It does. You typed 1.
No sir, I most definitely did not hit “1” … I’ve always hit Enter.
==> Packages to cleanBuild?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==>
1 archcanary
The1 indicates you typed it.
That’s why I had you check for modifications to yay’s default behavior.
Seriously, I am not hitting “1” … I will enter “N” next time instead of Enter. 
Exactly. If your default behavior is “1” when you hit “enter”, something changed or was modified with your yay configuration. Because “1” certainly is not the default action when hitting “enter” with yay.
Since I terminated the yay process above before proceeding further, I just went back and executed another yay and this time entered [N]one instead of Enter. Then [A]ll for showing diffs. This produced the same “+” diffs but no “-” diffs once again.
However, it’s possible that my previous (aborted) yay attempt overwrote the build file if the Enter key was somehow interpreted as a “1”.
Well, here it is anyhow…
:: PKGBUILD up to date, skipping download: archcanary
1 archcanary (Installed) (Build Files Exist)
==> Packages to cleanBuild?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==> N
1 archcanary (Installed) (Build Files Exist)
==> Diffs to show?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==> A
diff --git /home/ejm/.cache/yay/archcanary/PKGBUILD /home/ejm/.cache/yay/archcanary/PKGBUILD
new file mode 100644
index 0000000..12b8ac5
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/PKGBUILD
@@ -0,0 +1,163 @@
+# Maintainer: musqz <gummy-fang-deputy@duck.com>
+pkgname=archcanary
+pkgver=0.1.34
+pkgrel=1
+pkgdesc="Layered security detection stack for Arch Linux — malicious AUR packages, systemd/eBPF persistence, npm/bun cache poisoning, kernel module tampering"
+arch=('any')
+url="https://github.com/musqz/archcanary"
+license=('MIT')
+depends=('bash' 'pacman')
+optdepends=(
+ 'libnotify: desktop alerts on infected scan result'
+ 'polkit: privileged remediation commands (allowlist edits, audit-rules/lynis-config writes)'
+ 'bpf: bpftool for eBPF rootkit detection'
+ 'yay: AUR helper with Lua hook support'
+ 'paru: AUR helper with PreBuildCommand hook support'
+ 'bash-completion: tab-completion for archcanary/canary flags'
+)
+backup=('etc/archcanary/dkms_allowlist.conf'
+ 'etc/archcanary/systemd_allowlist.conf'
+ 'etc/archcanary/bpftool_allowlist.conf'
+ 'etc/archcanary/autostart_allowlist.conf')
+install=archcanary.install
+source=("$pkgname-$pkgver.tar.gz::https://github.com/musqz/$pkgname/archive/v$pkgver.tar.gz")
+sha256sums=('9af70610b8abf1f54bdb88512bf8e5881ce79066269bc8c29083235ca0d49205')
+
+package() {
+ cd "$srcdir/$pkgname-$pkgver"
+
+ # Stamp the real version into the placeholder install.sh normally sed's at
+ # install time — package() bypasses install.sh entirely, so without this
+ # every installed copy keeps the literal "@VERSION@" and --version shows
+ # "unknown".
+ sed -i "s/@VERSION@/$pkgver/" archcanary.sh
+ sed -i "s/@VERSION@/$pkgver/" man/archcanary.1
+
+ # Main user-facing binary
+ install -Dm755 archcanary.sh "$pkgdir/usr/bin/archcanary"
+
+ # Interactive terminal menu (replaces the removed yad GUI)
+ install -Dm755 archcanary-tui.sh "$pkgdir/usr/bin/archcanary-tui"
+
+ # Desktop entry launching the interactive menu
+ install -Dm644 configs/archcanary.desktop \
+ "$pkgdir/usr/share/applications/archcanary.desktop"
+
+ # Man page
+ install -Dm644 man/archcanary.1 "$pkgdir/usr/share/man/man1/archcanary.1"
+
+ # Bash completion (archcanary + canary alias)
+ install -Dm644 configs/archcanary-completion.bash \
+ "$pkgdir/usr/share/bash-completion/completions/archcanary"
+ ln -sf archcanary "$pkgdir/usr/share/bash-completion/completions/canary"
+
+ # System lib: scanner + root helper + threat lists (used by the root scan)
+ install -dm755 "$pkgdir/usr/lib/archcanary"
+ install -m755 archcanary.sh "$pkgdir/usr/lib/archcanary/archcanary.sh"
+ install -m755 lib/archcanary-root-helper "$pkgdir/usr/lib/archcanary/root-helper"
+ for _list in package_list.txt malicious_npm_packages.txt \
+ chaos_rat_packages.txt malicious_russian_spam_packages.txt \
+ community_reports.txt; do
+ install -Dm644 "lists/$_list" "$pkgdir/usr/lib/archcanary/$_list"
+ done
+ install -Dm644 configs/lynis-custom.prf \
+ "$pkgdir/usr/lib/archcanary/lynis-custom.prf"
+ install -Dm644 configs/audit-rules.conf \
+ "$pkgdir/usr/lib/archcanary/audit-rules.conf"
+ # yay Lua hook template — read-only reference copy, never installed to
+ # ~/.config/yay/init.lua automatically (that's a per-user path a pacman
+ # transaction can't reach, and hooks are opt-in either way). Lets an
+ # AUR-only install (no git clone) still have something to `cp`; see
+ # `archcanary --doctor`.
+ install -Dm644 configs/yay-init.lua \
+ "$pkgdir/usr/lib/archcanary/yay-init.lua"
+
+ # Polkit policy (authorises root-helper via pkexec)
+ install -Dm644 configs/org.archcanary.policy \
+ "$pkgdir/usr/share/polkit-1/actions/org.archcanary.policy"
+
+ # Systemd system units (root scan: weekly timer + pacman-triggered path;
+ # scan-all-homes: opt-in weekly sweep of every real local user's home)
+ for _unit in systemd/system/archcanary.service \
+ systemd/system/archcanary.timer \
+ systemd/system/archcanary.path \
+ systemd/system/archcanary-onchange.service \
+ systemd/system/archcanary-scan-all-homes.service \
+ systemd/system/archcanary-scan-all-homes.timer; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/system/$(basename "$_unit")"
+ done
+
+ # Systemd user units (user-scope scan + result notifier)
+ for _unit in systemd/user/archcanary-user.service \
+ systemd/user/archcanary-user.timer \
+ systemd/user/archcanary-notify.path \
+ systemd/user/archcanary-notify.service; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/user/$(basename "$_unit")"
+ done
+
+ # Allowlists — seeded as commented templates; users edit in place. pacman's
+ # backup=() array (see above) preserves local edits across upgrades.
+ install -dm755 "$pkgdir/etc/archcanary"
+ cat > "$pkgdir/etc/archcanary/dkms_allowlist.conf" << 'EOF'
+# DKMS modules to skip during --check-kmod (system-wide allowlist).
+# One module name per line. Everything after # is a comment.
+# Add modules that are known-good but not tracked by pacman.
+#
+# Common examples (uncomment as needed):
+# tuxedo-drivers # TUXEDO Computers hardware driver
+# v4l2loopback # virtual camera (OBS, video conferencing)
+# vboxdrv # VirtualBox host kernel module
+# vmmon # VMware Workstation
+EOF
+
+ cat > "$pkgdir/etc/archcanary/systemd_allowlist.conf" << 'EOF'
+# systemd units to skip during the systemd persistence check (--check-systemd),
+# system-wide allowlist. One unit name per line. Everything after # is a comment.
+# Add units that are known-good but not tracked by pacman and not vetted by the
+# standard-prefix check (e.g. a self-hosted app installed from an upstream
+# binary release rather than a package). A .timer is matched by its OWN name,
+# not its target .service — allowlist both if you want to silence both findings.
+#
+# Example:
+# forgejo.service # self-hosted git, installed from upstream binary release
+# forgejo.timer # only needed if forgejo also ships a persistent timer
+EOF
+
+ cat > "$pkgdir/etc/archcanary/bpftool_allowlist.conf" << 'EOF'
+# eBPF loader binaries to skip during the bpftool LSM-loader check
+# (--check-bpftool), system-wide allowlist. One binary basename per line.
+# Everything after # is a comment.
+# Add loaders that are known-good but not pacman-owned (a self-built or
+# manually-installed security/monitoring tool that legitimately loads LSM
+# eBPF hooks) — matched against the basename of /proc/<pid>/exe.
+#
+# Example:
+# falco # runtime security monitoring, installed from upstream binary release
+EOF
+
+ cat > "$pkgdir/etc/archcanary/autostart_allowlist.conf" << 'EOF'
+# Names to skip during the XDG autostart check (--check-autostart),
+# system-wide allowlist. One entry per line. Everything after # is a
+# comment. Covers two separate findings within the same check, each with
+# its own matching rule:
+#
+# 1. .desktop Exec= names that are known-good but can't be resolved via
+# $PATH or a standard system prefix — e.g. a package-private helper
+# binary the non-PATH fallback (search of /usr/lib, /usr/libexec) still
+# can't find, or an AppImage/Flatpak export. Matched against the bare
+# Exec= value exactly as written in the .desktop file (not a resolved
+# path) — usually just a command name.
+#
+# 2. User systemd service ExecStart= binaries unowned by pacman. Matched
+# against the ExecStart binary's exact, full path (NOT its basename —
+# a basename match would let an unrelated binary sharing that name
+# anywhere on disk slip through undetected). Useful for a package that
+# ships its user unit via /etc/skel (copied into ~/.config/systemd/user/
+# at account creation, so pacman never tracks that specific copy even
+# though the binary itself is a normal pacman-owned file).
+#
+# Examples:
+# zeitgeist-datahub # desktop activity logging, ships in a non-PATH libdir
+# /usr/bin/eos-update-notifier # EndeavourOS update notifier, user unit ships via /etc/skel
+EOF
+}
diff --git /home/ejm/.cache/yay/archcanary/archcanary.install /home/ejm/.cache/yay/archcanary/archcanary.install
new file mode 100644
index 0000000..9ea80a6
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/archcanary.install
@@ -0,0 +1,55 @@
+post_install() {
+ # Seed Lynis's false-positive-suppression profile, but only if lynis is
+ # actually installed and the target has no custom.prf of its own yet —
+ # mirrors install.sh's runtime check, which package() cannot do at build time.
+ if command -v lynis &>/dev/null && [[ ! -f /etc/lynis/custom.prf ]]; then
+ install -Dm644 /usr/lib/archcanary/lynis-custom.prf /etc/lynis/custom.prf
+ echo " installed: /etc/lynis/custom.prf (Lynis false-positive suppressions — edit to enable)"
+ fi
+
+ # Seed auditd rules, same way, only if auditd is installed and the target
+ # has no ruleset yet — mirrors install.sh's runtime check, which package()
+ # cannot do at build time. Already root here, no sudo needed.
+ if command -v auditctl &>/dev/null; then
+ _audit_cfg=/etc/audit/rules.d/30-archcanary.rules
diff --git /home/ejm/.cache/yay/archcanary/PKGBUILD /home/ejm/.cache/yay/archcanary/PKGBUILD
new file mode 100644
index 0000000..12b8ac5
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/PKGBUILD
@@ -0,0 +1,163 @@
+# Maintainer: musqz <gummy-fang-deputy@duck.com>
+pkgname=archcanary
+pkgver=0.1.34
+pkgrel=1
+pkgdesc="Layered security detection stack for Arch Linux — malicious AUR packages, systemd/eBPF persistence, npm/bun cache poisoning, kernel module tampering"
+arch=('any')
+url="https://github.com/musqz/archcanary"
+license=('MIT')
+depends=('bash' 'pacman')
+optdepends=(
+ 'libnotify: desktop alerts on infected scan result'
+ 'polkit: privileged remediation commands (allowlist edits, audit-rules/lynis-config writes)'
+ 'bpf: bpftool for eBPF rootkit detection'
+ 'yay: AUR helper with Lua hook support'
+ 'paru: AUR helper with PreBuildCommand hook support'
+ 'bash-completion: tab-completion for archcanary/canary flags'
+)
+backup=('etc/archcanary/dkms_allowlist.conf'
+ 'etc/archcanary/systemd_allowlist.conf'
+ 'etc/archcanary/bpftool_allowlist.conf'
+ 'etc/archcanary/autostart_allowlist.conf')
+install=archcanary.install
+source=("$pkgname-$pkgver.tar.gz::https://github.com/musqz/$pkgname/archive/v$pkgver.tar.gz")
+sha256sums=('9af70610b8abf1f54bdb88512bf8e5881ce79066269bc8c29083235ca0d49205')
+
+package() {
+ cd "$srcdir/$pkgname-$pkgver"
+
+ # Stamp the real version into the placeholder install.sh normally sed's at
+ # install time — package() bypasses install.sh entirely, so without this
+ # every installed copy keeps the literal "@VERSION@" and --version shows
+ # "unknown".
+ sed -i "s/@VERSION@/$pkgver/" archcanary.sh
+ sed -i "s/@VERSION@/$pkgver/" man/archcanary.1
+
+ # Main user-facing binary
+ install -Dm755 archcanary.sh "$pkgdir/usr/bin/archcanary"
+
+ # Interactive terminal menu (replaces the removed yad GUI)
+ install -Dm755 archcanary-tui.sh "$pkgdir/usr/bin/archcanary-tui"
+
+ # Desktop entry launching the interactive menu
+ install -Dm644 configs/archcanary.desktop \
+ "$pkgdir/usr/share/applications/archcanary.desktop"
+
+ # Man page
+ install -Dm644 man/archcanary.1 "$pkgdir/usr/share/man/man1/archcanary.1"
+
+ # Bash completion (archcanary + canary alias)
+ install -Dm644 configs/archcanary-completion.bash \
+ "$pkgdir/usr/share/bash-completion/completions/archcanary"
+ ln -sf archcanary "$pkgdir/usr/share/bash-completion/completions/canary"
+
+ # System lib: scanner + root helper + threat lists (used by the root scan)
+ install -dm755 "$pkgdir/usr/lib/archcanary"
+ install -m755 archcanary.sh "$pkgdir/usr/lib/archcanary/archcanary.sh"
+ install -m755 lib/archcanary-root-helper "$pkgdir/usr/lib/archcanary/root-helper"
+ for _list in package_list.txt malicious_npm_packages.txt \
+ chaos_rat_packages.txt malicious_russian_spam_packages.txt \
+ community_reports.txt; do
+ install -Dm644 "lists/$_list" "$pkgdir/usr/lib/archcanary/$_list"
+ done
+ install -Dm644 configs/lynis-custom.prf \
+ "$pkgdir/usr/lib/archcanary/lynis-custom.prf"
+ install -Dm644 configs/audit-rules.conf \
+ "$pkgdir/usr/lib/archcanary/audit-rules.conf"
+ # yay Lua hook template — read-only reference copy, never installed to
+ # ~/.config/yay/init.lua automatically (that's a per-user path a pacman
+ # transaction can't reach, and hooks are opt-in either way). Lets an
+ # AUR-only install (no git clone) still have something to `cp`; see
+ # `archcanary --doctor`.
+ install -Dm644 configs/yay-init.lua \
+ "$pkgdir/usr/lib/archcanary/yay-init.lua"
+
+ # Polkit policy (authorises root-helper via pkexec)
+ install -Dm644 configs/org.archcanary.policy \
+ "$pkgdir/usr/share/polkit-1/actions/org.archcanary.policy"
+
+ # Systemd system units (root scan: weekly timer + pacman-triggered path;
+ # scan-all-homes: opt-in weekly sweep of every real local user's home)
+ for _unit in systemd/system/archcanary.service \
+ systemd/system/archcanary.timer \
+ systemd/system/archcanary.path \
+ systemd/system/archcanary-onchange.service \
+ systemd/system/archcanary-scan-all-homes.service \
+ systemd/system/archcanary-scan-all-homes.timer; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/system/$(basename "$_unit")"
+ done
+
+ # Systemd user units (user-scope scan + result notifier)
+ for _unit in systemd/user/archcanary-user.service \
+ systemd/user/archcanary-user.timer \
+ systemd/user/archcanary-notify.path \
+ systemd/user/archcanary-notify.service; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/user/$(basename "$_unit")"
+ done
+
+ # Allowlists — seeded as commented templates; users edit in place. pacman's
+ # backup=() array (see above) preserves local edits across upgrades.
+ install -dm755 "$pkgdir/etc/archcanary"
+ cat > "$pkgdir/etc/archcanary/dkms_allowlist.conf" << 'EOF'
+# DKMS modules to skip during --check-kmod (system-wide allowlist).
+# One module name per line. Everything after # is a comment.
+# Add modules that are known-good but not tracked by pacman.
+#
+# Common examples (uncomment as needed):
+# tuxedo-drivers # TUXEDO Computers hardware driver
+# v4l2loopback # virtual camera (OBS, video conferencing)
+# vboxdrv # VirtualBox host kernel module
+# vmmon # VMware Workstation
+EOF
+
+ cat > "$pkgdir/etc/archcanary/systemd_allowlist.conf" << 'EOF'
+# systemd units to skip during the systemd persistence check (--check-systemd),
+# system-wide allowlist. One unit name per line. Everything after # is a comment.
+# Add units that are known-good but not tracked by pacman and not vetted by the
+# standard-prefix check (e.g. a self-hosted app installed from an upstream
+# binary release rather than a package). A .timer is matched by its OWN name,
+# not its target .service — allowlist both if you want to silence both findings.
+#
+# Example:
+# forgejo.service # self-hosted git, installed from upstream binary release
+# forgejo.timer # only needed if forgejo also ships a persistent timer
+EOF
+
+ cat > "$pkgdir/etc/archcanary/bpftool_allowlist.conf" << 'EOF'
+# eBPF loader binaries to skip during the bpftool LSM-loader check
+# (--check-bpftool), system-wide allowlist. One binary basename per line.
+# Everything after # is a comment.
+# Add loaders that are known-good but not pacman-owned (a self-built or
+# manually-installed security/monitoring tool that legitimately loads LSM
+# eBPF hooks) — matched against the basename of /proc/<pid>/exe.
+#
+# Example:
+# falco # runtime security monitoring, installed from upstream binary release
+EOF
+
+ cat > "$pkgdir/etc/archcanary/autostart_allowlist.conf" << 'EOF'
+# Names to skip during the XDG autostart check (--check-autostart),
+# system-wide allowlist. One entry per line. Everything after # is a
+# comment. Covers two separate findings within the same check, each with
+# its own matching rule:
+#
+# 1. .desktop Exec= names that are known-good but can't be resolved via
+# $PATH or a standard system prefix — e.g. a package-private helper
+# binary the non-PATH fallback (search of /usr/lib, /usr/libexec) still
+# can't find, or an AppImage/Flatpak export. Matched against the bare
+# Exec= value exactly as written in the .desktop file (not a resolved
+# path) — usually just a command name.
+#
+# 2. User systemd service ExecStart= binaries unowned by pacman. Matched
+# against the ExecStart binary's exact, full path (NOT its basename —
+# a basename match would let an unrelated binary sharing that name
+# anywhere on disk slip through undetected). Useful for a package that
+# ships its user unit via /etc/skel (copied into ~/.config/systemd/user/
+# at account creation, so pacman never tracks that specific copy even
+# though the binary itself is a normal pacman-owned file).
+#
+# Examples:
+# zeitgeist-datahub # desktop activity logging, ships in a non-PATH libdir
+# /usr/bin/eos-update-notifier # EndeavourOS update notifier, user unit ships via /etc/skel
+EOF
+}
diff --git /home/ejm/.cache/yay/archcanary/archcanary.install /home/ejm/.cache/yay/archcanary/archcanary.install
new file mode 100644
index 0000000..9ea80a6
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/archcanary.install
@@ -0,0 +1,55 @@
+post_install() {
+ # Seed Lynis's false-positive-suppression profile, but only if lynis is
+ # actually installed and the target has no custom.prf of its own yet —
+ # mirrors install.sh's runtime check, which package() cannot do at build time.
+ if command -v lynis &>/dev/null && [[ ! -f /etc/lynis/custom.prf ]]; then
+ install -Dm644 /usr/lib/archcanary/lynis-custom.prf /etc/lynis/custom.prf
+ echo " installed: /etc/lynis/custom.prf (Lynis false-positive suppressions — edit to enable)"
+ fi
+
+ # Seed auditd rules, same way, only if auditd is installed and the target
+ # has no ruleset yet — mirrors install.sh's runtime check, which package()
+ # cannot do at build time. Already root here, no sudo needed.
+ if command -v auditctl &>/dev/null; then
+ _audit_cfg=/etc/audit/rules.d/30-archcanary.rules
+ install -d -m 755 /etc/audit/rules.d
+ rm -f /etc/audit/rules.d/30-archcanary.conf /etc/audit/rules.d/archcanary.conf
+ if ! grep -qE '^\s*-[waAbfe]' "$_audit_cfg" 2>/dev/null; then
+ install -m 644 /usr/lib/archcanary/audit-rules.conf "$_audit_cfg"
+ augenrules --load >/dev/null 2>&1 || true
+ echo " installed: $_audit_cfg (auditd rules — edit with --audit-rules-get/--audit-rules-set)"
+ fi
+ unset _audit_cfg
+ fi
+
+ echo ""
+ echo "==> archcanary installed."
+ echo ""
+ echo " Enable the automated system scan (runs as root — weekly + on boot + after pacman):"
+ echo " sudo systemctl enable --now archcanary.timer archcanary.path"
+ echo ""
+ echo " Enable the user-scope scan and result notifier (run as your user):"
+ echo " systemctl --user enable --now archcanary-user.timer archcanary-notify.path"
+ echo ""
+ echo " Optional, machine-wide: weekly scan of every other real local user's"
+ echo " home too, not just yours (see --scan-all-homes) — off by default:"
+ echo " sudo systemctl enable --now archcanary-scan-all-homes.timer"
+ echo ""
+ echo " Run a manual full scan:"
+ echo " archcanary --refresh --full"
+ echo ""
+ echo " This package installs the system-wide pieces (binaries, systemd units,"
+ echo " polkit policy, /etc allowlists). Per-user setup can't be done from here"
+ echo " since it has to run as YOUR user, not the pacman transaction — run:"
+ echo " archcanary --doctor"
+ echo " to see exactly what's still missing (yay hooks, lynis)"
+ echo " and the precise command to fix each one."
+ echo ""
+ echo " Optional add-ons: lynis (hardening auditor)."
+ echo " See: https://github.com/musqz/archcanary"
+ echo ""
+}
+
+post_upgrade() {
+ post_install
+}
(END)
It still shows a “1” - which cleanbuilds the package:
Reset the default:
yay --noanswerclean --save
@ArchieLinux, you may have a bigger (or different) problem than a diff issue. Your yay was modified. And if you didn’t modify it, well… someone did.
Okay, (having aborted the update after the diff dump), I ran this line above and then reran yay again. Same puddle of puzzlement… it’s apparently ignoring my [N]one instructions.
AUR Explicit (1): archcanary-0.1.34-1
:: PKGBUILD up to date, skipping download: archcanary
1 archcanary (Installed) (Build Files Exist)
==> Packages to cleanBuild?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==> N
1 archcanary (Installed) (Build Files Exist)
==> Diffs to show?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==> A
diff --git /home/ejm/.cache/yay/archcanary/PKGBUILD /home/ejm/.cache/yay/archcanary/PKGBUILD
new file mode 100644
index 0000000..12b8ac5
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/PKGBUILD
@@ -0,0 +1,163 @@
+# Maintainer: musqz <gummy-fang-deputy@duck.com>
+pkgname=archcanary
+pkgver=0.1.34
+pkgrel=1
+pkgdesc="Layered security detection stack for Arch Linux — malicious AUR packages, systemd/eBPF persistence, npm/bun cache poisoning, kernel module tampering"
+arch=('any')
+url="https://github.com/musqz/archcanary"
+license=('MIT')
+depends=('bash' 'pacman')
+optdepends=(
+ 'libnotify: desktop alerts on infected scan result'
+ 'polkit: privileged remediation commands (allowlist edits, audit-rules/lynis-config writes)'
+ 'bpf: bpftool for eBPF rootkit detection'
+ 'yay: AUR helper with Lua hook support'
+ 'paru: AUR helper with PreBuildCommand hook support'
+ 'bash-completion: tab-completion for archcanary/canary flags'
+)
+backup=('etc/archcanary/dkms_allowlist.conf'
+ 'etc/archcanary/systemd_allowlist.conf'
+ 'etc/archcanary/bpftool_allowlist.conf'
+ 'etc/archcanary/autostart_allowlist.conf')
+install=archcanary.install
+source=("$pkgname-$pkgver.tar.gz::https://github.com/musqz/$pkgname/archive/v$pkgver.tar.gz")
+sha256sums=('9af70610b8abf1f54bdb88512bf8e5881ce79066269bc8c29083235ca0d49205')
+
+package() {
+ cd "$srcdir/$pkgname-$pkgver"
+
+ # Stamp the real version into the placeholder install.sh normally sed's at
+ # install time — package() bypasses install.sh entirely, so without this
+ # every installed copy keeps the literal "@VERSION@" and --version shows
+ # "unknown".
+ sed -i "s/@VERSION@/$pkgver/" archcanary.sh
+ sed -i "s/@VERSION@/$pkgver/" man/archcanary.1
+
+ # Main user-facing binary
+ install -Dm755 archcanary.sh "$pkgdir/usr/bin/archcanary"
+
+ # Interactive terminal menu (replaces the removed yad GUI)
+ install -Dm755 archcanary-tui.sh "$pkgdir/usr/bin/archcanary-tui"
+
+ # Desktop entry launching the interactive menu
+ install -Dm644 configs/archcanary.desktop \
+ "$pkgdir/usr/share/applications/archcanary.desktop"
+
+ # Man page
+ install -Dm644 man/archcanary.1 "$pkgdir/usr/share/man/man1/archcanary.1"
+
+ # Bash completion (archcanary + canary alias)
+ install -Dm644 configs/archcanary-completion.bash \
+ "$pkgdir/usr/share/bash-completion/completions/archcanary"
+ ln -sf archcanary "$pkgdir/usr/share/bash-completion/completions/canary"
+
+ # System lib: scanner + root helper + threat lists (used by the root scan)
+ install -dm755 "$pkgdir/usr/lib/archcanary"
+ install -m755 archcanary.sh "$pkgdir/usr/lib/archcanary/archcanary.sh"
+ install -m755 lib/archcanary-root-helper "$pkgdir/usr/lib/archcanary/root-helper"
+ for _list in package_list.txt malicious_npm_packages.txt \
+ chaos_rat_packages.txt malicious_russian_spam_packages.txt \
+ community_reports.txt; do
+ install -Dm644 "lists/$_list" "$pkgdir/usr/lib/archcanary/$_list"
+ done
+ install -Dm644 configs/lynis-custom.prf \
+ "$pkgdir/usr/lib/archcanary/lynis-custom.prf"
+ install -Dm644 configs/audit-rules.conf \
+ "$pkgdir/usr/lib/archcanary/audit-rules.conf"
+ # yay Lua hook template — read-only reference copy, never installed to
+ # ~/.config/yay/init.lua automatically (that's a per-user path a pacman
+ # transaction can't reach, and hooks are opt-in either way). Lets an
+ # AUR-only install (no git clone) still have something to `cp`; see
+ # `archcanary --doctor`.
+ install -Dm644 configs/yay-init.lua \
+ "$pkgdir/usr/lib/archcanary/yay-init.lua"
+
+ # Polkit policy (authorises root-helper via pkexec)
+ install -Dm644 configs/org.archcanary.policy \
+ "$pkgdir/usr/share/polkit-1/actions/org.archcanary.policy"
+
+ # Systemd system units (root scan: weekly timer + pacman-triggered path;
+ # scan-all-homes: opt-in weekly sweep of every real local user's home)
+ for _unit in systemd/system/archcanary.service \
+ systemd/system/archcanary.timer \
+ systemd/system/archcanary.path \
+ systemd/system/archcanary-onchange.service \
+ systemd/system/archcanary-scan-all-homes.service \
+ systemd/system/archcanary-scan-all-homes.timer; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/system/$(basename "$_unit")"
+ done
+
+ # Systemd user units (user-scope scan + result notifier)
+ for _unit in systemd/user/archcanary-user.service \
+ systemd/user/archcanary-user.timer \
+ systemd/user/archcanary-notify.path \
+ systemd/user/archcanary-notify.service; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/user/$(basename "$_unit")"
+ done
+
+ # Allowlists — seeded as commented templates; users edit in place. pacman's
+ # backup=() array (see above) preserves local edits across upgrades.
+ install -dm755 "$pkgdir/etc/archcanary"
+ cat > "$pkgdir/etc/archcanary/dkms_allowlist.conf" << 'EOF'
+# DKMS modules to skip during --check-kmod (system-wide allowlist).
+# One module name per line. Everything after # is a comment.
+# Add modules that are known-good but not tracked by pacman.
+#
+# Common examples (uncomment as needed):
+# tuxedo-drivers # TUXEDO Computers hardware driver
+# v4l2loopback # virtual camera (OBS, video conferencing)
+# vboxdrv # VirtualBox host kernel module
+# vmmon # VMware Workstation
+EOF
+
+ cat > "$pkgdir/etc/archcanary/systemd_allowlist.conf" << 'EOF'
+# systemd units to skip during the systemd persistence check (--check-systemd),
+# system-wide allowlist. One unit name per line. Everything after # is a comment.
+# Add units that are known-good but not tracked by pacman and not vetted by the
+# standard-prefix check (e.g. a self-hosted app installed from an upstream
+# binary release rather than a package). A .timer is matched by its OWN name,
+# not its target .service — allowlist both if you want to silence both findings.
+#
+# Example:
+# forgejo.service # self-hosted git, installed from upstream binary release
+# forgejo.timer # only needed if forgejo also ships a persistent timer
+EOF
+
+ cat > "$pkgdir/etc/archcanary/bpftool_allowlist.conf" << 'EOF'
+# eBPF loader binaries to skip during the bpftool LSM-loader check
+# (--check-bpftool), system-wide allowlist. One binary basename per line.
+# Everything after # is a comment.
+# Add loaders that are known-good but not pacman-owned (a self-built or
+# manually-installed security/monitoring tool that legitimately loads LSM
+# eBPF hooks) — matched against the basename of /proc/<pid>/exe.
+#
+# Example:
+# falco # runtime security monitoring, installed from upstream binary release
+EOF
+
+ cat > "$pkgdir/etc/archcanary/autostart_allowlist.conf" << 'EOF'
+# Names to skip during the XDG autostart check (--check-autostart),
+# system-wide allowlist. One entry per line. Everything after # is a
+# comment. Covers two separate findings within the same check, each with
+# its own matching rule:
+#
+# 1. .desktop Exec= names that are known-good but can't be resolved via
+# $PATH or a standard system prefix — e.g. a package-private helper
+# binary the non-PATH fallback (search of /usr/lib, /usr/libexec) still
+# can't find, or an AppImage/Flatpak export. Matched against the bare
+# Exec= value exactly as written in the .desktop file (not a resolved
+# path) — usually just a command name.
+#
+# 2. User systemd service ExecStart= binaries unowned by pacman. Matched
+# against the ExecStart binary's exact, full path (NOT its basename —
+# a basename match would let an unrelated binary sharing that name
+# anywhere on disk slip through undetected). Useful for a package that
+# ships its user unit via /etc/skel (copied into ~/.config/systemd/user/
+# at account creation, so pacman never tracks that specific copy even
+# though the binary itself is a normal pacman-owned file).
+#
+# Examples:
+# zeitgeist-datahub # desktop activity logging, ships in a non-PATH libdir
+# /usr/bin/eos-update-notifier # EndeavourOS update notifier, user unit ships via /etc/skel
+EOF
+}
diff --git /home/ejm/.cache/yay/archcanary/archcanary.install /home/ejm/.cache/yay/archcanary/archcanary.install
new file mode 100644
index 0000000..9ea80a6
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/archcanary.install
@@ -0,0 +1,55 @@
+post_install() {
+ # Seed Lynis's false-positive-suppression profile, but only if lynis is
+ # actually installed and the target has no custom.prf of its own yet —
+ # mirrors install.sh's runtime check, which package() cannot do at build time.
+ if command -v lynis &>/dev/null && [[ ! -f /etc/lynis/custom.prf ]]; then
+ install -Dm644 /usr/lib/archcanary/lynis-custom.prf /etc/lynis/custom.prf
+ echo " installed: /etc/lynis/custom.prf (Lynis false-positive suppressions — edit to enable)"
+ fi
+
+ # Seed auditd rules, same way, only if auditd is installed and the target
+ # has no ruleset yet — mirrors install.sh's runtime check, which package()
+ # cannot do at build time. Already root here, no sudo needed.
+ if command -v auditctl &>/dev/null; then
+ _audit_cfg=/etc/audit/rules.d/30-archcanary.rules
+ install -d -m 755 /etc/audit/rules.d
+ rm -f /etc/audit/rules.d/30-archcanary.conf /etc/audit/rules.d/archcanary.conf
+ if ! grep -qE '^\s*-[waAbfe]' "$_audit_cfg" 2>/dev/null; then
+ install -m 644 /usr/lib/archcanary/audit-rules.conf "$_audit_cfg"
+ augenrules --load >/dev/null 2>&1 || true
+ echo " installed: $_audit_cfg (auditd rules — edit with --audit-rules-get/--audit-rules-set)"
+ fi
+ unset _audit_cfg
+ fi
+
+ echo ""
+ echo "==> archcanary installed."
+ echo ""
+ echo " Enable the automated system scan (runs as root — weekly + on boot + after pacman):"
+ echo " sudo systemctl enable --now archcanary.timer archcanary.path"
+ echo ""
+ echo " Enable the user-scope scan and result notifier (run as your user):"
+ echo " systemctl --user enable --now archcanary-user.timer archcanary-notify.path"
+ echo ""
+ echo " Optional, machine-wide: weekly scan of every other real local user's"
+ echo " home too, not just yours (see --scan-all-homes) — off by default:"
+ echo " sudo systemctl enable --now archcanary-scan-all-homes.timer"
+ echo ""
+ echo " Run a manual full scan:"
+ echo " archcanary --refresh --full"
+ echo ""
+ echo " This package installs the system-wide pieces (binaries, systemd units,"
+ echo " polkit policy, /etc allowlists). Per-user setup can't be done from here"
+ echo " since it has to run as YOUR user, not the pacman transaction — run:"
+ echo " archcanary --doctor"
+ echo " to see exactly what's still missing (yay hooks, lynis)"
+ echo " and the precise command to fix each one."
+ echo ""
+ echo " Optional add-ons: lynis (hardening auditor)."
+ echo " See: https://github.com/musqz/archcanary"
+ echo ""
+}
+
+post_upgrade() {
+ post_install
+}
...
Hmm, that should have reset any modifications to the default (although you don’t have any evidence of modifications to the cleanbuild function).
For completeness, try it this way:
yay --answerclean=None --save
I don’t expect that will be any different, but maybe…
You shouldn’t need to type N at all. A simple enter should work. It has for me (and I suspect most others) since the beginning of using yay.
Your prediction is accurate. Ran the line for completeness above and then… despite accepting “None” as the response, it still lists “1 archcanary” anyhow. Weird.
:: PKGBUILD up to date, skipping download: archcanary
1 archcanary (Installed) (Build Files Exist)
==> Packages to cleanBuild?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==> None
1 archcanary (Installed) (Build Files Exist)
==> Diffs to show?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==> A
diff --git /home/ejm/.cache/yay/archcanary/PKGBUILD /home/ejm/.cache/yay/archcanary/PKGBUILD
new file mode 100644
index 0000000..12b8ac5
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/PKGBUILD
@@ -0,0 +1,163 @@
+# Maintainer: musqz <gummy-fang-deputy@duck.com>
+pkgname=archcanary
+pkgver=0.1.34
+pkgrel=1
+pkgdesc="Layered security detection stack for Arch Linux — malicious AUR packages, systemd/eBPF persistence, npm/bun cache poisoning, kernel module tampering"
+arch=('any')
+url="https://github.com/musqz/archcanary"
+license=('MIT')
+depends=('bash' 'pacman')
+optdepends=(
+ 'libnotify: desktop alerts on infected scan result'
+ 'polkit: privileged remediation commands (allowlist edits, audit-rules/lynis-config writes)'
+ 'bpf: bpftool for eBPF rootkit detection'
+ 'yay: AUR helper with Lua hook support'
+ 'paru: AUR helper with PreBuildCommand hook support'
+ 'bash-completion: tab-completion for archcanary/canary flags'
+)
+backup=('etc/archcanary/dkms_allowlist.conf'
+ 'etc/archcanary/systemd_allowlist.conf'
+ 'etc/archcanary/bpftool_allowlist.conf'
+ 'etc/archcanary/autostart_allowlist.conf')
+install=archcanary.install
+source=("$pkgname-$pkgver.tar.gz::https://github.com/musqz/$pkgname/archive/v$pkgver.tar.gz")
+sha256sums=('9af70610b8abf1f54bdb88512bf8e5881ce79066269bc8c29083235ca0d49205')
+
+package() {
+ cd "$srcdir/$pkgname-$pkgver"
+
+ # Stamp the real version into the placeholder install.sh normally sed's at
+ # install time — package() bypasses install.sh entirely, so without this
+ # every installed copy keeps the literal "@VERSION@" and --version shows
+ # "unknown".
+ sed -i "s/@VERSION@/$pkgver/" archcanary.sh
+ sed -i "s/@VERSION@/$pkgver/" man/archcanary.1
+
+ # Main user-facing binary
+ install -Dm755 archcanary.sh "$pkgdir/usr/bin/archcanary"
+
+ # Interactive terminal menu (replaces the removed yad GUI)
+ install -Dm755 archcanary-tui.sh "$pkgdir/usr/bin/archcanary-tui"
+
+ # Desktop entry launching the interactive menu
+ install -Dm644 configs/archcanary.desktop \
+ "$pkgdir/usr/share/applications/archcanary.desktop"
+
+ # Man page
+ install -Dm644 man/archcanary.1 "$pkgdir/usr/share/man/man1/archcanary.1"
+
+ # Bash completion (archcanary + canary alias)
+ install -Dm644 configs/archcanary-completion.bash \
+ "$pkgdir/usr/share/bash-completion/completions/archcanary"
+ ln -sf archcanary "$pkgdir/usr/share/bash-completion/completions/canary"
+
+ # System lib: scanner + root helper + threat lists (used by the root scan)
+ install -dm755 "$pkgdir/usr/lib/archcanary"
+ install -m755 archcanary.sh "$pkgdir/usr/lib/archcanary/archcanary.sh"
+ install -m755 lib/archcanary-root-helper "$pkgdir/usr/lib/archcanary/root-helper"
+ for _list in package_list.txt malicious_npm_packages.txt \
+ chaos_rat_packages.txt malicious_russian_spam_packages.txt \
+ community_reports.txt; do
+ install -Dm644 "lists/$_list" "$pkgdir/usr/lib/archcanary/$_list"
+ done
+ install -Dm644 configs/lynis-custom.prf \
+ "$pkgdir/usr/lib/archcanary/lynis-custom.prf"
+ install -Dm644 configs/audit-rules.conf \
+ "$pkgdir/usr/lib/archcanary/audit-rules.conf"
+ # yay Lua hook template — read-only reference copy, never installed to
+ # ~/.config/yay/init.lua automatically (that's a per-user path a pacman
+ # transaction can't reach, and hooks are opt-in either way). Lets an
+ # AUR-only install (no git clone) still have something to `cp`; see
+ # `archcanary --doctor`.
+ install -Dm644 configs/yay-init.lua \
+ "$pkgdir/usr/lib/archcanary/yay-init.lua"
+
+ # Polkit policy (authorises root-helper via pkexec)
+ install -Dm644 configs/org.archcanary.policy \
+ "$pkgdir/usr/share/polkit-1/actions/org.archcanary.policy"
+
+ # Systemd system units (root scan: weekly timer + pacman-triggered path;
+ # scan-all-homes: opt-in weekly sweep of every real local user's home)
+ for _unit in systemd/system/archcanary.service \
+ systemd/system/archcanary.timer \
+ systemd/system/archcanary.path \
+ systemd/system/archcanary-onchange.service \
+ systemd/system/archcanary-scan-all-homes.service \
+ systemd/system/archcanary-scan-all-homes.timer; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/system/$(basename "$_unit")"
+ done
+
+ # Systemd user units (user-scope scan + result notifier)
+ for _unit in systemd/user/archcanary-user.service \
+ systemd/user/archcanary-user.timer \
+ systemd/user/archcanary-notify.path \
+ systemd/user/archcanary-notify.service; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/user/$(basename "$_unit")"
+ done
+
+ # Allowlists — seeded as commented templates; users edit in place. pacman's
+ # backup=() array (see above) preserves local edits across upgrades.
+ install -dm755 "$pkgdir/etc/archcanary"
+ cat > "$pkgdir/etc/archcanary/dkms_allowlist.conf" << 'EOF'
+# DKMS modules to skip during --check-kmod (system-wide allowlist).
+# One module name per line. Everything after # is a comment.
+# Add modules that are known-good but not tracked by pacman.
+#
+# Common examples (uncomment as needed):
+# tuxedo-drivers # TUXEDO Computers hardware driver
+# v4l2loopback # virtual camera (OBS, video conferencing)
+# vboxdrv # VirtualBox host kernel module
+# vmmon # VMware Workstation
+EOF
+
+ cat > "$pkgdir/etc/archcanary/systemd_allowlist.conf" << 'EOF'
+# systemd units to skip during the systemd persistence check (--check-systemd),
+# system-wide allowlist. One unit name per line. Everything after # is a comment.
+# Add units that are known-good but not tracked by pacman and not vetted by the
+# standard-prefix check (e.g. a self-hosted app installed from an upstream
+# binary release rather than a package). A .timer is matched by its OWN name,
+# not its target .service — allowlist both if you want to silence both findings.
+#
+# Example:
+# forgejo.service # self-hosted git, installed from upstream binary release
+# forgejo.timer # only needed if forgejo also ships a persistent timer
+EOF
+
+ cat > "$pkgdir/etc/archcanary/bpftool_allowlist.conf" << 'EOF'
+# eBPF loader binaries to skip during the bpftool LSM-loader check
+# (--check-bpftool), system-wide allowlist. One binary basename per line.
+# Everything after # is a comment.
+# Add loaders that are known-good but not pacman-owned (a self-built or
+# manually-installed security/monitoring tool that legitimately loads LSM
+# eBPF hooks) — matched against the basename of /proc/<pid>/exe.
+#
+# Example:
+# falco # runtime security monitoring, installed from upstream binary release
+EOF
+
+ cat > "$pkgdir/etc/archcanary/autostart_allowlist.conf" << 'EOF'
+# Names to skip during the XDG autostart check (--check-autostart),
+# system-wide allowlist. One entry per line. Everything after # is a
+# comment. Covers two separate findings within the same check, each with
+# its own matching rule:
+#
+# 1. .desktop Exec= names that are known-good but can't be resolved via
+# $PATH or a standard system prefix — e.g. a package-private helper
+# binary the non-PATH fallback (search of /usr/lib, /usr/libexec) still
+# can't find, or an AppImage/Flatpak export. Matched against the bare
+# Exec= value exactly as written in the .desktop file (not a resolved
+# path) — usually just a command name.
+#
+# 2. User systemd service ExecStart= binaries unowned by pacman. Matched
+# against the ExecStart binary's exact, full path (NOT its basename —
+# a basename match would let an unrelated binary sharing that name
+# anywhere on disk slip through undetected). Useful for a package that
+# ships its user unit via /etc/skel (copied into ~/.config/systemd/user/
+# at account creation, so pacman never tracks that specific copy even
+# though the binary itself is a normal pacman-owned file).
+#
+# Examples:
+# zeitgeist-datahub # desktop activity logging, ships in a non-PATH libdir
+# /usr/bin/eos-update-notifier # EndeavourOS update notifier, user unit ships via /etc/skel
+EOF
+}
diff --git /home/ejm/.cache/yay/archcanary/archcanary.install /home/ejm/.cache/yay/archcanary/archcanary.install
new file mode 100644
index 0000000..9ea80a6
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/archcanary.install
@@ -0,0 +1,55 @@
+post_install() {
+ # Seed Lynis's false-positive-suppression profile, but only if lynis is
+ # actually installed and the target has no custom.prf of its own yet —
+ # mirrors install.sh's runtime check, which package() cannot do at build time.
+ if command -v lynis &>/dev/null && [[ ! -f /etc/lynis/custom.prf ]]; then
+ install -Dm644 /usr/lib/archcanary/lynis-custom.prf /etc/lynis/custom.prf
+ echo " installed: /etc/lynis/custom.prf (Lynis false-positive suppressions — edit to enable)"
+ fi
+
+ # Seed auditd rules, same way, only if auditd is installed and the target
+ # has no ruleset yet — mirrors install.sh's runtime check, which package()
+ # cannot do at build time. Already root here, no sudo needed.
+ if command -v auditctl &>/dev/null; then
+ _audit_cfg=/etc/audit/rules.d/30-archcanary.rules
diff --git /home/ejm/.cache/yay/archcanary/PKGBUILD /home/ejm/.cache/yay/archcanary/PKGBUILD
new file mode 100644
index 0000000..12b8ac5
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/PKGBUILD
@@ -0,0 +1,163 @@
+# Maintainer: musqz <gummy-fang-deputy@duck.com>
+pkgname=archcanary
+pkgver=0.1.34
+pkgrel=1
+pkgdesc="Layered security detection stack for Arch Linux — malicious AUR packages, systemd/eBPF persistence, npm/bun cache poisoning, kernel module tampering"
+arch=('any')
+url="https://github.com/musqz/archcanary"
+license=('MIT')
+depends=('bash' 'pacman')
+optdepends=(
+ 'libnotify: desktop alerts on infected scan result'
+ 'polkit: privileged remediation commands (allowlist edits, audit-rules/lynis-config writes)'
+ 'bpf: bpftool for eBPF rootkit detection'
+ 'yay: AUR helper with Lua hook support'
+ 'paru: AUR helper with PreBuildCommand hook support'
+ 'bash-completion: tab-completion for archcanary/canary flags'
+)
+backup=('etc/archcanary/dkms_allowlist.conf'
+ 'etc/archcanary/systemd_allowlist.conf'
+ 'etc/archcanary/bpftool_allowlist.conf'
+ 'etc/archcanary/autostart_allowlist.conf')
+install=archcanary.install
+source=("$pkgname-$pkgver.tar.gz::https://github.com/musqz/$pkgname/archive/v$pkgver.tar.gz")
+sha256sums=('9af70610b8abf1f54bdb88512bf8e5881ce79066269bc8c29083235ca0d49205')
+
+package() {
+ cd "$srcdir/$pkgname-$pkgver"
+
+ # Stamp the real version into the placeholder install.sh normally sed's at
+ # install time — package() bypasses install.sh entirely, so without this
+ # every installed copy keeps the literal "@VERSION@" and --version shows
+ # "unknown".
+ sed -i "s/@VERSION@/$pkgver/" archcanary.sh
+ sed -i "s/@VERSION@/$pkgver/" man/archcanary.1
+
+ # Main user-facing binary
+ install -Dm755 archcanary.sh "$pkgdir/usr/bin/archcanary"
+
+ # Interactive terminal menu (replaces the removed yad GUI)
+ install -Dm755 archcanary-tui.sh "$pkgdir/usr/bin/archcanary-tui"
+
+ # Desktop entry launching the interactive menu
+ install -Dm644 configs/archcanary.desktop \
+ "$pkgdir/usr/share/applications/archcanary.desktop"
+
+ # Man page
+ install -Dm644 man/archcanary.1 "$pkgdir/usr/share/man/man1/archcanary.1"
+
+ # Bash completion (archcanary + canary alias)
+ install -Dm644 configs/archcanary-completion.bash \
+ "$pkgdir/usr/share/bash-completion/completions/archcanary"
+ ln -sf archcanary "$pkgdir/usr/share/bash-completion/completions/canary"
+
+ # System lib: scanner + root helper + threat lists (used by the root scan)
+ install -dm755 "$pkgdir/usr/lib/archcanary"
+ install -m755 archcanary.sh "$pkgdir/usr/lib/archcanary/archcanary.sh"
+ install -m755 lib/archcanary-root-helper "$pkgdir/usr/lib/archcanary/root-helper"
+ for _list in package_list.txt malicious_npm_packages.txt \
+ chaos_rat_packages.txt malicious_russian_spam_packages.txt \
+ community_reports.txt; do
+ install -Dm644 "lists/$_list" "$pkgdir/usr/lib/archcanary/$_list"
+ done
+ install -Dm644 configs/lynis-custom.prf \
+ "$pkgdir/usr/lib/archcanary/lynis-custom.prf"
+ install -Dm644 configs/audit-rules.conf \
+ "$pkgdir/usr/lib/archcanary/audit-rules.conf"
+ # yay Lua hook template — read-only reference copy, never installed to
+ # ~/.config/yay/init.lua automatically (that's a per-user path a pacman
+ # transaction can't reach, and hooks are opt-in either way). Lets an
+ # AUR-only install (no git clone) still have something to `cp`; see
+ # `archcanary --doctor`.
+ install -Dm644 configs/yay-init.lua \
+ "$pkgdir/usr/lib/archcanary/yay-init.lua"
+
+ # Polkit policy (authorises root-helper via pkexec)
+ install -Dm644 configs/org.archcanary.policy \
+ "$pkgdir/usr/share/polkit-1/actions/org.archcanary.policy"
+
+ # Systemd system units (root scan: weekly timer + pacman-triggered path;
+ # scan-all-homes: opt-in weekly sweep of every real local user's home)
+ for _unit in systemd/system/archcanary.service \
+ systemd/system/archcanary.timer \
+ systemd/system/archcanary.path \
+ systemd/system/archcanary-onchange.service \
+ systemd/system/archcanary-scan-all-homes.service \
+ systemd/system/archcanary-scan-all-homes.timer; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/system/$(basename "$_unit")"
+ done
+
+ # Systemd user units (user-scope scan + result notifier)
+ for _unit in systemd/user/archcanary-user.service \
+ systemd/user/archcanary-user.timer \
+ systemd/user/archcanary-notify.path \
+ systemd/user/archcanary-notify.service; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/user/$(basename "$_unit")"
+ done
+
+ # Allowlists — seeded as commented templates; users edit in place. pacman's
+ # backup=() array (see above) preserves local edits across upgrades.
+ install -dm755 "$pkgdir/etc/archcanary"
+ cat > "$pkgdir/etc/archcanary/dkms_allowlist.conf" << 'EOF'
+# DKMS modules to skip during --check-kmod (system-wide allowlist).
+# One module name per line. Everything after # is a comment.
+# Add modules that are known-good but not tracked by pacman.
+#
+# Common examples (uncomment as needed):
+# tuxedo-drivers # TUXEDO Computers hardware driver
+# v4l2loopback # virtual camera (OBS, video conferencing)
+# vboxdrv # VirtualBox host kernel module
+# vmmon # VMware Workstation
+EOF
+
+ cat > "$pkgdir/etc/archcanary/systemd_allowlist.conf" << 'EOF'
+# systemd units to skip during the systemd persistence check (--check-systemd),
+# system-wide allowlist. One unit name per line. Everything after # is a comment.
+# Add units that are known-good but not tracked by pacman and not vetted by the
+# standard-prefix check (e.g. a self-hosted app installed from an upstream
+# binary release rather than a package). A .timer is matched by its OWN name,
+# not its target .service — allowlist both if you want to silence both findings.
+#
+# Example:
+# forgejo.service # self-hosted git, installed from upstream binary release
+# forgejo.timer # only needed if forgejo also ships a persistent timer
+EOF
+
+ cat > "$pkgdir/etc/archcanary/bpftool_allowlist.conf" << 'EOF'
+# eBPF loader binaries to skip during the bpftool LSM-loader check
+# (--check-bpftool), system-wide allowlist. One binary basename per line.
+# Everything after # is a comment.
+# Add loaders that are known-good but not pacman-owned (a self-built or
+# manually-installed security/monitoring tool that legitimately loads LSM
+# eBPF hooks) — matched against the basename of /proc/<pid>/exe.
+#
+# Example:
+# falco # runtime security monitoring, installed from upstream binary release
+EOF
+
+ cat > "$pkgdir/etc/archcanary/autostart_allowlist.conf" << 'EOF'
+# Names to skip during the XDG autostart check (--check-autostart),
+# system-wide allowlist. One entry per line. Everything after # is a
+# comment. Covers two separate findings within the same check, each with
+# its own matching rule:
+#
+# 1. .desktop Exec= names that are known-good but can't be resolved via
+# $PATH or a standard system prefix — e.g. a package-private helper
+# binary the non-PATH fallback (search of /usr/lib, /usr/libexec) still
+# can't find, or an AppImage/Flatpak export. Matched against the bare
+# Exec= value exactly as written in the .desktop file (not a resolved
+# path) — usually just a command name.
+#
+# 2. User systemd service ExecStart= binaries unowned by pacman. Matched
+# against the ExecStart binary's exact, full path (NOT its basename —
+# a basename match would let an unrelated binary sharing that name
+# anywhere on disk slip through undetected). Useful for a package that
+# ships its user unit via /etc/skel (copied into ~/.config/systemd/user/
+# at account creation, so pacman never tracks that specific copy even
+# though the binary itself is a normal pacman-owned file).
+#
+# Examples:
+# zeitgeist-datahub # desktop activity logging, ships in a non-PATH libdir
+# /usr/bin/eos-update-notifier # EndeavourOS update notifier, user unit ships via /etc/skel
+EOF
+}
diff --git /home/ejm/.cache/yay/archcanary/archcanary.install /home/ejm/.cache/yay/archcanary/archcanary.install
new file mode 100644
index 0000000..9ea80a6
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/archcanary.install
@@ -0,0 +1,55 @@
+post_install() {
+ # Seed Lynis's false-positive-suppression profile, but only if lynis is
+ # actually installed and the target has no custom.prf of its own yet —
+ # mirrors install.sh's runtime check, which package() cannot do at build time.
+ if command -v lynis &>/dev/null && [[ ! -f /etc/lynis/custom.prf ]]; then
+ install -Dm644 /usr/lib/archcanary/lynis-custom.prf /etc/lynis/custom.prf
+ echo " installed: /etc/lynis/custom.prf (Lynis false-positive suppressions — edit to enable)"
+ fi
+
+ # Seed auditd rules, same way, only if auditd is installed and the target
+ # has no ruleset yet — mirrors install.sh's runtime check, which package()
+ # cannot do at build time. Already root here, no sudo needed.
+ if command -v auditctl &>/dev/null; then
+ _audit_cfg=/etc/audit/rules.d/30-archcanary.rules
+ _audit_cfg=/etc/audit/rules.d/30-archcanary.rules
diff --git /home/ejm/.cache/yay/archcanary/PKGBUILD /home/ejm/.cache/yay/archcanary/PKGBUILD
new file mode 100644
index 0000000..12b8ac5
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/PKGBUILD
@@ -0,0 +1,163 @@
+# Maintainer: musqz <gummy-fang-deputy@duck.com>
+pkgname=archcanary
+pkgver=0.1.34
+pkgrel=1
+pkgdesc="Layered security detection stack for Arch Linux — malicious AUR packages, systemd/eBPF persistence, npm/bun cache poisoning, kernel module tampering"
+arch=('any')
+url="https://github.com/musqz/archcanary"
+license=('MIT')
+depends=('bash' 'pacman')
+optdepends=(
+ 'libnotify: desktop alerts on infected scan result'
+ 'polkit: privileged remediation commands (allowlist edits, audit-rules/lynis-config writes)'
+ 'bpf: bpftool for eBPF rootkit detection'
+ 'yay: AUR helper with Lua hook support'
+ 'paru: AUR helper with PreBuildCommand hook support'
+ 'bash-completion: tab-completion for archcanary/canary flags'
+)
+backup=('etc/archcanary/dkms_allowlist.conf'
+ 'etc/archcanary/systemd_allowlist.conf'
+ 'etc/archcanary/bpftool_allowlist.conf'
+ 'etc/archcanary/autostart_allowlist.conf')
+install=archcanary.install
+source=("$pkgname-$pkgver.tar.gz::https://github.com/musqz/$pkgname/archive/v$pkgver.tar.gz")
+sha256sums=('9af70610b8abf1f54bdb88512bf8e5881ce79066269bc8c29083235ca0d49205')
+
+package() {
+ cd "$srcdir/$pkgname-$pkgver"
+
+ # Stamp the real version into the placeholder install.sh normally sed's at
+ # install time — package() bypasses install.sh entirely, so without this
+ # every installed copy keeps the literal "@VERSION@" and --version shows
+ # "unknown".
+ sed -i "s/@VERSION@/$pkgver/" archcanary.sh
+ sed -i "s/@VERSION@/$pkgver/" man/archcanary.1
+
+ # Main user-facing binary
+ install -Dm755 archcanary.sh "$pkgdir/usr/bin/archcanary"
+
+ # Interactive terminal menu (replaces the removed yad GUI)
+ install -Dm755 archcanary-tui.sh "$pkgdir/usr/bin/archcanary-tui"
+
+ # Desktop entry launching the interactive menu
+ install -Dm644 configs/archcanary.desktop \
+ "$pkgdir/usr/share/applications/archcanary.desktop"
+
+ # Man page
+ install -Dm644 man/archcanary.1 "$pkgdir/usr/share/man/man1/archcanary.1"
+
+ # Bash completion (archcanary + canary alias)
+ install -Dm644 configs/archcanary-completion.bash \
+ "$pkgdir/usr/share/bash-completion/completions/archcanary"
+ ln -sf archcanary "$pkgdir/usr/share/bash-completion/completions/canary"
+
+ # System lib: scanner + root helper + threat lists (used by the root scan)
+ install -dm755 "$pkgdir/usr/lib/archcanary"
+ install -m755 archcanary.sh "$pkgdir/usr/lib/archcanary/archcanary.sh"
+ install -m755 lib/archcanary-root-helper "$pkgdir/usr/lib/archcanary/root-helper"
+ for _list in package_list.txt malicious_npm_packages.txt \
+ chaos_rat_packages.txt malicious_russian_spam_packages.txt \
+ community_reports.txt; do
+ install -Dm644 "lists/$_list" "$pkgdir/usr/lib/archcanary/$_list"
+ done
+ install -Dm644 configs/lynis-custom.prf \
+ "$pkgdir/usr/lib/archcanary/lynis-custom.prf"
+ install -Dm644 configs/audit-rules.conf \
+ "$pkgdir/usr/lib/archcanary/audit-rules.conf"
+ # yay Lua hook template — read-only reference copy, never installed to
+ # ~/.config/yay/init.lua automatically (that's a per-user path a pacman
+ # transaction can't reach, and hooks are opt-in either way). Lets an
+ # AUR-only install (no git clone) still have something to `cp`; see
+ # `archcanary --doctor`.
+ install -Dm644 configs/yay-init.lua \
+ "$pkgdir/usr/lib/archcanary/yay-init.lua"
+
+ # Polkit policy (authorises root-helper via pkexec)
+ install -Dm644 configs/org.archcanary.policy \
+ "$pkgdir/usr/share/polkit-1/actions/org.archcanary.policy"
+
+ # Systemd system units (root scan: weekly timer + pacman-triggered path;
+ # scan-all-homes: opt-in weekly sweep of every real local user's home)
+ for _unit in systemd/system/archcanary.service \
+ systemd/system/archcanary.timer \
+ systemd/system/archcanary.path \
+ systemd/system/archcanary-onchange.service \
+ systemd/system/archcanary-scan-all-homes.service \
+ systemd/system/archcanary-scan-all-homes.timer; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/system/$(basename "$_unit")"
+ done
+
+ # Systemd user units (user-scope scan + result notifier)
+ for _unit in systemd/user/archcanary-user.service \
+ systemd/user/archcanary-user.timer \
+ systemd/user/archcanary-notify.path \
+ systemd/user/archcanary-notify.service; do
+ install -Dm644 "$_unit" "$pkgdir/usr/lib/systemd/user/$(basename "$_unit")"
+ done
+
+ # Allowlists — seeded as commented templates; users edit in place. pacman's
+ # backup=() array (see above) preserves local edits across upgrades.
+ install -dm755 "$pkgdir/etc/archcanary"
+ cat > "$pkgdir/etc/archcanary/dkms_allowlist.conf" << 'EOF'
+# DKMS modules to skip during --check-kmod (system-wide allowlist).
+# One module name per line. Everything after # is a comment.
+# Add modules that are known-good but not tracked by pacman.
+#
+# Common examples (uncomment as needed):
+# tuxedo-drivers # TUXEDO Computers hardware driver
+# v4l2loopback # virtual camera (OBS, video conferencing)
+# vboxdrv # VirtualBox host kernel module
+# vmmon # VMware Workstation
+EOF
+
+ cat > "$pkgdir/etc/archcanary/systemd_allowlist.conf" << 'EOF'
+# systemd units to skip during the systemd persistence check (--check-systemd),
+# system-wide allowlist. One unit name per line. Everything after # is a comment.
+# Add units that are known-good but not tracked by pacman and not vetted by the
+# standard-prefix check (e.g. a self-hosted app installed from an upstream
+# binary release rather than a package). A .timer is matched by its OWN name,
+# not its target .service — allowlist both if you want to silence both findings.
+#
+# Example:
+# forgejo.service # self-hosted git, installed from upstream binary release
+# forgejo.timer # only needed if forgejo also ships a persistent timer
+EOF
+
+ cat > "$pkgdir/etc/archcanary/bpftool_allowlist.conf" << 'EOF'
+# eBPF loader binaries to skip during the bpftool LSM-loader check
+# (--check-bpftool), system-wide allowlist. One binary basename per line.
+# Everything after # is a comment.
+# Add loaders that are known-good but not pacman-owned (a self-built or
+# manually-installed security/monitoring tool that legitimately loads LSM
+# eBPF hooks) — matched against the basename of /proc/<pid>/exe.
+#
+# Example:
+# falco # runtime security monitoring, installed from upstream binary release
+EOF
+
+ cat > "$pkgdir/etc/archcanary/autostart_allowlist.conf" << 'EOF'
+# Names to skip during the XDG autostart check (--check-autostart),
+# system-wide allowlist. One entry per line. Everything after # is a
+# comment. Covers two separate findings within the same check, each with
+# its own matching rule:
+#
+# 1. .desktop Exec= names that are known-good but can't be resolved via
+# $PATH or a standard system prefix — e.g. a package-private helper
+# binary the non-PATH fallback (search of /usr/lib, /usr/libexec) still
+# can't find, or an AppImage/Flatpak export. Matched against the bare
+# Exec= value exactly as written in the .desktop file (not a resolved
+# path) — usually just a command name.
+#
+# 2. User systemd service ExecStart= binaries unowned by pacman. Matched
+# against the ExecStart binary's exact, full path (NOT its basename —
+# a basename match would let an unrelated binary sharing that name
+# anywhere on disk slip through undetected). Useful for a package that
+# ships its user unit via /etc/skel (copied into ~/.config/systemd/user/
+# at account creation, so pacman never tracks that specific copy even
+# though the binary itself is a normal pacman-owned file).
+#
+# Examples:
+# zeitgeist-datahub # desktop activity logging, ships in a non-PATH libdir
+# /usr/bin/eos-update-notifier # EndeavourOS update notifier, user unit ships via /etc/skel
+EOF
+}
diff --git /home/ejm/.cache/yay/archcanary/archcanary.install /home/ejm/.cache/yay/archcanary/archcanary.install
new file mode 100644
index 0000000..9ea80a6
--- /dev/null
+++ /home/ejm/.cache/yay/archcanary/archcanary.install
@@ -0,0 +1,55 @@
+post_install() {
+ # Seed Lynis's false-positive-suppression profile, but only if lynis is
+ # actually installed and the target has no custom.prf of its own yet —
+ # mirrors install.sh's runtime check, which package() cannot do at build time.
+ if command -v lynis &>/dev/null && [[ ! -f /etc/lynis/custom.prf ]]; then
+ install -Dm644 /usr/lib/archcanary/lynis-custom.prf /etc/lynis/custom.prf
+ echo " installed: /etc/lynis/custom.prf (Lynis false-positive suppressions — edit to enable)"
+ fi
+
+ # Seed auditd rules, same way, only if auditd is installed and the target
+ # has no ruleset yet — mirrors install.sh's runtime check, which package()
+ # cannot do at build time. Already root here, no sudo needed.
+ if command -v auditctl &>/dev/null; then
+ _audit_cfg=/etc/audit/rules.d/30-archcanary.rules
+ install -d -m 755 /etc/audit/rules.d
+ rm -f /etc/audit/rules.d/30-archcanary.conf /etc/audit/rules.d/archcanary.conf
+ if ! grep -qE '^\s*-[waAbfe]' "$_audit_cfg" 2>/dev/null; then
+ install -m 644 /usr/lib/archcanary/audit-rules.conf "$_audit_cfg"
+ augenrules --load >/dev/null 2>&1 || true
+ echo " installed: $_audit_cfg (auditd rules — edit with --audit-rules-get/--audit-rules-set)"
+ fi
+ unset _audit_cfg
+ fi
+
+ echo ""
+ echo "==> archcanary installed."
+ echo ""
+ echo " Enable the automated system scan (runs as root — weekly + on boot + after pacman):"
+ echo " sudo systemctl enable --now archcanary.timer archcanary.path"
+ echo ""
+ echo " Enable the user-scope scan and result notifier (run as your user):"
+ echo " systemctl --user enable --now archcanary-user.timer archcanary-notify.path"
+ echo ""
+ echo " Optional, machine-wide: weekly scan of every other real local user's"
+ echo " home too, not just yours (see --scan-all-homes) — off by default:"
+ echo " sudo systemctl enable --now archcanary-scan-all-homes.timer"
+ echo ""
+ echo " Run a manual full scan:"
+ echo " archcanary --refresh --full"
+ echo ""
+ echo " This package installs the system-wide pieces (binaries, systemd units,"
+ echo " polkit policy, /etc allowlists). Per-user setup can't be done from here"
+ echo " since it has to run as YOUR user, not the pacman transaction — run:"
+ echo " archcanary --doctor"
+ echo " to see exactly what's still missing (yay hooks, lynis)"
+ echo " and the precise command to fix each one."
+ echo ""
+ echo " Optional add-ons: lynis (hardening auditor)."
+ echo " See: https://github.com/musqz/archcanary"
+ echo ""
+}
+
+post_upgrade() {
+ post_install
+}
@Stagger_Lee, I thought I’d try rebuilding Archcanary to see what would happen. I clicked enter and 1 was chosen. Could this be an Archcanary issue?
─❯ yay -S archcanary --rebuild
AUR Explicit (1): archcanary-0.1.34-1
:: PKGBUILD up to date, skipping download: archcanary
1 archcanary (Installed) (Build Files Exist)
==> Packages to cleanBuild?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==>
1 archcanary (Installed) (Build Files Exist)
==> Diffs to show?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==>
1 archcanary (Installed) (Build Files Exist)
==> PKGBUILDs to edit?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==>
==> Making package: archcanary 0.1.34-1 (Fri 11 Sep 2026 11:58:56 AM CDT)
==> Retrieving sources...
-> Found archcanary-0.1.34.tar.gz
==> WARNING: Skipping verification of source file PGP signatures.
==> Validating source files with sha256sums...
archcanary-0.1.34.tar.gz ... Passed
:: (1/1) Parsing SRCINFO: archcanary
==> Making package: archcanary 0.1.34-1 (Fri 11 Sep 2026 11:58:57 AM CDT)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
-> Found archcanary-0.1.34.tar.gz
==> Validating source files with sha256sums...
archcanary-0.1.34.tar.gz ... Passed
==> Removing existing $srcdir/ directory...
==> Extracting sources...
-> Extracting archcanary-0.1.34.tar.gz with bsdtar
==> Sources are ready.
==> Making package: archcanary 0.1.34-1 (Fri 11 Sep 2026 11:58:59 AM CDT)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> WARNING: Using existing $srcdir/ tree
==> Entering fakeroot environment...
==> Starting package()...
==> Tidying install...
-> Removing libtool files...
-> Purging unreproducible ruby files...
-> Removing static library files...
-> Purging unwanted files...
-> Stripping unneeded symbols from binaries and libraries...
-> Compressing man and info pages...
==> Checking for packaging issues...
==> Creating package "archcanary"...
-> Generating .PKGINFO file...
-> Generating .BUILDINFO file...
-> Adding install file...
-> Generating .MTREE file...
-> Compressing package...
==> Leaving fakeroot environment.
==> Finished making: archcanary 0.1.34-1 (Fri 11 Sep 2026 11:59:02 AM CDT)
==> Cleaning up...
[sudo] password for wombat:
loading packages...
warning: archcanary-0.1.34-1 is up to date -- reinstalling
resolving dependencies...
looking for conflicting packages...
Package (1) Old Version New Version Net Change
archcanary 0.1.34-1 0.1.34-1 0.00 MiB
Total Installed Size: 0.54 MiB
Net Upgrade Size: 0.00 MiB
:: Proceed with installation? [Y/n]
(1/1) checking keys in keyring [----------------------------------------------------] 100%
(1/1) checking package integrity [----------------------------------------------------] 100%
(1/1) loading package files [----------------------------------------------------] 100%
(1/1) checking for file conflicts [----------------------------------------------------] 100%
:: Processing package changes...
(1/1) reinstalling archcanary [----------------------------------------------------] 100%
==> archcanary installed.
Enable the automated system scan (runs as root — weekly + on boot + after pacman):
sudo systemctl enable --now archcanary.timer archcanary.path
Enable the user-scope scan and result notifier (run as your user):
systemctl --user enable --now archcanary-user.timer archcanary-notify.path
Optional, machine-wide: weekly scan of every other real local user's
home too, not just yours (see --scan-all-homes) — off by default:
sudo systemctl enable --now archcanary-scan-all-homes.timer
Run a manual full scan:
archcanary --refresh --full
This package installs the system-wide pieces (binaries, systemd units,
polkit policy, /etc allowlists). Per-user setup can't be done from here
since it has to run as YOUR user, not the pacman transaction — run:
archcanary --doctor
to see exactly what's still missing (yay hooks, lynis)
and the precise command to fix each one.
Optional add-ons: lynis (hardening auditor).
See: https://github.com/musqz/archcanary
:: Running post-transaction hooks...
(1/6) Reloading system manager configuration...
(2/6) Reloading user manager configuration...
(3/6) Enqueuing marked services...
(4/6) Arming ConditionNeedsUpdate...
(5/6) Checking which packages need to be rebuilt
(6/6) Updating the desktop file MIME type cache...
==> AUR installed: archcanary 0.1.34-1
─❯
Interesting observation! Now I’m eager for some other AUR package to require an update. I’ve cut down on AUR packages sharply, so it might be a while. 
Well, it certainly seems that way.
@ArchieLinux , pick a random AUR package in your cache (something that doesn’t take long to build) and see what happens.
Well I’ll be damned. It does the same behavior here, using a random AUR package (not archcanary) - cleanbuild defaults to “1” instead of 'None."
I’m calling this a bug with yay.
Same here…
[ejm@mbp ~]$ yay -S wayshot
AUR Explicit (1): wayshot-1.6.0-1
Sync Make Dependency (2): scdoc-1.11.5-1, rust-1:1.98.1-1
:: (1/1) Downloaded PKGBUILD: wayshot
1 wayshot (Build Files Exist)
==> Packages to cleanBuild?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==> N
1 wayshot (Build Files Exist)
==> Diffs to show?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==> A
diff --git /home/ejm/.cache/yay/wayshot/.gitignore /home/ejm/.cache/yay/wayshot/.gitignore
new file mode 100644
index 0000000..e4f9ba3
--- /dev/null
+++ /home/ejm/.cache/yay/wayshot/.gitignore
@@ -0,0 +1,4 @@
+*
+!.SRCINFO
+!PKGBUILD
+!.gitignore
diff --git /home/ejm/.cache/yay/wayshot/PKGBUILD /home/ejm/.cache/yay/wayshot/PKGBUILD
new file mode 100644
index 0000000..e7a2ba1
--- /dev/null
+++ /home/ejm/.cache/yay/wayshot/PKGBUILD
@@ -0,0 +1,43 @@
+# Maintainer: Gigas002 <gigas002@pm.me>
+
+pkgname=wayshot
+pkgver=1.6.0
+pkgrel=1
+pkgdesc="Screenshot tool for wlroots compositors"
+arch=(x86_64)
+url="https://github.com/waycrate/$pkgname"
+license=(
+ 'GPL-3.0-or-later'
+)
+depends=(gcc-libs glibc libdrm libjxl mesa wayland)
+optdepends=('slurp: region selection'
+ 'waysip: region selection')
+makedepends=(cargo git scdoc)
+source=("git+$url#tag=v$pkgver")
+b2sums=('87d5f365c55e71dffe9d1d283a59d420d84e38c6e51213a871dc539ad000b15d68e51e3370a43576f37821b77c85c878eb0c64c1c3bfc24b49a6b368d8ea2022')
+
+prepare() {
+ cd $pkgname
+
+ # build.rs compiles and gzips man pages; we handle scdoc manually
+ rm -f build.rs
+
+ export RUSTUP_TOOLCHAIN=stable
+ cargo fetch --locked
+}
+
+build() {
+ cd $pkgname
+ export RUSTUP_TOOLCHAIN=stable
+ export CARGO_TARGET_DIR=target
+ cargo build --frozen --release --all-features
+}
+
+package() {
+ cd $pkgname
+ install -Dm755 target/release/$pkgname -t "$pkgdir/usr/bin/"
+ scdoc < docs/$pkgname.1.scd | install -Dm644 /dev/stdin "$pkgdir/usr/share/man/man1/$pkgname.1"
+ scdoc < docs/$pkgname.5.scd | install -Dm644 /dev/stdin "$pkgdir/usr/share/man/man5/$pkgname.5"
+ scdoc < docs/$pkgname.7.scd | install -Dm644 /dev/stdin "$pkgdir/usr/share/man/man7/$pkgname.7"
+ install -Dm644 LICENSE-GPL -t "$pkgdir/usr/share/licenses/$pkgname/"
+}
Seems so!
─❯ yay -S upscayl-bin --rebuild
AUR Explicit (1): upscayl-bin-2.15.0-10
:: PKGBUILD up to date, skipping download: upscayl-bin
1 upscayl-bin (Installed) (Build Files Exist)
==> Packages to cleanBuild?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==>
1 upscayl-bin (Installed) (Build Files Exist)
==> Diffs to show?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==>
1 upscayl-bin (Installed) (Build Files Exist)
==> PKGBUILDs to edit?
==> [N]one [A]ll [Ab]ort [I]nstalled [No]tInstalled or (1 2 3, 1-3, ^4)
==>
==> Making package: upscayl-bin 2.15.0-10 (Fri 11 Sep 2026 12:08:38 PM CDT)
==> Retrieving sources...
-> Downloading upscayl-2.15.0-linux.zip...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 0
100 290.1M 100 290.1M 0 0 98.42M 0 00:02 00:02 106.0M
-> Found upscayl
-> Found org.upscayl.Upscayl.desktop
==> WARNING: Skipping verification of source file PGP signatures.
==> Validating source files with sha512sums...
upscayl-2.15.0-linux.zip ... Passed
upscayl ... Passed
org.upscayl.Upscayl.desktop ... Passed
:: (1/1) Parsing SRCINFO: upscayl-bin
==> Making package: upscayl-bin 2.15.0-10 (Fri 11 Sep 2026 12:08:42 PM CDT)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
-> Found upscayl-2.15.0-linux.zip
-> Found upscayl
-> Found org.upscayl.Upscayl.desktop
==> Validating source files with sha512sums...
upscayl-2.15.0-linux.zip ... Passed
upscayl ... Passed
org.upscayl.Upscayl.desktop ... Passed
==> Removing existing $srcdir/ directory...
==> Extracting sources...
==> Starting prepare()...
Archive: upscayl-2.15.0-linux.zip
inflating: upscayl-2.15.0/LICENSE.electron.txt
inflating: upscayl-2.15.0/LICENSES.chromium.html
inflating: upscayl-2.15.0/chrome-sandbox
inflating: upscayl-2.15.0/chrome_100_percent.pak
inflating: upscayl-2.15.0/chrome_200_percent.pak
inflating: upscayl-2.15.0/chrome_crashpad_handler
inflating: upscayl-2.15.0/icudtl.dat
inflating: upscayl-2.15.0/libEGL.so
inflating: upscayl-2.15.0/libGLESv2.so
inflating: upscayl-2.15.0/libffmpeg.so
inflating: upscayl-2.15.0/libvk_swiftshader.so
inflating: upscayl-2.15.0/libvulkan.so.1
creating: upscayl-2.15.0/locales/
inflating: upscayl-2.15.0/locales/af.pak
inflating: upscayl-2.15.0/locales/am.pak
inflating: upscayl-2.15.0/locales/ar.pak
inflating: upscayl-2.15.0/locales/bg.pak
inflating: upscayl-2.15.0/locales/bn.pak
inflating: upscayl-2.15.0/locales/ca.pak
inflating: upscayl-2.15.0/locales/cs.pak
inflating: upscayl-2.15.0/locales/da.pak
inflating: upscayl-2.15.0/locales/de.pak
inflating: upscayl-2.15.0/locales/el.pak
inflating: upscayl-2.15.0/locales/en-GB.pak
inflating: upscayl-2.15.0/locales/en-US.pak
inflating: upscayl-2.15.0/locales/es-419.pak
inflating: upscayl-2.15.0/locales/es.pak
inflating: upscayl-2.15.0/locales/et.pak
inflating: upscayl-2.15.0/locales/fa.pak
inflating: upscayl-2.15.0/locales/fi.pak
inflating: upscayl-2.15.0/locales/fil.pak
inflating: upscayl-2.15.0/locales/fr.pak
inflating: upscayl-2.15.0/locales/gu.pak
inflating: upscayl-2.15.0/locales/he.pak
inflating: upscayl-2.15.0/locales/hi.pak
inflating: upscayl-2.15.0/locales/hr.pak
inflating: upscayl-2.15.0/locales/hu.pak
inflating: upscayl-2.15.0/locales/id.pak
inflating: upscayl-2.15.0/locales/it.pak
inflating: upscayl-2.15.0/locales/ja.pak
inflating: upscayl-2.15.0/locales/kn.pak
inflating: upscayl-2.15.0/locales/ko.pak
inflating: upscayl-2.15.0/locales/lt.pak
inflating: upscayl-2.15.0/locales/lv.pak
inflating: upscayl-2.15.0/locales/ml.pak
inflating: upscayl-2.15.0/locales/mr.pak
inflating: upscayl-2.15.0/locales/ms.pak
inflating: upscayl-2.15.0/locales/nb.pak
inflating: upscayl-2.15.0/locales/nl.pak
inflating: upscayl-2.15.0/locales/pl.pak
inflating: upscayl-2.15.0/locales/pt-BR.pak
inflating: upscayl-2.15.0/locales/pt-PT.pak
inflating: upscayl-2.15.0/locales/ro.pak
inflating: upscayl-2.15.0/locales/ru.pak
inflating: upscayl-2.15.0/locales/sk.pak
inflating: upscayl-2.15.0/locales/sl.pak
inflating: upscayl-2.15.0/locales/sr.pak
inflating: upscayl-2.15.0/locales/sv.pak
inflating: upscayl-2.15.0/locales/sw.pak
inflating: upscayl-2.15.0/locales/ta.pak
inflating: upscayl-2.15.0/locales/te.pak
inflating: upscayl-2.15.0/locales/th.pak
inflating: upscayl-2.15.0/locales/tr.pak
inflating: upscayl-2.15.0/locales/uk.pak
inflating: upscayl-2.15.0/locales/ur.pak
inflating: upscayl-2.15.0/locales/vi.pak
inflating: upscayl-2.15.0/locales/zh-CN.pak
inflating: upscayl-2.15.0/locales/zh-TW.pak
creating: upscayl-2.15.0/resources/
inflating: upscayl-2.15.0/resources.pak
inflating: upscayl-2.15.0/resources/512x512.png
inflating: upscayl-2.15.0/resources/app-update.yml
inflating: upscayl-2.15.0/resources/app.asar
creating: upscayl-2.15.0/resources/bin/
inflating: upscayl-2.15.0/resources/bin/upscayl-bin
creating: upscayl-2.15.0/resources/models/
inflating: upscayl-2.15.0/resources/models/digital-art-4x.bin
inflating: upscayl-2.15.0/resources/models/digital-art-4x.param
inflating: upscayl-2.15.0/resources/models/high-fidelity-4x.bin
inflating: upscayl-2.15.0/resources/models/high-fidelity-4x.param
inflating: upscayl-2.15.0/resources/models/remacri-4x.bin
inflating: upscayl-2.15.0/resources/models/remacri-4x.param
inflating: upscayl-2.15.0/resources/models/ultramix-balanced-4x.bin
inflating: upscayl-2.15.0/resources/models/ultramix-balanced-4x.param
inflating: upscayl-2.15.0/resources/models/ultrasharp-4x.bin
inflating: upscayl-2.15.0/resources/models/ultrasharp-4x.param
inflating: upscayl-2.15.0/resources/models/upscayl-lite-4x.bin
inflating: upscayl-2.15.0/resources/models/upscayl-lite-4x.param
inflating: upscayl-2.15.0/resources/models/upscayl-standard-4x.bin
inflating: upscayl-2.15.0/resources/models/upscayl-standard-4x.param
inflating: upscayl-2.15.0/snapshot_blob.bin
inflating: upscayl-2.15.0/upscayl
inflating: upscayl-2.15.0/v8_context_snapshot.bin
inflating: upscayl-2.15.0/vk_swiftshader_icd.json
==> Sources are ready.
==> Making package: upscayl-bin 2.15.0-10 (Fri 11 Sep 2026 12:08:47 PM CDT)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> WARNING: Using existing $srcdir/ tree
==> Entering fakeroot environment...
==> Starting package()...
==> Tidying install...
-> Removing libtool files...
-> Purging unreproducible ruby files...
-> Removing static library files...
-> Purging unwanted files...
-> Stripping unneeded symbols from binaries and libraries...
-> Compressing man and info pages...
==> Checking for packaging issues...
==> Creating package "upscayl-bin"...
-> Generating .PKGINFO file...
-> Generating .BUILDINFO file...
-> Generating .MTREE file...
-> Compressing package...
==> Leaving fakeroot environment.
==> Finished making: upscayl-bin 2.15.0-10 (Fri 11 Sep 2026 12:08:52 PM CDT)
==> Cleaning up...
[sudo] password for wombat:
loading packages...
warning: upscayl-bin-2.15.0-10 is up to date -- reinstalling
resolving dependencies...
looking for conflicting packages...
Package (1) Old Version New Version Net Change
upscayl-bin 2.15.0-10 2.15.0-10 0.00 MiB
Total Installed Size: 355.38 MiB
Net Upgrade Size: 0.00 MiB
:: Proceed with installation? [Y/n]
(1/1) checking keys in keyring [----------------------------------------------------] 100%
(1/1) checking package integrity [----------------------------------------------------] 100%
(1/1) loading package files [----------------------------------------------------] 100%
(1/1) checking for file conflicts [----------------------------------------------------] 100%
:: Processing package changes...
(1/1) reinstalling upscayl-bin [----------------------------------------------------] 100%
:: Running post-transaction hooks...
(1/3) Arming ConditionNeedsUpdate...
(2/3) Checking which packages need to be rebuilt
(3/3) Updating the desktop file MIME type cache...
==> AUR installed: upscayl-bin 2.15.0-10
─❯