archcanary

What it is

archcanary (v0.1.28 at time of writing — pre-1.0) is a read-only Arch Linux security scanner distributed via the AUR or source. The existing summary covers its detection scope; what follows is the operational detail needed to actually run and interpret it.

How it works

Detection is layered and off by default. Bare archcanary only matches installed packages against the known-bad threat-intel lists — nothing else runs unless you add flags or --full. Some checks require root. Threat-intel is fetched on --refresh, and the banner prints each list's entry count and how much it changed since last run (e.g. aur-audit red 269, aur-audit black 101, Russian spam 75), so a suddenly growing feed is visible.

Preconditions / Affected

Arch and derivatives — developed on Mabox, tested by the EndeavourOS community, said to run on Manjaro. Full scans need sudo. Bash tab-completion for all flags is installed automatically via the bash-completion package (both installer paths), no .bashrc edits.

What to do

# Check if you installed any compromised packages
archcanary

# Full scan — all checks (some require root)
sudo archcanary --full

# Check setup health
archcanary --doctor

# Refresh package lists online, then scan
archcanary --refresh --full

# Interactive menu — same checks, no flags to remember
archcanary-tui

The only writes are its own logs and config lists; install.sh, --refresh, and the allowlist editors (DKMS, systemd, bpftool) are the sole explicit exceptions. Remediation is entirely manual — it never deletes, quarantines, or disables.

Caveats

• Treat detections as advisory, not authoritative. The developer states the code and docs are AI-assisted (Claude/Anthropic), reviewed before commit.
• Don't drive the Lynis suggestion count to zero. Lynis was built for server hardening, so many suggestions (mail-relay ACLs, multi-user auditing, firewall rules for exposed services) don't apply to a single-user desktop. The page flags the desktop-relevant overlaps it bundles Lynis for: sysctl hardening (ASLR, kptr_restrict, ptrace_scope), file-permission audits (world-writable, SUID/SGID), a GRUB bootloader password (more relevant on a laptop than a rack server), outdated packages, and PAM/login policy.