Skip to content

Record AUR support in roadmap and architecture docs #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kridaydave merged 1 commit into from
Sep 12, 2026
Merged

Record AUR support in roadmap and architecture docs #54

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions ARCHITECTURE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,9 +70,11 @@ The Rust binary is also directly installable (`cargo install` / direct download)
for non-Node environments.

### `Registry` trait
npm is the only implementation now, but the trait
(`fetch_manifest`, `fetch_tarball`, `list_versions`) exists from commit 1 so
PyPI/cargo plug in later without refactoring the engine.
Four implementations ship behind it now: npm, crates.io, PyPI, and a
review-only AUR adapter (git history over the system `git` binary, static
PKGBUILD parsing, never executed). The trait (`list_releases`,
`default_version`, integrity-typed fetch) exists from commit 1 so each
registry plugged in later without refactoring the engine.

### Extraction & untrusted-input safety
Every tarball and registry response is fully untrusted. The `extract` stage enforces:
Expand Down Expand Up @@ -101,7 +103,7 @@ Every tarball and registry response is fully untrusted. The `extract` stage enfo
|----|-----------------------------------------------------|---------------------------------------------------------------------------|
| D1 | Rust core + Node shim | Security-critical path in a memory-safe, single-binary language; Node only for `npx` ergonomics. |
| D2 | Local deterministic heuristic first | Transparent, auditable, offline. Hosted ML *refines* score when token present — never required. Keeps "the wedge stays open" honest. |
| D3 | npm-only, `Registry` trait seam | Deepen one registry; avoid speculative multi-registry code now. |
| D3 | One registry deep, `Registry` trait seam, then four | Deepen one registry first; avoid speculative multi-registry code. npm, crates.io, PyPI, and review-only AUR now share the seam. |
| D4 | Read-only sandbox extraction + integrity verify | Core safety invariant. Verify sha512/signature *before* extract; bound size/entry/FD; reject symlinks/special files; Landlock-sandbox the step. Package code never runs. |
| D5 | Baseline = last known-clean version | Source: locally installed version in `node_modules` → else previous version in registry list (neutral verdict on first sighting). Overrides persisted in SQLite. |
| D6 | Revocation = OSV + GitHub Advisory cache | Reuse the open vulnerability corpus; paid tier adds human-verified recall (hosted index). |
Expand Down
1 change: 1 addition & 0 deletions ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ Phased plan from greenfield to a trustworthy release-diff review desk. See
## Phase 4 — Scale & Multi-Registry ✅
- [x] crates.io registry adapter (`--ecosystem cargo`, `Cargo.lock` CI scanning, `.crate` verification, yanked-aware baselines)
- [x] PyPI registry adapter (`--ecosystem pypi`, `requirements.txt` CI scanning, PEP 440 / PEP 503, wheel extraction, PEP 740 provenance)
- [x] AUR registry adapter (`--ecosystem aur`, review-only): git-history-backed reviews with vercmp ordering, static PKGBUILD heuristics (R11-R23), maintainer-transition finding, pin-file CI scanning, and a yay `AURPreInstall` gate hook
- [ ] Advisory feed contributions back to OSV / GitHub

---
Expand Down
Loading