1Content-Type: text/x-zim-wiki 2Wiki-Format: zim 0.6 3Creation-Date: 2026-06-18T14:04:34+01:00 4 5====== AUR inspector ====== 6 7===== INSTRUCTIONS ===== 8 9Inspect this ArchLinux PKGBUILD for security vulnerabilities.10There have been supply chain attacks where malicious code was inserted into packages in subtle ways.11121. Scan these package functions first:13pkgver(), verify(), prepare(), build(), check(), package()14Then scan all the remaining bash functions, e.g. package_pkgname()15162. For each function focus on these vulns:17* command injection in shell scripts,18* reverse shells,19* obfuscated code,20* curl piped to sh,21* any direct file downloads inside the functions (files not specified inside the `source=` array, and without a checksum)22* Obfuscated or encoded commands (hex/octal/base64-assembled strings, eval of a decoded blob) used to hide what the code does23* any eval use24* any use of git inside the prepare(), build() or package() functions25* exfiltrating local data (e.g. SSH/GPG keys, .aws credentials, env vars, browser data, arbitrary files) to a remote host26* downloading code or binaries from an untrusted/unexpected host and executing them (e.g. curl|bash, or fetching a script then chmod +x and running it)27* backdoors, reverse shells, credential/token theft, or tampering with unrelated system files28293. What is allowed:30* `git describe` used inside the pkgver() function is allowed31* checkums (sha256sums, sha512sums, md5sums, b2sums) are usually set to 'SKIP' when version control (git, hg, svn) is used in the source= array32* a version controlled source pointing at a #tag, #branch or #commit is fine33* running the upstream build system (make, cmake, meson, cargo, go) is allowed in the build() and package() functions3435Generate a report of no more than 700 words. The report should be in JSON format with the following format:3637'''38{39package_name: "str",40package_ver: "str",41functions_scanned: [{42	function_name: "str"43	summary: "short 1para summary of function scan"44	result: "suspicious or clean"45}, ],46vulns_scanned: [{47	vuln_name: "str"48	summary: "short 1 para summary of vuln scan"49	result: "suspicious or clean"50}, ],51allowed_found: [{52	allow_name: "str",53	summary: "1 line about why it is allowed"54}, ],55overall_summary: "2-4 paras of summary",56is_suspicious: bool,57is_clean: bool,58}59'''