arch_agent
adee5dfc78
- FastAPI server with scan/build/repo endpoints - LLM scanner (Ollama) with regex pre-scan - makepkg/devtools builder with chroot isolation - Scan cache with TTL + PKGBUILD hash - Client installer + safe-yay wrapper - Docs + config example
116 lines
4.0 KiB
Bash
116 lines
4.0 KiB
Bash
#!/usr/bin/env bash
|
|
# AUR-Shield Client Installer
|
|
# Configures pacman to use the AUR-Shield repo
|
|
set -euo pipefail
|
|
|
|
SHIELD_HOST="${AUR_SHIELD_HOST:-localhost}"
|
|
SHIELD_PORT="${AUR_SHIELD_PORT:-8443}"
|
|
|
|
echo "╔══════════════════════════════════════════════╗"
|
|
echo "║ AUR-Shield Client Installer ║"
|
|
echo "╚══════════════════════════════════════════════╝"
|
|
echo ""
|
|
|
|
if ! command -v pacman &>/dev/null; then
|
|
echo "✗ This script requires Arch Linux (pacman)."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Server: http://$SHIELD_HOST:$SHIELD_PORT"
|
|
echo ""
|
|
|
|
# Add pacman repo
|
|
PACMAN_CONF="/etc/pacman.conf"
|
|
REPO_ENTRY="[aur-shield]
|
|
Server = http://$SHIELD_HOST:$SHIELD_PORT/repo
|
|
SigLevel = Never"
|
|
|
|
if grep -q "^\[aur-shield\]" "$PACMAN_CONF"; then
|
|
echo "⚠ [aur-shield] already exists in $PACMAN_CONF — skipping"
|
|
else
|
|
echo "Adding [aur-shield] to $PACMAN_CONF..."
|
|
sudo tee -a "$PACMAN_CONF" > /dev/null << EOF
|
|
|
|
# AUR-Shield — AI-scanned AUR packages
|
|
$REPO_ENTRY
|
|
EOF
|
|
echo "✓ Added repo entry"
|
|
fi
|
|
|
|
# Install safe-yay wrapper
|
|
WRAPPER_PATH="/usr/local/bin/safe-yay"
|
|
echo "Installing safe-yay wrapper to $WRAPPER_PATH..."
|
|
|
|
sudo tee "$WRAPPER_PATH" > /dev/null << 'WRAPPER'
|
|
#!/usr/bin/env bash
|
|
# safe-yay — wrapper that routes AUR packages through AUR-Shield
|
|
set -euo pipefail
|
|
|
|
SHIELD_HOST="${AUR_SHIELD_HOST:-localhost}"
|
|
SHIELD_PORT="${AUR_SHIELD_PORT:-8443}"
|
|
|
|
if [ $# -eq 0 ]; then
|
|
echo "Usage: safe-yay <package> [package2 ...]"
|
|
echo "Scans and builds AUR packages through AUR-Shield"
|
|
exit 0
|
|
fi
|
|
|
|
for pkg in "$@"; do
|
|
echo "→ Processing $pkg..."
|
|
|
|
# Call AUR-Shield to scan + build
|
|
RESPONSE=$(curl -sf "http://$SHIELD_HOST:$SHIELD_PORT/api/build/$pkg" 2>&1) || {
|
|
echo "✗ Failed to process $pkg"
|
|
echo " $RESPONSE"
|
|
continue
|
|
}
|
|
|
|
# Extract verdict
|
|
VERDICT=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.loads(sys.stdin.read()).get('verdict','error'))" 2>/dev/null)
|
|
|
|
case "$VERDICT" in
|
|
clean)
|
|
echo " ✓ Clean — package built and added to repo"
|
|
;;
|
|
suspicious)
|
|
echo " ⚠ Suspicious — package built but review recommended"
|
|
echo " Report: http://$SHIELD_HOST:$SHIELD_PORT/api/report/$pkg"
|
|
;;
|
|
malicious)
|
|
echo " ✗ MALICIOUS — package blocked!"
|
|
echo " Report: http://$SHIELD_HOST:$SHIELD_PORT/api/report/$pkg"
|
|
continue
|
|
;;
|
|
*)
|
|
echo " ? Error: $RESPONSE"
|
|
continue
|
|
;;
|
|
esac
|
|
|
|
# Now install via pacman
|
|
echo " Installing via pacman..."
|
|
sudo pacman -Sy "aur-shield/$pkg" || {
|
|
echo " ⚠ Package not in repo yet — may need to wait for build"
|
|
}
|
|
done
|
|
|
|
echo "Done."
|
|
WRAPPER
|
|
|
|
sudo chmod +x "$WRAPPER_PATH"
|
|
echo "✓ Installed safe-yay"
|
|
|
|
echo ""
|
|
echo "╔══════════════════════════════════════════════╗"
|
|
echo "║ Client setup complete! ║"
|
|
echo "╠══════════════════════════════════════════════╣"
|
|
echo "║ ║"
|
|
echo "║ Usage: ║"
|
|
echo "║ safe-yay <package> ║"
|
|
echo "║ sudo pacman -S aur-shield/<package> ║"
|
|
echo "║ ║"
|
|
echo "║ Set server via env: ║"
|
|
echo "║ export AUR_SHIELD_HOST=10.90.9.102 ║"
|
|
echo "║ export AUR_SHIELD_PORT=8443 ║"
|
|
echo "║ ║"
|
|
echo "╚══════════════════════════════════════════════╝" |