02 Security · Static analysis

TrustSight

Evidence-driven security analysis for AUR packages. It never executes code, never fetches sources, and fails closed when coverage is incomplete.

A clean result is not proof of safety. It is a statement about detection.

Python 3.11+Arch LinuxSQLiteEd25519libgit2
GitHub Docs trustsight.org Watcher Harness PyPI

Documented rules

257

Source URLs

186K

Maintainer identities

36K

Release

v0.22.0

01

Problem

AUR package updates are reviewed by humans reading PKGBUILD diffs. This process is slow, inconsistent, and misses structural attacks: piped shell scripts, checksum disabling, typosquatting, obfuscated commands, and maintainer takeovers. There is no automated tool that produces evidence without executing the package.

02

Why it's hard

The hard constraint is never executing code. Static analysis of PKGBUILDs means reasoning about shell scripts, command injection, typosquatting, and maintainer behavior patterns without running anything.

Corpus-wide cluster detection adds another layer: tracking roughly 186K source URLs and 36K maintainer identities to detect first-seen signals, orphan hijacking, and accelerated release cadence. The tool must fail closed; incomplete evidence must not silently become confidence.

03

Security model

Invariants
PKGBUILD execution BLOCKED
Arbitrary network BLOCKED
System modification BLOCKED
Coverage loss EXPLICIT
Incomplete analysis FAIL-CLOSED
04

Detection categories

Command injection

Piped shell scripts, obfuscated commands, build-environment tampering (LD_PRELOAD, and peers).

Supply chain

Checksum disabled, source URL swaps, unpinned build dependencies, GPG verification removed.

Typosquatting

Package-name and source-URL edit distance against known forge domains and popular packages.

Maintainer signals

Untrusted takeover, orphan hijacking, stale package revived, accelerated release cadence.

Novelty detection

First-seen URLs and maintainers against a signed seed database of ~186K source URLs and ~36K identities.

Sabotage payloads

Fork bombs, disk wiping, permission sabotage, coin miners; distinguishes build sandbox from system context.

Encoding attacks

Unicode bidi overrides, homoglyph codepoints, and reviewer-directed instruction templates.

IOC matching

Known-bad indicators against signed, federated baselines from the release channel.

05

Key decisions

Static analysis only

Never executes PKGBUILDs, never fetches URLs, runs before makepkg. The tool is a SAST tool by design.

Evidence, not proof

Every finding is traceable to a specific diff line, URL, or novelty record. The output is a structured evidence report, not a gate.

Signed baselines

Novelty seed and IOC baselines ship as signed GitHub release assets, verified against a pinned distribution key on import.

Configurable dependency depth

AUR dependencies are analyzed as packages in their own right, to a configurable depth. Coverage gaps stay explicit.

06

Ecosystem

TrustSight is a core with five independent satellites: measurement, research, triage, the public site, and the live watcher feed.

trustsight

Core · CLI · watcher

The analysis engine, rule catalog, signed baselines, deterministic evidence reports, and the AUR watcher that feeds the public alert stream.

PythonSQLitelibgit2
Source ↗

trustsight-harness

Adversarial measurement

Turns "an LLM found N bypasses" into reproducible, cost-tracked campaigns against a pinned build. Also exposes an MCP server for feed and verification tools.

PythonDockerpytest
Source ↗

trustsight-lab

Offline research

Finds, ranks, and validates deterministic rule improvements in a throwaway worktree. Proposals require human review and the normal gates.

Pythonuvpytest
Source ↗

trustsight-triage-agent

Local-model triage

One process, one local model. Cited FP/TP triage over watcher alerts with no remote gateway, queue, or job container.

PythonOllamaMCP
Source ↗

trustsight-web

Product site

Single-page site for trustsight.org presenting the evidence-first review model: capabilities, calibration, configuration, and limits.

PreactVite
Source ↗

trustsight-feed

Live alert feed

Searchable archive of watcher alerts on Cloudflare Workers and D1, with per-rule explanations and full evidence documents.

WorkersD1Preact
Source ↗
07

Verification

The harness turns "an LLM found N bypasses" into a reproducible, auditable, cost-tracked measurement against a pinned build.

Harness statuses
detected rule fired
partial_evasion another rule caught it
fail_closed_catch coverage gap blocked
bypass returned UNFLAGGED
behavior_lost attack chain not proven
08

What it cannot see

  • Malicious upstream release tarballs (audits the PKGBUILD, not binaries)
  • Deliberately unremarkable attacks (no diff signal = invisible)
  • Runtime attacks (the tool never executes anything)
  • Zero-day structural attacks (pattern-based, calibrated against the corpus)