Pacsea v0.4.5 — Security scanning Tools

Security scanning upgrades, safer UX, and VirusTotal API setup.

Highlights

• New: VirusTotal API setup modal

  • Open the "my API key" page from the modal (Enter or mouse click)
  • Paste and save the key to settings.conf
  • Modal blocks main UI interactions to avoid accidental clicks/keys

• New: Security tools in Optional Deps

  • Security: clamav (Official)
  • Security: trivy (Official)
  • Security: semgrep-bin (AUR)
  • Security: shellcheck (Official)
  • Security: VirusTotal API (Setup)
  • Security: aur-sleuth (LLM audit, Setup)

• New: "Scan AUR package(s) before install"

  • From "Confirm Install" modal, press S to clone and scan
  • Runs: makepkg -o, clamscan, trivy fs, semgrep, shellcheck, VirusTotal hash lookups, custom suspicious pattern scanning, and aur-sleuth (optional)
  • Substantive end-of-scan summary (infections, vulns by severity, Semgrep count, VT stats)

• Enhanced: Comprehensive scan summary

  • ClamAV: infections count
  • Trivy: counts by severity (CRITICAL/HIGH/MEDIUM/LOW)
  • Semgrep: findings count
  • VirusTotal: files analyzed, known vs unknown, malicious/suspicious/harmless/undetected
  • ShellCheck: PKGBUILD and .install file analysis
  • Custom patterns: suspicious bash pattern detection
  • aur-sleuth: LLM-powered security audit results

How to use

Setup VirusTotal API

1. Options → Optional Deps → Security: VirusTotal API
2. Press Enter on empty field to open: https://www.virustotal.com/gui/my-apikey
3. Paste key and press Enter to save

Install security tools (Optional Deps)

• Security: clamav → sudo pacman -S --needed --noconfirm clamav
• Security: trivy → sudo pacman -S --needed --noconfirm trivy
• Security: semgrep-bin → AUR helper
• Security: shellcheck → sudo pacman -S --needed --noconfirm shellcheck
• Security: aur-sleuth → Setup guide provided in Optional Deps

Scan AUR before install

1. Add AUR package(s) to Install list → Enter (Confirm Install)
2. Press S to run the scan
3. Configure which scans to run (ClamAV, Trivy, Semgrep, ShellCheck, VirusTotal, custom patterns, aur-sleuth)
4. Review the summary at the end

Notes

• ClamAV: If signatures missing, scan prints clear instructions (sudo freshclam or start clamav-freshclam)
• VirusTotal: If VT_API_KEY not in env, scan auto-reads virustotal_api_key from settings.conf
• aur-sleuth: Requires manual installation; setup instructions provided in Optional Deps modal
• Summary includes:
  • ClamAV: infections
  • Trivy: counts by severity (CRITICAL/HIGH/MEDIUM/LOW)
  • Semgrep: findings count
  • VirusTotal: files analyzed, known vs unknown, malicious/suspicious/harmless/undetected
  • ShellCheck: PKGBUILD/.install linting results
  • Custom patterns: suspicious bash pattern matches
  • aur-sleuth: LLM audit findings (if enabled)

Upgrade notes

• No config changes required
• Optional: Install security tools via Optional Deps modal for enhanced scanning capabilities
• Optional: Configure VirusTotal API key for hash-based malware detection

Full Changelog: v0.4.4...v0.4.5