APS

• Description
• Installation
• Usage
• Documentation
• Contributing
• Automated public reports
• License

APS (AUR Patterns Searcher) is a fast and powerful patterns searcher for AUR package sources.
It's a useful tool to get fast, automated and pro-active reports of the presence of knowingly suspicious / malicious patterns in AUR package files.

See the Usage chapter for details.

A (statically linked) pre-compiled binary for the x86_64 (amd64) architecture is distributed as a release asset (aps-<release_version>-x86_64).

The pre-compiled binary can be reproduced from source (in the sense of reproducible builds). The build environment is created and fully documented via repro-env, and is tracked in this repository.

To reproduce the pre-compiled binary for a given release, install repro-env and run the following:

git clone https://github.com/Antiz96/aps.git
cd aps
git checkout <tag> # Where <tag> is the git tag for the targeted release, e.g. "v1.3.0"
repro-env build -- cargo build --release --target x86_64-unknown-linux-musl
sha256sum target/x86_64-unknown-linux-musl/release/aps

Then, compare the sha256 hash of the built binary to the one of the pre-compiled release binary (which is also recorded in the aps-<release_version>-x86_64.sha256 file in the release assets). Both hashes should be equal, indicating that the binary has been successfully reproduced.

Each release assets are also cryptographically signed, with the detached signature for each asset distributed as <asset_name>.asc (see the MAINTAINERS.md file for a list of keys expected to emit signatures).

git clone https://gitlab.archlinux.org/antiz/aps.git
cd aps
cargo build --release

The built binary will be located at ./target/release/aps.

The man page can be generated with scdoc:

scdoc < doc/man/aps.1.scd > doc/man/aps.1

There are also shell completions available in the res/completions/ directory.

Run aps to search for given patterns in AUR packages sources.

It requires a clone of the AUR GitHub mirror. A bare clone is recommended for optimal scanning performance (also see the related --repo and --fetch option flags):
git clone --bare https://github.com/archlinux/aur.git

Search patterns are read from a given file, one pattern per line.
It supports wildcard (*) expansion. Lines starting with # are ignored (see the patterns.txt file from this repository as an example, and the related --patterns option flag).

You can optionally provide a specific list of pkgbases to search patterns for (see the related --pkgbases and --refresh-pkgbases option flags).
Otherwise, aps searches through every pkgbases by default.

See aps --help and the aps(1) man page for more details.

See aps --help and the aps(1) man page.

A periodic run of aps (once per hour) is executed on my own infrastructure, searching for the patterns listed in the patterns.txt file from this repository (feel free to open a merge requests to add patterns).

Scan results are publicly served at https://aps.antiz.fr.

See the contributing guidelines.

APS is licensed under the GPL-3.0 license (or any later version of that license).