs_ver}" \
92 -D USE_BUNDLED_DEPS=Off \
93 -D USE_BUNDLED_DRIVER=Off \
94 -D USE_BUNDLED_JSONCPP=Off \
95 -D USE_BUNDLED_CXXOPTS=Off \
96 -D USE_BUNDLED_RE2=Off \
97 -D USE_BUNDLED_TBB=Off \
98 -D USE_BUNDLED_UTHASH=Off \
99 -D USE_BUNDLED_VALIJSON=Off \
100 -D USE_BUNDLED_ZLIB=Off
101 # This is build for plugins/container
102 cmake --build "plugin-container-build" --target "container" --config "Release" --verbose
103
104 # This is CMake prepare for eBPF files that req for actual falco build
105 cmake -B "skeleton-build" -S "${pkgname}-${pkgver}" \
106 -Wno-author \
107 -D CMAKE_BUILD_TYPE="Release" \
108 -D CMAKE_C_FLAGS="${CFLAGS} ${DEBUG_CFLAGS}" \
109 -D CMAKE_EXE_LINKER_FLAGS="${LDFLAGS}" \
110 -D CMAKE_SHARED_LINKER_FLAGS="${LDFLAGS}" \
111 -D DRIVER_SOURCE_DIR="${srcdir}/libs-${_driver_ver}-driver/driver" \
112 -D DRIVER_VERSION="${_driver_ver}" \
113 -D FALCOSECURITY_LIBS_SOURCE_DIR="${srcdir}/libs-${_libs_ver}" \
114 -D FALCOSECURITY_LIBS_VERSION="${_libs_ver}" \
115 -D FALCOSECURITY_RULES_FALCO_PATH="${srcdir}/rules-${pkgname}-rules-${_rules_ver}/rules/${pkgname}_rules.yaml" \
116 -D USE_BUNDLED_DEPS=Off \
117 -D USE_BUNDLED_CPPHTTPLIB=Off \
118 -D USE_BUNDLED_DRIVER=Off \
119 -D USE_BUNDLED_JSONCPP=Off \
120 -D USE_BUNDLED_LIBBPF=Off \
121 -D USE_BUNDLED_LIBELF=Off \
122 -D USE_BUNDLED_MODERN_BPF=Off \
123 -D USE_BUNDLED_NLOHMANN_JSON=Off \
124 -D USE_BUNDLED_OPENSSL=Off \
125 -D USE_BUNDLED_RE2=Off \
126 -D USE_BUNDLED_TBB=Off \
127 -D USE_BUNDLED_UTHASH=Off \
128 -D USE_BUNDLED_VALIJSON=Off \
129 -D USE_BUNDLED_YAMLCPP=Off \
130 -D USE_BUNDLED_ZLIB=Off \
131 -D BUILD_DRIVER=Off \
132 -D USE_JEMALLOC=Off \
133 -D BUILD_FALCO_MODERN_BPF=On \
134 -D FALCO_VERSION="${pkgver}"
135 cmake --build "skeleton-build" --target "ProbeSkeleton" --config "Release" --verbose
136
137 # This is CMake prepare for falco
138 cmake -B "build" -S "${pkgname}-${pkgver}" \
139 -Wno-author \
140 -D CMAKE_BUILD_TYPE="Release" \
141 -D CMAKE_C_FLAGS="${CFLAGS} ${DEBUG_CFLAGS}" \
142 -D CMAKE_EXE_LINKER_FLAGS="${LDFLAGS}" \
143 -D CMAKE_SHARED_LINKER_FLAGS="${LDFLAGS}" \
144 -D DRIVER_SOURCE_DIR="${srcdir}/libs-${_driver_ver}-driver/driver" \
145 -D DRIVER_VERSION="${_driver_ver}" \
146 -D FALCOSECURITY_LIBS_SOURCE_DIR="${srcdir}/libs-${_libs_ver}" \
147 -D FALCOSECURITY_LIBS_VERSION="${_libs_ver}" \
148 -D FALCOSECURITY_RULES_FALCO_PATH="${srcdir}/rules-${pkgname}-rules-${_rules_ver}/rules/${pkgname}_rules.yaml" \
149 -D USE_BUNDLED_DEPS=Off \
150 -D USE_BUNDLED_CPPHTTPLIB=Off \
151 -D USE_BUNDLED_DRIVER=Off \
152 -D USE_BUNDLED_JSONCPP=Off \
153 -D USE_BUNDLED_LIBBPF=Off \
154 -D USE_BUNDLED_LIBELF=Off \
155 -D USE_BUNDLED_MODERN_BPF=Off \
156 -D USE_BUNDLED_NLOHMANN_JSON=Off \
157 -D USE_BUNDLED_OPENSSL=Off \
158 -D USE_BUNDLED_RE2=Off \
159 -D USE_BUNDLED_TBB=Off \
160 -D USE_BUNDLED_UTHASH=Off \
161 -D USE_BUNDLED_VALIJSON=Off \
162 -D USE_BUNDLED_YAMLCPP=Off \
163 -D USE_BUNDLED_GPERFTOOLS=Off \
164 -D USE_BUNDLED_ZLIB=Off \
165 -D USE_BUNDLED_GTEST=Off \
166 -D USE_BUNDLED_JEMALLOC=Off \
167 -D CMAKE_INSTALL_PREFIX="/usr" \
168 -D CMAKE_INSTALL_LIBDIR="lib" \
169 -D MODERN_BPF_SKEL_DIR="${srcdir}/skeleton-build/skel_dir" \
170 -D BUILD_FALCO_UNIT_TESTS=Off \
171 -D ENABLE_BENCHMARKS=Off \
172 -D BUILD_DRIVER=Off \
173 -D USE_JEMALLOC=Off \
174 -D BUILD_FALCO_MODERN_BPF=On \
175 -D USE_GPERFTOOLS=On \
176 -D ADD_FALCOCTL_DEPENDENCY=Off \
177 -D FALCO_VERSION="${pkgver}"
178
179 # This is falco build
180 cmake --build "build" --target "falco" --config "Release" --verbose
181
182 # This is falcoctl build (golang)
183 cd "${GOPATH}/src/${_uri}/${pkgname}ctl"
184 eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
185 GOOS="${GOHOSTOS}" GOARCH="${GOHOSTARCH}" \
186 go build \
187 -buildmode="pie" \
188 -trimpath \
189 -mod="readonly" \
190 -modcacherw \
191 -ldflags "-linkmode external -extldflags '${LDFLAGS}' \
192 -X ${_uri}/${pkgname}ctl/cmd/version.semVersion=${_ctl_ver} \
193 -X ${_uri}/${pkgname}ctl/cmd/version.gitCommit=$(git rev-parse HEAD) \
194 -X ${_uri}/${pkgname}ctl/cmd/version.buildDate=$(date -u '+%Y%m%d-%H:%M:%S' --date=@${SOURCE_DATE_EPOCH})"
195}
196
197check() {
198 cmake --build "build" --target "cppcheck"
199 cd "${GOPATH}/src/${_uri}/${pkgname}ctl"
200 TMPDIR="${GOPATH}/tmp" go test -modcacherw -cover ./...
201}
202
203package() {
204 DESTDIR="${pkgdir}" cmake --install "build" --config "release"
205 find "${pkgdir}/usr/lib" -type f -name "*.*a" -delete -print
206 install -Dm0755 "${pkgname}ctl-${_ctl_ver}/${pkgname}ctl" -t "${pkgdir}/usr/bin"
207 install -Dm0644 "${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
208 install -Dm0644 "${pkgname}.service" -t "${pkgdir}/usr/lib/systemd/system"
209 install -Dm0644 "${pkgname}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
210 install -Dm0644 "${pkgname}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
211 # Some compiled stuff from Internet
212 rm --verbose --force "${pkgdir}/usr/share/${pkgname}/plugins/libcontainer.so"
213 install -Dm0755 "plugin-container-build/libcontainer.so" -t \
214"${pkgdir}/usr/share/${pkgname}/plugins"
215}
216

Changes since previous scan

--- PKGBUILD @ 2026-09-29 00:07
+++ PKGBUILD @ 2026-10-03 00:23
@@ -3,13 +3,13 @@
# Contributor: Kris Nóva <kris@nivenly.com> R.I.P.
pkgname='falco'
-pkgver='0.44.1'
-_rules_ver='5.1.0'
-_libs_ver='0.25.4'
-_driver_ver='10.2.0'
-_ctl_ver='0.13.0'
-_p_container_ver='0.7.1'
-pkgrel='5'
+pkgver='0.45.0'
+_rules_ver='5.2.0'
+_libs_ver='0.26.0'
+_driver_ver='11.0.0'
+_ctl_ver='0.14.2'
+_p_container_ver='0.7.5'
+pkgrel='1'
pkgdesc='Falco is a cloud native runtime security tool for Linux operating systems'
arch=('x86_64' 'aarch64')
url="https://${pkgname}.org/"
@@ -31,12 +31,12 @@
"${pkgname}.service"
"${pkgname}.sysusers"
"${pkgname}.tmpfiles")
-sha256sums=('661d0dc62f0eb82352f8b176e423bd34fdc44ca4c98b3f329fd73d984f0c50f5'
- '8b1a9e61030e88ca3e8727cfe20bab8f662d6e2e6b13178e2be57d38e025af24'
- '272a5a0c05e7c10a658ed9649023e6179061a4ab29e012602893586ac64b5938'
- '0e585f5fc2b76696ef2cb902f0901ea39a2f2df87e1f091f3348f968b9085f39'
- '804a37e6372201ee21d3bc99ffea6079484b557ece0aa17719dbc6e8cb2b5fec'
- '111223c2c85344856ac371243efbb0ea4b07538a62738bf80e00bac17e3cf7d6'
+sha256sums=('6982fc2d00444b35c89b863ca70827383e68be8fd08c3d1551315c909da8c0ee'
+ 'b9c16a1de507744a99d67717df3ecaa767782dd95fa73d027775cd576bcfbdc1'
+ '430b90236a345f913387adb4c042e7d9140b4fec128f7ef863b7e53f2fdd5e35'
+ '4120c6363fbbad75a48e8425447f89fb30c3ee2aa5537d2112486dddfcc0e336'
+ '2ac3bd90913933e7fb6f9a722e1b8999dedaaab158c1ea073405d28c491112c1'
+ '820d66250f4537acb1e121cca86b7ce9c47ac7d3e87b16de03047eedd29ebc7f'
'64edf36a93fceb949d186505d703c1fb49a47892b63d77d49f4db92ee69df535'
'ce971a3f52ab84182146da14651eabbac9b33157bacebe5efc087f461d18bc49'
'5c7f1ba69b9af0e919deea901b8b9dfc1fa8d9e287b0c5a189e7dca9956558e1')
@@ -85,6 +85,9 @@
cmake -B "plugin-container-build" -S "plugins-plugins-container-v${_p_container_ver}/plugins/container" \
-Wno-author \
-D CMAKE_BUILD_TYPE="Release" \
+ -D CMAKE_C_FLAGS="${CFLAGS} ${DEBUG_CFLAGS}" \
+ -D CMAKE_EXE_LINKER_FLAGS="${LDFLAGS}" \
+ -D CMAKE_SHARED_LINKER_FLAGS="${LDFLAGS}" \
-D LIBS_DIR="${srcdir}/libs-${_libs_ver}" \
-D USE_BUNDLED_DEPS=Off \
-D USE_BUNDLED_DRIVER=Off \
@@ -96,12 +99,15 @@
-D USE_BUNDLED_VALIJSON=Off \
-D USE_BUNDLED_ZLIB=Off
# This is build for plugins/container
- cmake --build "plugin-container-build" --target "container" --config "Release"
+ cmake --build "plugin-container-build" --target "container" --config "Release" --verbose
# This is CMake prepare for eBPF files that req for actual falco build
cmake -B "skeleton-build" -S "${pkgname}-${pkgver}" \
-Wno-author \
-D CMAKE_BUILD_TYPE="Release" \
+ -D CMAKE_C_FLAGS="${CFLAGS} ${DEBUG_CFLAGS}" \
+ -D CMAKE_EXE_LINKER_FLAGS="${LDFLAGS}" \
+ -D CMAKE_SHARED_LINKER_FLAGS="${LDFLAGS}" \
-D DRIVER_SOURCE_DIR="${srcdir}/libs-${_driver_ver}-driver/driver" \
-D DRIVER_VERSION="${_driver_ver}" \
-D FALCOSECURITY_LIBS_SOURCE_DIR="${srcdir}/libs-${_libs_ver}" \
@@ -126,12 +132,15 @@
-D USE_JEMALLOC=Off \
-D BUILD_FALCO_MODERN_BPF=On \
-D FALCO_VERSION="${pkgver}"
- cmake --build "skeleton-build" --target "ProbeSkeleton" --config "Release"
+ cmake --build "skeleton-build" --target "ProbeSkeleton" --config "Release" --verbose
# This is CMake prepare for falco
cmake -B "build" -S "${pkgname}-${pkgver}" \
-Wno-author \
-D CMAKE_BUILD_TYPE="Release" \
+ -D CMAKE_C_FLAGS="${CFLAGS} ${DEBUG_CFLAGS}" \
+ -D CMAKE_EXE_LINKER_FLAGS="${LDFLAGS}" \
+ -D CMAKE_SHARED_LINKER_FLAGS="${LDFLAGS}" \
-D DRIVER_SOURCE_DIR="${srcdir}/libs-${_driver_ver}-driver/driver" \
-D DRIVER_VERSION="${_driver_ver}" \
-D FALCOSECURITY_LIBS_SOURCE_DIR="${srcdir}/libs-${_libs_ver}" \
@@ -168,7 +177,7 @@
-D FALCO_VERSION="${pkgver}"
# This is falco build
- cmake --build "build" --target "falco" --config "Release"
+ cmake --build "build" --target "falco" --config "Release" --verbose
# This is falcoctl build (golang)
cd "${GOPATH}/src/${_uri}/${pkgname}ctl"
@@ -193,6 +202,7 @@
package() {
DESTDIR="${pkgdir}" cmake --install "build" --config "release"
+ find "${pkgdir}/usr/lib" -type f -name "*.*a" -delete -print
install -Dm0755 "${pkgname}ctl-${_ctl_ver}/${pkgname}ctl" -t "${pkgdir}/usr/bin"
install -Dm0644 "${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
install -Dm0644 "${pkgname}.service" -t "${pkgdir}/usr/lib/systemd/system"

Scan history

Scanned at (UTC)SeverityRules
2026-10-03 00:23:04 Low 2
2026-10-02 00:00:32 Low 2
2026-10-01 00:02:06 Low 2
2026-09-30 00:20:07 Low 2
2026-09-29 09:23:18 Medium 1
2026-09-29 00:07:46 Low 2
2026-09-28 00:28:32 Low 2
2026-09-27 00:07:07 Low 2
2026-09-26 00:12:15 Low 2
2026-09-25 00:03:36 Low 2
2026-09-24 00:24:14 Low 2
2026-09-23 00:28:13 Low 2
2026-09-22 00:15:14 Low 2
2026-09-21 00:26:32 Low 2
2026-09-20 00:25:31 Low 2
2026-09-19 00:25:36 Low 2
2026-09-18 17:28:51 Medium 1
2026-09-18 00:17:11 Low 2
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion