TrustSight

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then produces a deterministic evidence report.

Setup

Not published to the AUR yet: aur.archlinux.org/trustsight.git does not exist. Build from the PKGBUILD in this repository.

# 1. Install
git clone https://github.com/emiliano-go/trustsight.git
cd trustsight/packaging/aur
makepkg -si

# 2. Scan your outdated AUR packages
trustsight review

Requires Python 3.11+ and Arch Linux (the tool discovers packages via pacman -Qm, pacman -Sl for local repos, or --repo/--all-repos flags).

The analysis is deterministic and calculated locally. Verdicts are template-based, describing each finding in plain English, for example "Version bump. modified PKGBUILD, .SRCINFO. Signals: checksum disabled; novel dependency 'pyfoo' added in depends."

Baselines ship as signed GitHub release assets (baseline-seed.tar.gz, IOC baselines, the corpus). On first use the tool downloads the novelty seed and imports it only after its ed25519 signature verifies against the pinned distribution key; when offline, the attempt is skipped silently and the run starts cold. See installation for details.

Security model

TrustSight is evidence-producing, not proof-of-safety. Read the full security model for the threat model, invariants, and enforcement gates. It audits and does not install. The tool never runs the PKGBUILD, never executes extracted commands, and never modifies your system. Every finding is traceable to a specific diff line, URL, or novelty record. The output is a structured evidence report, not a gate. See what TrustSight cannot see.

What it detects

What it cannot detect

The default review output shows findings and a verdict, not score or risk columns. Add --score or --risk when you want the numeric band in the terminal. A clean score means no known risk signals fired, not that the package is safe. See what TrustSight cannot see for details.

The 30-second example

trustsight review

                        TrustSight Review
┏━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Package         ┃ Risk Score   ┃ Verdict                                   ┃
┃                 ┃              ┃                                           ┃
┡━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ chez-scheme-bin │   0/100      │ Version bump. No structural changes.      │
├─────────────────┼──────────────┼───────────────────────────────────────────┤
│ sketchy-pkg     │  35/100      │ R004 HIGH  Checksum disabled (SKIP).      │
│                 │              │ C003 INFO  Source URL changed without     │
│                 │              │            version bump.                  │
│                 │              │ SOURCE_BUCKET MEDIUM  New domain:         │
│                 │              │   sketchy-cdn.invalid (unknown).          │
│                 │              │ NOVELTY HIGH  Source URL first seen       │
│                 │              │   globally.                               │
│                 │              │ PINNING INFO  Source pinning: unpinned.   │
│                 │              │ Verdict: Checksum disabled; sources       │
│                 │              │   replaced with content from an unknown,  │
│                 │              │   never-before-seen domain.               │
├─────────────────┼──────────────┼───────────────────────────────────────────┤
│ obsidian-beta   │  15/100      │ INCONCLUSIVE. Only 2 prior observations;  │
│                 │              │ no high-severity signals from a cold DB.  │
└─────────────────┴──────────────┴───────────────────────────────────────────┘

The tiered evidence display is the differentiator: every signal (rule, bucket, novelty, pinning, verification) is shown with its contribution and severity. You see why the score is what it is.

Commands

Use it from Python

Every flow above is available as a library through trustsight.api, which returns dataclasses instead of printing. Nothing else under trustsight. is public.

from trustsight import TrustSight

ts = TrustSight()

report = ts.inspect("some-package")
print(report.risk_label, report.verdict)

result = ts.review(limit=25)
for r in result.flagged:
    print(r.package, r.risk, r.verdict)
for failure in result.failures:
    print("NOT VETTED:", failure.package, failure.error)

for cycle in ts.watch(interval=1800):     # full-aur --watch, as a generator
    for package, rule_id in cycle.new_alerts:
        print(rule_id, package)

Two rules carry over from the CLI. Use report.risk, never a band re-derived from report.score: an analysis that could not read the whole change reports Inconclusive regardless of the number. And check result.failures, because a package that could not be analysed is a result, not an absence.

How scoring works

Scoring is fully deterministic: same input always produces the same score. The pipeline is:

1. Diff the old and new PKGBUILD
2. Apply rules to detect structural changes, suspicious commands, typosquatting, etc.
3. Classify URLs into trust buckets (official, self-hosted, unknown, homograph)
4. Check novelty against the local database of known URLs and maintainers
5. Calculate score from 0-100 by summing weighted contributions across four evidence tiers

Signals come from 13 core detection rules (R001-R013), the expanded TOML set (R039-R059), code-emitted rules (R060+), 4 dependency-graph rules (D001-D004) and 7 code-structure rules (C001-C007), all calibrated against a 3,246-diff benign corpus and a 3,322-diff stratified corpus of real AUR updates.

Verdicts are template-based, describing each triggered finding in plain English. The score is never influenced by the verdict text.

See scoring philosophy.

License

MIT

Documentation hub