You are browsing as a guest. Sign up (or log in) to start making projects!

aurek

By @relic_of_sky

  • 3 Devlogs
  • 7 Total hours

AUREK is a Rust-based security wrapper for yay that scans AUR packages before It fetches and analyzes PKGBUILD files to detect suspicious or potentially malicious behavior, including remote script execution, unsafe sudo usage, dangerous commands, obfuscation, suspicious downloads, permission changes, systemd or cron modifications, and other risky patterns. aurek can also use a local gemma model through llama.cpp for context-aware analysis. This works alongside its heuristic and regex-based detection to provide a stronger security check while keeping the analysis on the user's machine.If something suspicious is found, aurek shows the detected issues and asks the user for confirmation before allowing yay to The project is designed to be extensible, with plans for more detection methods, package managers, and security features.

Source
Ship #1 Pending review

@relic_of_sky on aurek

aurek is a rust security wrapper for yay that adds a security check before installing aur packages. aur packages are community maintained and their pkgbuild files can execute arbitrary commands, so aurek fetches and scans the pkgbuild before allowing yay to continue. it uses heuristic and regex based detection for things like remote script execution, suspicious sudo usage, dangerous commands, obfuscation, downloads, permission changes and systemd or cron modifications. starting from v2.0.0, aurek can also use a local gemma model through llama.cpp for context-aware analysis, while keeping the whole process on the users machine with no external api required ,gemma (2b) is easy to run why waste money. v2.1.2 focused on making the workflow easier to use with scan-by-default, /etc/aurek.conf , better llm output, colored terminal output and on v2.1.4 more yay commands including package removal with -R. the project went through several iterations and a few very stupid bugs along the way, including multiple crates.io naming issues(it was really stupid) and a version reporting bug, but those were fixed and v2.1.4 is now published. aurek is not meant to guarantee that a package is safe, but to give users another layer of protection before trusting an aur pkgbuild. the project is open source and still has a roadmap for more detection methods, dependency scanning, additional llm models and support for other package managers.
Also i wd like to add github support also , i am genuinely asking myself if i shld i add paru too , but i believe in yay supremacy , so no.

Try project → See source code →
Open comments for this post

@relic_of_sky on aurek

21m 2s logged

after the version hell , i added -R feature just like yay , now it looks better and to be honest the llm is unpredictable i genuinely advise to use the fallback model its fine for most cases .

2
0
42
Open comments for this post

@relic_of_sky on aurek

3h 6m logged

I have successfully built aurek 2.1.3 , after treating some hillarious bugs , its finally here. try it now on
“https://crates.io/crates/aurek” i found i literally did the same mistake(as v1) ,naming on crates(cargo) requires README.md and on stardance readme.md , i have decided to keep both from now also there were some other bug fix and qol , after the major v2 , for last 3 hrs i have added llm response , a config file on /etc/aurek.conf (yeah here i accidentally added my /home/erox/.config) so main change , added some more bugs to fix later , sank you

0
0
68
Open comments for this post

@relic_of_sky on aurek

3h 41m 34s logged

Aurek v2.0.0 is probably the biggest change the project has had so far. aurek started as a small security wrapper for yay that checks aur packages before installation, mainly using heuristics to look for things like remote script execution, suspicious sudo usage, dangerous commands, chmod 777, base64, eval and other patterns that could be risky inside a pkgbuild. The problem with heuristics is that they only really see patterns, they don’t understand much context, so v2.0.0 adds optional local LLM analysis using Gemma through llama.cpp. Everything runs locally, no external API or internet connection is needed, and aurek handles starting llama-server, waiting for it, running the analysis and shutting it down afterwards. The LLM is meant to be another layer on top of the heuristics, not a replacement for them. v2.0.0 also added Git fallback when the aur API isn’t available and improved some of the package handling. Colored terminal output isn’t actually part of v2.0.0, that’s being worked on for v2.1.0 along with some other improvements. After publishing v2.0.0, a small packaging issue was noticed where the README was named readme.md instead of README.md, which meant crates.io didn’t display it properly. Because of that v2.0.0 was yanked and v2.0.1 was released with the filename fixed, with no actual code or functionality changes. The project itself has been moving along for a while before Stardance too. The v1 devlog couldn’t be published because I wasn’t registered on Stardance(my aadhar was on queue ) at the time, but development kept going and Hackatime picked up on the continued work. So instead of leaving that part undocumented, all three stages are being put together here — v1, v2.0.0 and the small v2.0.1 fix. The next plans are more LLM models, better heuristics, recursive dependency scanning and eventually support for package managers beyond the aur. aurek is still meant to be a security layer, not a guarantee that every package is safe, but the goal is to make checking aur packages a bit less of a just trust this pkgbuild and pray situation.

0
0
17

Delete project?

Are you sure you want to permanently delete this project? This action cannot be undone.

All devlogs, followers, and associated data will be removed.

Followers

Loading…