Arch Linux User Repository

Search Criteria

Enter search criteria

Search by

Keywords

Out of Date

Sort by

Sort order

Per page

Package Details: aurscan-manticore-release-git 0.7.1-1

Package Actions

Git Clone URL:	https://aur.archlinux.org/aurscan-manticore-release-git.git (read-only, click to copy)
Package Base:	aurscan-manticore-release-git
Description:	LLM-powered pre-build malware scanner for AUR packages (with paru / yay hooks) -- git release
Upstream URL:	https://github.com/manticore-projects/aurscan
Licenses:	Apache-2.0
Conflicts:	aurscan, aurscan-manticore-bin-release-git, aurscan-manticore-release-git
Submitter:	Ataraxy
Maintainer:	Ataraxy
Last Packager:	Ataraxy
Votes:	4
Popularity:	2.86
First Submitted:	2026-06-20 12:16 (UTC)
Last Updated:	2026-07-13 12:49 (UTC)

Dependencies (8)

git (git-git^AUR, git-gl^AUR, git-wd40^AUR) (make)
gnupg (gnupg-git^AUR, gnupg-largekeys^AUR) (make)
go (go-git^AUR, gcc-go-git^AUR, goup-rs^AUR, go-bin^AUR, gcc-go-snapshot^AUR, gcc-go) (make)
claude-code^AUR (claude-code-stable^AUR, claude-code-stable-bin^AUR) (optional) – keyless backend via your Claude subscription
openai-codex (openai-codex-git^AUR, openai-codex-bin^AUR, openai-codex-reasoning^AUR, openai-codex-reasoning-bin^AUR) (optional) – keyless backend via your Codex subscription
paru^AUR (paru-bin^AUR, paru-git^AUR, paru-patch^AUR, paru-alpm-bin^AUR) (optional) – sparu wrapper, PreBuildCommand hook, and --update-check
xdg-utils (busking-git^AUR, xdg-utils-slock^AUR, mimi^AUR, mimi-git^AUR, opener^AUR, mimejs-git^AUR, xdg-utils-mimeo^AUR, xdg-utils-git^AUR) (optional) – open mail client for mailing-list reports
yay^AUR (yay-git^AUR, yay-bin^AUR) (optional) – syay wrapper, editor-gate hook, and --update-check

Required by (0)

Sources (2)

Pinned Comments

Ataraxy commented on 2026-06-20 12:24 (UTC) (edited on 2026-06-20 12:24 (UTC) by Ataraxy)

To skip the LLM checking (which fails closed):

alias paru='AURSCAN_RULES_ONLY=1 /usr/bin/sparu'
alias yay='AURSCAN_RULES_ONLY=1 /usr/bin/syay'

Latest Comments

musdus commented on 2026-07-13 14:11 (UTC)

Hi @Ataraxy,

Bug: read-only go-mod-cache breaks build directory cleanup.

After a build, makepkg/yay/paru fail to remove the build directory:

rm: cannot remove '.../src/.go-mod-cache/mvdan.cc/sh/v3@v3.8.0/...': Permission denied

Cause: prepare() runs go mod download without -modcacherw set, so Go writes the module cache read-only by default. Setting GOFLAGS="...-modcacherw" later in build() doesn't help, since the cache was already written read-only during prepare().

Fix: export GOFLAGS="-modcacherw" in prepare() before go mod download, e.g.

export GOMODCACHE="${srcdir}/.go-mod-cache" export GOFLAGS="-modcacherw" go mod download

That way the cache is writable from creation and cleans up normally afterward.

Ataraxy commented on 2026-06-30 16:09 (UTC)

Thanks @musdus for the report -- I've DRYed the filename into a variable.

musdus commented on 2026-06-25 08:04 (UTC) (edited on 2026-06-25 08:04 (UTC) by musdus)

Bug: filename mismatch in prepare() breaks build.

source= downloads the GPG key as andreas-manticore-projects.gpg, but prepare() line 47 references andreas@manticore-projects.com.gpg — the file is never found and the build fails:

/PKGBUILD: line 47: src/andreas@manticore-projects.com.gpg: No such file or directory

Fix line 47: gpg --dearmor < "${srcdir}/andreas-manticore-projects.gpg" > "${srcdir}/keyring.gpg"

Ataraxy commented on 2026-06-20 12:24 (UTC) (edited on 2026-06-20 12:24 (UTC) by Ataraxy)

To skip the LLM checking (which fails closed):

alias paru='AURSCAN_RULES_ONLY=1 /usr/bin/sparu'
alias yay='AURSCAN_RULES_ONLY=1 /usr/bin/syay'