Greetings.
Extended the scan over all 111,018 live packages, static rules only,
offline. Three packages tripped a non-overridable rule, all piping an
upstream installer to a shell at build time:
grok-build-git sh.rustup.rs | sh
swiss-army-knife-hs get-ghcup.haskell.org | sh
qoder-cli qoder.com/install | bash
Nothing resembling the xsnow worm.
So far so good but from a closer look at random 20 packages the rules
did not flag:
tarah package() runs "sudo cp target/release/tarah
/usr/bin" — installs onto the live system,
bypassing fakeroot and $pkgdir
freetype2-wps patch fetched from a live GitLab merge-request
diff URL, mutable
power-menu-bin pkgver=0.1.2, source URL fetches v0.1.1,
md5sums=SKIP
None malicious, yet all worth to clean up.
Unfortunately no regex expresses "declared version does not
match the URL" or "this patch source can change after review".
Writing one rule per case is possible; enumerating the cases in
advance is not.
Static rules are a floor, not a screen. A "clean" result means
nothing matched the patterns we thought to write — not that
the AUR is clean.
Best and cheers,
Andreas
