This is an install/update as user.
Would be nice if a user can choose with or without --system 
one can simply adjust the function to their needs. I haven’t run it as --system as of yet. I have seen it but keep forgetting about it when I run the command. So I just copied the command the way it was on the command line.
The “downside” is it looks for version the version is related to the pkgbuild but all latest commits after the release are not perse in that version. After that many new commits appear before a new version appears.
Just pull, why not 
I assumed version changed with updates. If this is incorrect then the function is useless
Not now (new release) But in general, I think so too
Just git pull & ./install.sh thats all for an update.
Now where are talking about versions.
A new version. v0.1.26
- multi user scan flag added
- reorder yay sequence. 1e user reviews. second archcanary scan.
- updated: How to read a pkgbuild .md (docs)
- And many more stuff …
well the function was originally for another program I used to have to keep updated I just modified it for this thinking you kept up with versioning for all updates. guess I can retire it again
Does arachcanary use multi-processor/core for scanning?
I would urge you to think of those who have internet issues some of which is data usage. Many hotspot from their phones and when you limited on data every download matters. Some are in area’s that limit data usage so again maybe think of a way those users can keep updated without needing to use their data everytime especially as the project slows down once the kinks are mostly ironed out and it doesn’t require as much time or effort on your part.
Don’t get me wrong I’m very appreciative of this project and only want to help make it better and more friendly.
Do the search without --refresh and the scan does not sync online.
The latest --refresh the user downloaded of course. But thats realy fine.
For Aur-audit (WTAKO) , there is a checkbox switch.
And never updated the other syncs from github. (todo)
archcanary --aur-audit-disable --refresh # This is only useful with --refresh
Ther is a checkbox in the Gui. To enable/disbale syc with WTAKO.
This section need some attention. todo’s
But the question, can one scan without internet = Yes
- Leave
--refreshfrom the search.
fyi
--aur-audit-disable
--aur-audit-enable
--aur-audit-status
Running this via terminal gives no output at all.
Indeed it should show the gui instead.
Does it show the yad gui. Or nothing?
archcanary-gui --no-gui # shows the output in the terminal
For your interest
archcanary-gui --no-gui# always adds --no-notify
Update: Not a version change.
git pull
./install.sh --system
One fix. I got a red flag on firefox-pure from CachyOS. Canary didn’t check the version difference from WTAKO. Now if something is flagged red you get this message:
==> WARNING: Skipping verification of source file PGP signatures.
==> Validating source files with sha256sums...
firefox-153.0.source.tar.xz ... Passed
firefox-symbolic.svg ... Passed
firefox.desktop ... Passed
org.mozilla.firefox.metainfo.xml ... Passed
0001-Install-under-remoting-name.patch ... Passed
firefox-153-patches-01.tar.xz ... Passed
-> firefox-pure: aur-audit flagged RED for a different version (152.0.5-1, 2026-07-11) — installing 153.0-1 —
verify at aur-audit.wtako.net if this looks stale
:: Remove make dependencies after install? [y/N]
A black flag would stop yay from installing.
PS Run this after the pull. If you use yay and interested in the setup.
archcanary --doctor
I wanted to see what Discord-Qt was all about. Installed it. Launched; nothing opened. Removed it via yay -Rns discord-qt. Reinstalled Discord and all is well. Launches as expected.
However, after running Archcanary, I now get this…
Check summary
───────────────────────────────────────────────────────
[1] Package list (2501 pkgs) ✅ clean
[2] pacman.log history ⚠ warnings
[3] Systemd persistence ✅ clean
[4] eBPF rootkit traces ✅ clean
[5] npm cache ✅ clean
[6] bun cache ✅ clean
[6b] yarn cache ✅ clean
[6c] pnpm cache ✅ clean
[7] PKGBUILD obfuscation scan ✅ clean
[8] eBPF programs (bpftool) ✅ clean
[9] ld.so.preload injection ✅ clean
[10] XDG autostart + shell RCs ✅ clean
[11] Kernel modules (DKMS) ✅ clean
[12] Lynis hardening ⚠ skipped (not installed)
[13] Package integrity ✅ clean
───────────────────────────────────────────────────────
============================================================
RESULT: WARNINGS - Review output above.
============================================================
--- [2] Historical pacman logs ---
LOG_HIST: discord-qt (installed on 2026-08-06T11:09:38-0500)
NOTE: historical-only log matches (package no longer installed):
- discord-qt (installed on 2026-08-06T11:09:38-0500)
These were removed at some point after the log entry above, so they are
not an active infection — but if they were compromised while installed,
treat that install-time window as a potential past exposure.
Ideas?
Looks like its just informing you about activity of a program you removed it. I think its just a cautionary statement that only applies if you actually installed something infected.
I suppose that warning will just remain then? I’ll need to remember that next time I run Archcanary.
Good catch, and good news:
This isn’t an active infection.
Discord-qt was one of the ~400 packages from June’s AUR supply-chain incident, so archcanary flagging it is expected.
But checking the package now, it got reassigned to a new maintainer right after the incident broke — a strong sign Arch cleaned it up rather than it staying compromised.
The PKGBUILD itself is plain and harmless: it just downloads the real DiscordQt app and packages it.
Your scan backs this up too — no rogue startup entries, no kernel/eBPF weirdness, nothing. “Installed, didn’t open, removed it” looks like a broken, abandoned package (zero votes on AUR) rather than malware.
One quirk worth knowing:
Archcanary’s list checks names only, not versions, so a cleaned-up package can still get flagged forever — check its AUR page yourself if you want to confirm.
- the lists dont carry versions, only names
Archcanary only reports, it never removes anything, so there was nothing to undo here either way.
I can only say.
Use the output to keep an eye on those sections, read it as a record not per se as a warning.
I think Archcanary has grown quick in a short time, thanks to output I cannot produce. 
Thanks for all your feedback, endeavouros forum users .
Much appreciated 
:
ps: This forum thread is in the readme as a active backstory source.
ps I will remove the warning in the output. I will have second look at the way of showing.
typing…