Aurek v2.0.0 is probably the biggest change the project has had so far. aurek started as a small security wrapper for yay that checks aur packages before installation, mainly using heuristics to look for things like remote script execution, suspicious sudo usage, dangerous commands, chmod 777, base64, eval and other patterns that could be risky inside a pkgbuild. The problem with heuristics is that they only really see patterns, they don’t understand much context, so v2.0.0 adds optional local LLM analysis using Gemma through llama.cpp. Everything runs locally, no external API or internet connection is needed, and aurek handles starting llama-server, waiting for it, running the analysis and shutting it down afterwards. The LLM is meant to be another layer on top of the heuristics, not a replacement for them. v2.0.0 also added Git fallback when the aur API isn’t available and improved some of the package handling. Colored terminal output isn’t actually part of v2.0.0, that’s being worked on for v2.1.0 along with some other improvements. After publishing v2.0.0, a small packaging issue was noticed where the README was named readme.md instead of README.md, which meant crates.io didn’t display it properly. Because of that v2.0.0 was yanked and v2.0.1 was released with the filename fixed, with no actual code or functionality changes. The project itself has been moving along for a while before Stardance too. The v1 devlog couldn’t be published because I wasn’t registered on Stardance(my aadhar was on queue ) at the time, but development kept going and Hackatime picked up on the continued work. So instead of leaving that part undocumented, all three stages are being put together here — v1, v2.0.0 and the small v2.0.1 fix. The next plans are more LLM models, better heuristics, recursive dependency scanning and eventually support for package managers beyond the aur. aurek is still meant to be a security layer, not a guarantee that every package is safe, but the goal is to make checking aur packages a bit less of a just trust this pkgbuild and pray situation.
Comments 0
No comments yet. Be the first!
Sign in to join the conversation.