Archcanary — a layered security scanner for Arch-based Linux

ps I see you have init.lua for yay in the config. Have a look at.

The init.lua is not copied when there is already a ini.lua from yay.

During installation: The init.lua is not copied when there is already a ini.lua.

First: thanks for this awesome tool. But now, I’ve got the same pacman.log results as seen here…

Apparently, I don’t have any currently infected foreign packages per [1], but per [2] I previously had some packages (back in time) that had subsequently become infected during these recent troubling times for orphan packages.

However, since they’re now gone (i.e., I uninstalled them without having updated from the AUR when recent news of orphaned package attacks broke), I presume I can ignore this pacman.log warning.

QUESTION: Assuming my logic is reasonable, is there then a way to refresh my pacman log history - to avoid getting this warning forever going forward? Would a log reset or erasure wipe out other critical pacman functionality?

Yeah looks much better.

@UncleSpellbinder
Good catch,

And thanks for confirming the wording fix worked.
Turns out 3 of your 4 apps (Gearlever, MEGAsync, Eloquent) were a different problem than Conky’s — they’re Flatpak apps, and archcanary didn’t yet recognize Flatpak’s export directories as a trusted location.

Fixed now: git pull && ./install.sh # to get the latest commits

pCloud will still show up — that one’s a manually-installed binary in a non-standard spot, so there’s no safe way to auto-recognize it. The warning itself now tells you the exact command to mark it known-good:

archcanary --allowlist-add=autostart:"/home/wombat/.config/pcloud/pcloud-launcher.sh"

Btw the answer is in the warning:

If you recognize this app (e.g. an AppImage/Flatpak launcher or a
     personal script), mark it known-good: archcanary --allowlist-add=autostart:"/home/wombat/.config/pcloud/pcloud-launcher.sh"

:penguin:

It says pcloud-launcher and gearleever are “already added” to the allowlist. Yet pcloud launcher still shows up as a warning while gearlever shows as “info”…

╭─ ~ ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 11:18:57 AM 
╰─❯ cd archcanary

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 11:19:23 AM 
╰─❯ git pull
Already up to date.

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 11:19:31 AM 
╰─❯ ./install.sh
Installing to: /home/wombat/.local/bin
Config dir:    /home/wombat/.config/archcanary

  installed: /home/wombat/.local/bin/archcanary
  installed: /home/wombat/.local/bin/archcanary-gui
  installed: /home/wombat/.local/share/man/man1/archcanary.1
  installed: /home/wombat/.local/share/bash-completion/completions/{archcanary,canary}
  installed: /home/wombat/.local/share/applications/archcanary.desktop
  kept:      /home/wombat/.config/archcanary/package_list.txt (already exists)
  kept:      /home/wombat/.config/archcanary/malicious_npm_packages.txt (already exists)
  kept:      /home/wombat/.config/yay/init.lua (already exists)

Done. Run: archcanary --refresh --full

WARNING: /home/wombat/.local/bin is not in your PATH.
Add this to your shell profile:
  export PATH="$PATH:/home/wombat/.local/bin"

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 11:19:37 AM 
╰─❯ export PATH="$PATH:/home/wombat/.local/bin"

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 11:19:43 AM 
╰─❯ pkexec archcanary --allowlist-add=autostart:gearlever
already allowlisted: gearlever

╭─ ~/archcanary  master ─────────────────────────────────────────────────────────────────────────────────────────────────── 4s  11:19:52 AM 
╰─❯ pkexec archcanary --allowlist-add=autostart:"/home/wombat/.config/pcloud/pcloud-launcher.sh"
already allowlisted: /home/wombat/.config/pcloud/pcloud-launcher.sh

╭─ ~/archcanary  master ─────────────────────────────────────────────────────────────────────────────────────────────────── 3s  11:20:10 AM 
╰─❯ archcanary --refresh --full
Fetching infected package list...
Updating /home/wombat/.config/archcanary/package_list.txt...
Fetching malicious npm list...
Updated /home/wombat/.config/archcanary/malicious_npm_packages.txt (4 entries)
Fetching CHAOS RAT list...
Updated /home/wombat/.config/archcanary/chaos_rat_packages.txt (7 entries)
Fetching Russian spam list...
Updated /home/wombat/.config/archcanary/malicious_russian_spam_packages.txt (75 entries)
Fetching community reports list...
Updated /home/wombat/.config/archcanary/community_reports.txt (43 entries)
Fetching aur-audit black list...
Updated /home/wombat/.config/archcanary/aur_audit_black.txt (101 entries)
Fetching aur-audit red list...
Updated /home/wombat/.config/archcanary/aur_audit_red.txt (302 entries)
============================================================
 Archcanary v0.1.21
 Scanned: 2026-08-02 11:20

 Lists loaded
   package_list.txt  infostealer + eBPF rootkit  1936 pkgs
   + CHAOS RAT         7 pkgs
   + Russian Spam     75 pkgs
   + Community Reports 43 pkgs
   + aur-audit black 101 pkgs
   + aur-audit red   302 pkgs

 Packages checked: 2464
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

--- [3] Systemd persistence check ---
  Clean: no suspicious systemd units found.

--- [4] eBPF rootkit check ---
  Clean: no eBPF rootkit traces detected.

--- [5] npm cache check ---
  Clean: no malicious packages in npm cache.

--- [6] bun cache check ---
  Clean: no malicious packages in bun cache.

--- [6b] yarn cache check ---
  Clean: no malicious packages in yarn cache.

--- [6c] pnpm cache check ---
  Clean: no malicious packages in pnpm store/cache.

--- [7] PKGBUILD/install file scan (obfuscation-aware) ---
  Clean: no malicious commands found in 101 PKGBUILD/install file(s).

--- [8] Loaded eBPF programs/links (bpftool) ---
  Skipped: bpftool not installed (pacman -S bpf).

--- [9] ld.so.preload injection check ---
  Clean: /etc/ld.so.preload not present or empty.
  INFO: ld.so.conf.d entry present: /etc/ld.so.conf.d/lib32-glibc.conf (mtime 2026-07-28)

--- [10] XDG autostart + shell RC persistence check ---
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/pcloud.desktop
    Exec="/home/wombat/.config/pcloud/pcloud-launcher.sh" (outside standard system path)
    If you recognize this app (e.g. an AppImage/Flatpak launcher or a
    personal script), mark it known-good: archcanary --allowlist-add=autostart:"/home/wombat/.config/pcloud/pcloud-launcher.sh"
  INFO: autostart entry allowlisted (unresolved binary): /home/wombat/.config/autostart/it.mijorus.gearlever.desktop
    Exec=gearlever

--- [11] Kernel module / DKMS audit ---
  Skipped: --check-kmod requires root for reliable module attribution.
  → Try: sudo /home/wombat/.local/bin/archcanary --check-kmod

--- [12] Lynis hardening report ---
  Skipped: lynis not installed (pacman -S lynis).

--- [13] Package file integrity ---
  Verifying installed file checksums against pacman database...
  (May take 30-60 seconds on large installs)
  All accessible installed files match pacman database checksums.


 Check summary
 ───────────────────────────────────────────────────────
 Package list (2464 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ⚠   REVIEW
 Kernel modules (DKMS)                ⚠   skipped (needs root)
 Lynis hardening                      ⚠   skipped (not installed)
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: REVIEW NEEDED - Suspicious behavior found, see checks above.
 INCOMPLETE: 1 root check(s) skipped (no root): kmod
 Re-run with sudo for the full picture: sudo /home/wombat/.local/bin/archcanary --full
 INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis
============================================================

╭─ ~/archcanary  master ────────────────────────────────────────────────────────────────────────────────────────── ✘ 2  1m 0s  11:21:19 AM 
╰─❯

Issue with GUI
I keep getting this error when ever I try to do a full scan from the GUI

I ran as suggested still get same issue. Would suggest that the scan be allowed to run and skip those parts of the check that are unauthorized. Gui users will appreciate this more than to keep getting the error.

Sorry this is the gui. I will have a look. in the list todo. You can ignore it … you probably installed archcanary as user without --system. Nothing to worry about.

I will come back about it :slight_smile:

I just did another git pull, and there was an update. May help?

Hi @made-lief, this is the output from my sudo ./archcanary.sh --full scan. Could you advise what action I need to take for the DKMS review?

sudo ./archcanary.sh --full
[sudo] password for dirn: 
============================================================
 Archcanary v0.1.21
 Scanned: 2026-08-03 00:34

 Lists loaded
   package_list.txt  infostealer + eBPF rootkit  1936 pkgs
   + CHAOS RAT         7 pkgs
   + Russian Spam     75 pkgs
   + Community Reports 43 pkgs

 Packages checked: 2061
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

--- [3] Systemd persistence check ---
  Clean: no suspicious systemd units found.

--- [4] eBPF rootkit check ---
  Clean: no eBPF rootkit traces detected.

--- [5] npm cache check ---
  Clean: no malicious packages in npm cache.

--- [6] bun cache check ---
  Clean: no malicious packages in bun cache.

--- [6b] yarn cache check ---
  Clean: no malicious packages in yarn cache.

--- [6c] pnpm cache check ---
  Clean: no malicious packages in pnpm store/cache.

--- [7] PKGBUILD/install file scan (obfuscation-aware) ---
  Clean: no malicious commands found in 11 PKGBUILD/install file(s).

--- [8] Loaded eBPF programs/links (bpftool) ---
  Skipped: bpftool not installed (pacman -S bpf).

--- [9] ld.so.preload injection check ---
  Clean: /etc/ld.so.preload not present or empty.
  INFO: ld.so.conf.d entry present: /etc/ld.so.conf.d/lib32-glibc.conf (mtime 2026-07-28)

--- [10] XDG autostart + shell RC persistence check ---
  Clean: no suspicious autostart or shell RC entries found.

--- [11] Kernel module / DKMS audit ---
  Clean: all loaded modules traceable to pacman packages or DKMS.
  WARNING: DKMS module from untracked source: vboxhost/7.2.14_OSE, 6.18.41-1-lts, x86_64: installed
  WARNING: DKMS module from untracked source: vboxhost/7.2.14_OSE, 7.1.5-arch1-2, x86_64: installed

--- [12] Lynis hardening report ---
  Skipped: lynis not installed (pacman -S lynis).

--- [13] Package file integrity ---
  Verifying installed file checksums against pacman database...
  (May take 30-60 seconds on large installs)
  All accessible installed files match pacman database checksums.


 Check summary
 ───────────────────────────────────────────────────────
 Package list (2061 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ✅  clean
 Kernel modules (DKMS)                ⚠   REVIEW
 Lynis hardening                      ⚠   skipped (not installed)
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: REVIEW NEEDED - Suspicious behavior found, see checks above.
 INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis
============================================================

You can also try to see if any package is missing.

archcanary --doctor

Sorry wrong post of reply.. Awweeejjiie… anyway there is doctor :slight_smile:

Results from GUI…

Authenticate in the polkit dialog to continue...
  After authenticating, please wait — the first scan fetches package lists from the network.


============================================================


Fetching infected package list...
Updating /home/wombat/.config/archcanary/package_list.txt...
Fetching malicious npm list...
Updated /home/wombat/.config/archcanary/malicious_npm_packages.txt (4 entries)
Fetching CHAOS RAT list...
Updated /home/wombat/.config/archcanary/chaos_rat_packages.txt (7 entries)
Fetching Russian spam list...
Updated /home/wombat/.config/archcanary/malicious_russian_spam_packages.txt (75 entries)
Fetching community reports list...
Updated /home/wombat/.config/archcanary/community_reports.txt (43 entries)
Fetching aur-audit black list...
Updated /home/wombat/.config/archcanary/aur_audit_black.txt (101 entries)
Fetching aur-audit red list...
Updated /home/wombat/.config/archcanary/aur_audit_red.txt (302 entries)
============================================================
 Archcanary v0.1.21
 Scanned: 2026-08-02 11:42

 Lists loaded
   package_list.txt  infostealer + eBPF rootkit  1936 pkgs
   + CHAOS RAT         7 pkgs
   + Russian Spam     75 pkgs
   + Community Reports 43 pkgs
   + aur-audit black 101 pkgs
   + aur-audit red   302 pkgs

 Packages checked: 2464
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

--- [3] Systemd persistence check ---
  Clean: no suspicious systemd units found.

--- [4] eBPF rootkit check ---
  Clean: no eBPF rootkit traces detected.

--- [5] npm cache check ---
  Clean: no malicious packages in npm cache.

--- [6] bun cache check ---
  Clean: no malicious packages in bun cache.

--- [6b] yarn cache check ---
  Clean: no malicious packages in yarn cache.

--- [6c] pnpm cache check ---
  Clean: no malicious packages in pnpm store/cache.

--- [7] PKGBUILD/install file scan (obfuscation-aware) ---
  Clean: no malicious commands found in 101 PKGBUILD/install file(s).

--- [8] Loaded eBPF programs/links (bpftool) ---
  Skipped: bpftool not installed (pacman -S bpf).

--- [9] ld.so.preload injection check ---
  Clean: /etc/ld.so.preload not present or empty.
  INFO: ld.so.conf.d entry present: /etc/ld.so.conf.d/lib32-glibc.conf (mtime 2026-07-28)

--- [10] XDG autostart + shell RC persistence check ---
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/pcloud.desktop
    Exec="/home/wombat/.config/pcloud/pcloud-launcher.sh" (outside standard system path)
  INFO: autostart entry allowlisted (unresolved binary): /home/wombat/.config/autostart/it.mijorus.gearlever.desktop
    Exec=gearlever

--- [11] Kernel module / DKMS audit ---
  Clean: all loaded modules traceable to pacman packages or DKMS.
  WARNING: DKMS module from untracked source: nvidia/610.43.03, 6.18.41-1-lts, x86_64: installed
  WARNING: DKMS module from untracked source: nvidia/610.43.03, 7.1.5-arch1-2, x86_64: installed
  WARNING: DKMS module from untracked source: nvidia/610.43.03, 7.1.5-zen1-2-zen, x86_64: installed

--- [12] Lynis hardening report ---
  Skipped: lynis not installed (pacman -S lynis).

--- [13] Package file integrity ---
  Verifying installed file checksums against pacman database...
  (May take 30-60 seconds on large installs)
  All accessible installed files match pacman database checksums.

============================================================
 RESULT: INFECTED - Indicators found! Follow incident response.
 INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis
============================================================

─── done ───


 Check summary
 ───────────────────────────────────────────────────────
 Package list (2464 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ✅  clean
 Kernel modules (DKMS)                ✅  clean
 Lynis hardening                      ⚠   skipped (not installed)
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────

so far so good i guess…

 Check summary
 ───────────────────────────────────────────────────────
 Package list (2464 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ✅  clean
 Kernel modules (DKMS)                ✅  clean
 Lynis hardening                      ✅  clean
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: CLEAN - No indicators found.
============================================================

Update: Major changes.
Archcanary v0.1.22

I skipped aurscan from the project. It has difficulties with packaging for the aur. It is not in aur at the moment. It is a llm service to check a package before installing.
WTAKO is the replacer.

git pull
./archcanary.sh --refresh --full
╭─ ~ ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 12:11:48 PM 
╰─❯ cd archcanary

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 12:11:53 PM 
╰─❯ git pull
remote: Enumerating objects: 16, done.
remote: Counting objects: 100% (16/16), done.
remote: Compressing objects: 100% (10/10), done.
remote: Total 16 (delta 9), reused 7 (delta 6), pack-reused 0 (from 0)
Unpacking objects: 100% (16/16), 30.02 KiB | 1.15 MiB/s, done.
From https://github.com/musqz/archcanary
   6ad55f6..6d7d561  master                                     -> origin/master
 * [new branch]      fix/gui-root-helper-diagnosis-and-fallback -> origin/fix/gui-root-helper-diagnosis-and-fallback
 * [new tag]         v0.1.22                                    -> v0.1.22
Updating 6ad55f6..6d7d561
Fast-forward
 CHANGELOG.md       |  4 +++-
 archcanary-gui.sh  | 26 +++++++++++++++++++++++---
 packaging/.SRCINFO |  8 ++++----
 packaging/PKGBUILD | 38 +++++++++++++++++++++++++-------------
 version.txt        |  2 +-
 5 files changed, 56 insertions(+), 22 deletions(-)

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 12:11:59 PM 
╰─❯ ./archcanary.sh --refresh --full
Fetching infected package list...
Updating /home/wombat/.config/archcanary/package_list.txt...
Fetching malicious npm list...
Updated /home/wombat/.config/archcanary/malicious_npm_packages.txt (4 entries)
Fetching CHAOS RAT list...
Updated /home/wombat/.config/archcanary/chaos_rat_packages.txt (7 entries)
Fetching Russian spam list...
Updated /home/wombat/.config/archcanary/malicious_russian_spam_packages.txt (75 entries)
Fetching community reports list...
Updated /home/wombat/.config/archcanary/community_reports.txt (43 entries)
Fetching aur-audit black list...
Updated /home/wombat/.config/archcanary/aur_audit_black.txt (101 entries)
Fetching aur-audit red list...
Updated /home/wombat/.config/archcanary/aur_audit_red.txt (302 entries)
============================================================
 Archcanary v0.1.22
 Scanned: 2026-08-02 12:12

 Lists loaded
   package_list.txt  infostealer + eBPF rootkit  1936 pkgs
   + CHAOS RAT         7 pkgs
   + Russian Spam     75 pkgs
   + Community Reports 43 pkgs
   + aur-audit black 101 pkgs
   + aur-audit red   302 pkgs

 Packages checked: 2464
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

--- [3] Systemd persistence check ---
  Clean: no suspicious systemd units found.

--- [4] eBPF rootkit check ---
  Clean: no eBPF rootkit traces detected.

--- [5] npm cache check ---
  Clean: no malicious packages in npm cache.

--- [6] bun cache check ---
  Clean: no malicious packages in bun cache.

--- [6b] yarn cache check ---
  Clean: no malicious packages in yarn cache.

--- [6c] pnpm cache check ---
  Clean: no malicious packages in pnpm store/cache.

--- [7] PKGBUILD/install file scan (obfuscation-aware) ---
  Clean: no malicious commands found in 101 PKGBUILD/install file(s).

--- [8] Loaded eBPF programs/links (bpftool) ---
  Skipped: bpftool not installed (pacman -S bpf).

--- [9] ld.so.preload injection check ---
  Clean: /etc/ld.so.preload not present or empty.
  INFO: ld.so.conf.d entry present: /etc/ld.so.conf.d/lib32-glibc.conf (mtime 2026-07-28)

--- [10] XDG autostart + shell RC persistence check ---
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/pcloud.desktop
    Exec="/home/wombat/.config/pcloud/pcloud-launcher.sh" (outside standard system path)
    If you recognize this app (e.g. an AppImage/Flatpak launcher or a
    personal script), mark it known-good: archcanary --allowlist-add=autostart:"/home/wombat/.config/pcloud/pcloud-launcher.sh"
  INFO: autostart entry allowlisted (unresolved binary): /home/wombat/.config/autostart/it.mijorus.gearlever.desktop
    Exec=gearlever

--- [11] Kernel module / DKMS audit ---
  Skipped: --check-kmod requires root for reliable module attribution.
  → Try: sudo ./archcanary.sh --check-kmod

--- [12] Lynis hardening report ---
  Skipped: lynis not installed (pacman -S lynis).

--- [13] Package file integrity ---
  Verifying installed file checksums against pacman database...
  (May take 30-60 seconds on large installs)
  All accessible installed files match pacman database checksums.


 Check summary
 ───────────────────────────────────────────────────────
 Package list (2464 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ⚠   REVIEW
 Kernel modules (DKMS)                ⚠   skipped (needs root)
 Lynis hardening                      ⚠   skipped (not installed)
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: REVIEW NEEDED - Suspicious behavior found, see checks above.
 INCOMPLETE: 1 root check(s) skipped (no root): kmod
 Re-run with sudo for the full picture: sudo ./archcanary.sh --full
 INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis
============================================================

╭─ ~/archcanary  master ────────────────────────────────────────────────────────────────────────────────────────── ✘ 2  1m 0s  12:13:06 PM 
╰─❯
╭─ ~/archcanary  master ────────────────────────────────────────────────────────────────────────────────────────── ✘ 2  1m 0s  12:13:06 PM 
╰─❯ sudo ./archcanary.sh --check-kmod
[sudo] password for wombat: 
--- [11] Kernel module / DKMS audit ---
  Clean: all loaded modules traceable to pacman packages or DKMS.
  WARNING: DKMS module from untracked source: nvidia/610.43.03, 6.18.41-1-lts, x86_64: installed
  WARNING: DKMS module from untracked source: nvidia/610.43.03, 7.1.5-arch1-2, x86_64: installed
  WARNING: DKMS module from untracked source: nvidia/610.43.03, 7.1.5-zen1-2-zen, x86_64: installed


 Check summary
 ───────────────────────────────────────────────────────
 Kernel modules (DKMS)                ⚠   REVIEW
 ───────────────────────────────────────────────────────
============================================================
 RESULT: REVIEW NEEDED - Suspicious behavior found, see checks above.
============================================================

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────── ✘ 2  26s  12:15:04 PM 
╰─❯

Followed the various steps to complete full scope scans, but continue to get the pacman.log history warnings …

Assuming I’m comfortable with the specific citations seen in section [2] (not bothering to post again, as I had previously above) and not worried about having once used these packages a long time ago before uninstalling them, is there a way to clear them out of the pacman.log file to avoid getting these unnecessary warnings?

Perhaps: If I simply delete the pacman.log file itself will that do serious damage to current pacman features and related historical tracking ?

Or perhaps just rename it to pacman.log.bak in case you need or want it back.

today, --full:

there seems to be two threads for this and I tried to read them all.

seems normal. will run with sudo next

EDIT: with sudo 100% pass for aur check

I’m also using LXQT so not sure if your calling the correct “Sudo box” Maybe why I’m getting the error still. I did the --system like I said earlier but it still does the same thing in LXQT

That was after the last update.