arch_agent/aur-shield
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8 Commits 1 Branch 0 Tags
b91d9815f3c0cebc55afdcd7b9ebda77f8134a4f
Commit Graph

8 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
arch_agent b91d9815f3 feat: /etc/safe-yay.conf config file 
- Installer writes /etc/safe-yay.conf with SHIELD_HOST/SHIELD_PORT
- safe-yay sources /etc/safe-yay.conf at startup (overrides defaults)
- No more env-var juggling needed
 2026-08-04 10:04:50 +02:00
arch_agent 6619b9240b fix: default SHIELD_HOST to 10.90.9.102 instead of localhost 2026-08-04 10:02:42 +02:00
arch_agent 7000949483 feat: -Syu system update + --check-installed for installed AUR packages 
- safe-yay -Syu: scans AUR updates through AUR-Shield before installing,
  blocks malicious updates, prompts for suspicious ones
- safe-yay --check-installed: checks all installed AUR packages (pacman -Qmq)
  against IOC lists — like archcanary's installed-package scan
- Both use exit codes: 0=clean, 1=warning, 2=malicious
 2026-08-04 10:00:02 +02:00
arch_agent aaaea08d6d fix: AUR RPC URL — /rpc not /rpc/v5 (API path changed) 2026-08-04 09:49:43 +02:00
arch_agent 375d472ecd fix: AUR RPC API 404 — use list params for arg[] encoding 2026-08-04 09:47:40 +02:00
arch_agent f6b5ec4031 feat: extended IOC sources + archcanary features 
Extended IOC sources (from archcanary):
- aur-audit.wtako.net black/red API (3rd-party continuous AUR scanner)
- Community reports list (community-curated malicious packages)
- CHAOS RAT campaign list (backdoor payload)
- Russian spam campaign list (.bashrc injection)

Client features (archcanary-inspired):
- Exit codes: 0=clean, 1=warning, 2=malicious (scriptable)
- --doctor health check (server, ollama, repo status)
- --scan-only mode (scan without building)
- IOC match display in malicious blocks
- Suspicious packages: interactive install prompt

All IOC fetches run concurrently for speed.
 2026-08-04 09:42:02 +02:00
arch_agent 7f46bc8f9a feat: IOC pre-check via public threat intel (AegisAUR integration) 
- ioc_fetcher.py: fetches from HedgeDoc, Atomic Arch Gist, Arch Security
  Tracker, AUR RPC orphan detection (concurrent)
- scanner.py: IOC pre-check before LLM scan — known malicious packages
  get instant MALICIOUS verdict without LLM cost
- typosquatting check with Levenshtein distance
- server.py: API returns ioc_matches + typosquat_matches
- README: threat intel sources documented

Sources ported from AegisAUR (Rust) to Python.
 2026-08-04 09:39:53 +02:00
arch_agent adee5dfc78 aur-shield v0.1.0: AI-powered AUR firewall 
- FastAPI server with scan/build/repo endpoints
- LLM scanner (Ollama) with regex pre-scan
- makepkg/devtools builder with chroot isolation
- Scan cache with TTL + PKGBUILD hash
- Client installer + safe-yay wrapper
- Docs + config example
 2026-08-04 09:35:35 +02:00