CPAC

Community Package Analysis Client – a package trust layer for Arch-based Linux distributions.

While traditional package managers answer “Can I install this?”, CPAC answers “Should I trust this?”

What is CPAC?

CPAC is a standalone package trust and advisory tool for Arch-based Linux. It works on Arch, EndeavourOS, Garuda, CachyOS, Manjaro, and any other Arch-based distribution.

It is not a package manager replacement. CPAC is a package advisor – it sits in front of pacman (and optionally AUR helpers) and provides trust scoring, PKGBUILD analysis, and system auditing before you install or upgrade anything.

Philosophy

• CPAC is a package advisor, not a gatekeeper
• The user always has the final say
• Trust scores are transparent and explainable
• CPAC never blocks standard tools like yay or paru
• Designed to remain useful regardless of the future state of AUR

Features

Trust Scoring

Every package receives a score from 0 to 100 based on multiple signals: repository source, package age, maintainer status, popularity, update recency, and out-of-date flags. Scores are always explainable – cpac trust <package> shows each signal, its points, and the reason.

PKGBUILD Diffing

CPAC detects suspicious modifications to PKGBUILD build scripts before install or upgrade. On upgrades, it diffs the new PKGBUILD against the cached version and flags dangerous patterns like remote code execution, obfuscation, and system path modifications.

System Audit

cpac audit scans all installed packages, classifies them by trust tier (Official, ThirdParty, Community, Unknown), and surfaces warnings for low-scoring or unverified packages.

AUR Support (Enabled by Default)

AUR support is enabled by default. Disable it with cpac config set aur off.

Metadata Cache

CPAC maintains a local cache at ~/.cpac/cache/ using sled for fast, offline-capable lookups. Search results, trust reports, and PKGBUILD snapshots are cached automatically.

Quick Start

# Search for a package
cpac search firefox

# Check a package's trust score
cpac trust firefox

# Install with trust analysis
cpac install firefox

# Audit all installed packages
cpac audit

Requirements

• Arch-based Linux distribution
• pacman available on PATH
• Network access for AUR search and trust metadata

Related Projects

Project	Role
cpac-trust-db	Community-maintained advisory data + opt-in crowdsourced PKGBUILD snapshots
website	Project site

Made By

Developer/Maintainer: Sabeeir Sharrma

Made under The Cinder Project – Making a safer internet

Installation

CPAC runs on any Arch-based Linux distribution, including Arch, EndeavourOS, Garuda, CachyOS, and Manjaro.

To install CPAC, you can build from source (recommended) or alternatively you can install it from the AUR via yay/paru.

Quick Install Script (Recommended)

For a quick build and install, run:

$ curl -sL https://thecinderproject.qd.je/install.sh -o install.sh
$ less install.sh   # review the script we provide you
$ bash install.sh

This script will install Rust+Cargo and cpac, since cpac is dependent on Rust+Cargo for building from source.

Building from source

To build from source you must have Rust installed on your system, to do this you can run:

$ sudo pacman -S rustup 

refresh/restart your terminal and run:

$ rustup install stable

Then clone and build:

$ git clone https://github.com/sabeeirsharrma/cpac.git
$ cd cpac
$ cargo build
$ cargo install --path .

This installs the CLI binary as cpac in Cargo’s bin directory, usually ~/.cargo/bin. Next, to make it available system wide you must add this to ~/.bashrc or ~/.zshrc etc.

export PATH="$HOME/.cargo/bin:$PATH"

This will add Cargo’s bin directory (where cpac is installed) to your path. Now you can refresh/restart your terminal and run cpac to test.

Installing from AUR (Using yay/paru)

This will install cpac from the AUR but updates to the AUR version may lag behind by up to 24 hours.

To directly install cpac from the AUR, run:

$ yay -S cpac

or if you use paru

$ paru -S cpac

Note: CPAC isn’t installed yet at this point, so its own trust analysis isn’t available to evaluate this install – this is the one bootstrapping exception to CPAC’s usual AUR-last, trust-checked install flow. Once CPAC is installed via any method, all future package installs go through its normal resolution and trust scoring.

Verify Installation

After installing, run:

cpac --help

If your shell prints cpac: command not found, Cargo’s bin directory is not on your PATH. Add it for the current terminal session:

export PATH="$HOME/.cargo/bin:$PATH"

To make that permanent, add the same line to your shell config (~/.bashrc, ~/.zshrc, etc.) and restart your terminal.

Configuration

CPAC stores its configuration at ~/.cpac/config.toml using standard TOML format. The file is created on first save.

Using the Config Command

The easiest way to view and change settings is:

cpac config

This displays the current configuration and presents an interactive menu for changing the crowdsourced data submission level.

Configuration File

The raw configuration file looks like this:

aur_enabled = false
consent = "hash"

Options

Key	Type	Default	Values
aur_enabled	boolean	false	true / false
consent	string	"hash"	"none" / "hash" / "full"

aur_enabled

Controls whether CPAC includes the Arch User Repository (AUR) in search results, trust lookups, and install operations.

• false (default) – AUR is excluded. cpac search only queries official repos. AUR packages cannot be installed via CPAC.
• true – AUR is included. Search, trust, and install operations will query both official repos and the AUR.

Toggle via CLI:

cpac aur enable    # enable AUR support
cpac aur disable   # disable AUR support

consent

Controls the level of data CPAC submits to the community trust database for crowdsourced PKGBUILD diffing. This is an opt-in system – see Trust Algorithm for details.

Value	Label	Description
"none"	No submission	Don’t submit anything to the community database
"hash"	Hash/signature only	Submit only hash/signature data (default)
"full"	Full PKGBUILD	Submit the full PKGBUILD text for better diff accuracy

Change via the interactive config menu:

cpac config

Cache Location

CPAC stores cached data at ~/.cpac/cache/:

File	Contents
packages.db	Package search results and info lookups
trust.db	Trust analysis reports
advisories.db	Security advisories (reserved for future use)
pkgbuilds.db	Cached PKGBUILD snapshots for upgrade diffing

Clear the cache manually:

cpac clear-cache

Command Reference

cpac search <query>

Search official repositories and the AUR (if enabled) for packages matching the query.

cpac search firefox

Results are sorted by relevance (exact match, starts-with, contains, description) then by source (Official > ThirdParty > AUR). By default, the top 25 results are shown.

Flags

Flag	Description
--all	Show all results instead of the default 25

Example

$ cpac search firefox
Package                             Version        Source           Description
firefox                             128.0esr-1     Official         Standalone web browser from mozilla.org
firefox-developer-edition          130.0b9-1      Official         Developer Edition of the Firefox web browser
...

Showing 25 of 87 results. Use --all to view everything.

---

cpac trust <package>

Show a full trust report for a named package. Resolves the package from official repos or AUR (if enabled) and runs the complete trust analysis algorithm.

cpac trust firefox

Example

$ cpac trust firefox

Package:          firefox
Version:          128.0esr-1
Repository:       Official
Trust Tier:       Official
Maintainer:       Remote Maintainers
URL:              https://www.mozilla.org/en-US/firefox/
Popularity:       High
Installed Size:   219.5 MB
Licenses:         MPL2
Dependencies:     12 dependencies

══════════════════════════════
Trust Score: 92/100
Recommendation: SAFE
══════════════════════════════

Signal                          Points
Repository Source               +30/30
Package Age                     +15/15
Maintainer                      +13/15
Popularity                      +15/15
Last Updated                    +15/15

---

cpac install <package>

Install a package with trust analysis shown before proceeding. Supports both official repositories and AUR packages.

cpac install firefox

Flags

Flag	Description
--force	Skip trust analysis and confirmation prompt
--dry-run	Show what would be installed without actually installing

Behavior

1. Resolves the package from official repos or AUR
2. Runs trust analysis and displays the report (unless --force)
3. For upgrades: diffs the new PKGBUILD against the cached version and flags suspicious changes
4. Prompts for confirmation (unless --force)
5. Installs the package using the appropriate backend
6. Caches the PKGBUILD for future diffing

Backend Selection

Source	Backend
Official / ThirdParty	pacman
AUR	paru (preferred) or yay (auto-detected)

Example

$ cpac install firefox

Trust Score: 92/100 (SAFE)
Continue? [Y/n]

[installing...]
$ firefox installed successfully.

$ cpac install google-chrome --dry-run

Trust Score: 65/100 (MODERATE)
[DRY RUN] Would install 'google-chrome' using yay backend

---

cpac remove <package>

Remove an installed package. Shows the trust report before removal to inform the user.

cpac remove firefox

Flags

Flag	Description
--recursive	Also remove unneeded dependencies (pacman -Rs)
--force	Skip trust analysis and confirmation prompt

Behavior

1. Checks that the package is installed (errors if not)
2. Displays the trust report (unless --force)
3. Prompts for confirmation (unless --force)
4. Removes the package

---

cpac update

Update package databases. Runs pacman -Sy for official repositories.

cpac update

Flags

Flag	Description
--aur	Also update AUR databases (useful when AUR is disabled but you want a one-time AUR update)

Behavior

1. Syncs official package databases (pacman -Sy)
2. If AUR is enabled (or --aur is passed): syncs AUR databases via paru -Sy or yay -Sy
3. Clears cached metadata since repository state has changed

---

cpac audit [package]

Run a trust audit on installed packages.

cpac audit          # audit all installed packages
cpac audit firefox  # audit a single package

System Audit (no arguments)

Scans all installed packages and produces:

• Summary: Total installed packages with breakdown by trust tier (Official, ThirdParty, Community, Unknown)
• Official notices: Packages from distro-specific repos (EndeavourOS, CachyOS) noted as excluded from warnings
• Warnings: Packages with trust score below 60 or Unknown tier, sorted by score

After printing the summary, prompts “View Details? [Y/n]” to show individual trust reports for each warning.

Single Package Audit

Audits one installed package and prints its trust report. Errors if the package is not installed.

Example

$ cpac audit

Installed Packages: 842

  Official:     721
  Third Party:   86
  Community:     30
  Unknown:        5

12 package(s) from official repositories (EndeavourOS, CachyOS) are excluded from warnings.

Warnings:
  foo-bin       [Trust: 34/100 -- New maintainer, recent PKGBUILD change]
  bar-git       [Trust: Unknown -- Installed outside CPAC]
  baz-nightly   [Trust: 41/100 -- No signed package]

View Details? [Y/n]

---

cpac diff <package>

Show the PKGBUILD diff for an AUR package. Compares the cached PKGBUILD (from a previous CPAC install) against the current version from the AUR.

cpac diff firefox

Behavior

1. Resolves the package (must be an AUR package)
2. Retrieves the cached PKGBUILD and fetches the current one from AUR
3. Displays the diff with color-coded output:
   • Green (+): Added lines
   • Red (-): Removed lines
   • Yellow (!): Suspicious patterns detected

Suspicious Patterns Detected

Pattern	Risk
curl | sh, wget | bash	Remote script execution
eval, exec	Inline script execution
rm -rf outside pkgdir/srcdir	Aggressive file deletion
Base64/hex decoding	Obfuscation
Dynamic pkgver from network	Untrusted version source
pip install, npm install, cargo install	Language package manager in build
Modifications to /etc/, /usr/, /bin/	System path modifications

---

cpac config

View and change CPAC configuration.

cpac config

Displays the current configuration and presents an interactive menu for changing the crowdsourced data submission level.

Options

Choice	Label	Description
1	No submission	Don’t submit anything
2	Hash/signature only	Submit only hash/signature data (default)
3	Full PKGBUILD	Submit the full PKGBUILD text

See Configuration for full details.

---

cpac aur <enable|disable>

Enable or disable AUR support.

cpac aur enable    # enable AUR
cpac aur disable   # disable AUR

When disabled, CPAC only queries official repositories. When enabled, search, trust, and install operations include the AUR.

---

cpac clear-cache

Clear the local metadata cache at ~/.cpac/cache/.

cpac clear-cache

This removes all cached search results, trust reports, and PKGBUILD snapshots. The cache is rebuilt automatically on next use.

---

Exit Codes

Code	Meaning
0	Success
1	Error (package not found, not installed, network failure, etc.)

Configuration File Location

Path	Contents
~/.cpac/config.toml	User configuration (AUR toggle, consent level)
~/.cpac/cache/	Metadata cache (packages, trust, PKGBUILDs)

Trust Algorithm

CPAC assigns every resolved package a score from 0 to 100. The score is built from metadata available via pacman -Si and the AUR RPC API.

The score is explainable: cpac trust <package> prints each signal, the points it contributed, and the reason.

Trust Tiers

Trust tier is separate from trust score. CPAC generates an independent score for every package regardless of source.

Tier	Description
Official	Package from an official Arch Linux repository
ThirdParty	Package from a third-party (non-official) repository
Community	Package from the AUR
Unknown	Package source cannot be determined

Signals

Signal	Max	Notes
Repository source	30	Official packages receive the strongest source score. AUR packages receive a smaller community-source score.
Package age	15	Older packages receive more points. Official packages receive a conservative default.
Maintainer	15	Maintained packages score higher. Orphaned AUR packages are penalized.
Popularity	15	AUR vote counts are used when available. Official packages receive a conservative default.
Last updated	15	Recently updated packages score higher. Official packages receive a conservative default.
Out-of-date flag	-10	AUR packages flagged out-of-date lose points.

Repository Source (max +30)

Source	Points
Official repo	+30
Third-party repo	+15
AUR	+10
Unknown	+0

Package Age (max +15)

Based on the first_submitted timestamp:

Age	Points
0 – 30 days	+2
31 – 180 days	+5
181 – 365 days	+8
1 – 2 years	+11
2 – 5 years	+14
5+ years	+15

If metadata is unavailable, partial credit is awarded by source type: Official +13, ThirdParty +8, AUR/Unknown +5.

Maintainer (max +15)

Status	Points
Orphaned (no maintainer)	-5
Maintained, official packager	+13
Maintained, non-official	+10

If metadata is unavailable, partial credit is awarded by source type.

Popularity / Votes (max +15)

Votes	Points
0 – 5	+2
6 – 25	+5
26 – 100	+8
101 – 500	+11
501 – 2000	+13
2001+	+15

If metadata is unavailable, partial credit is awarded by source type.

Last Updated Recency (max +15)

Time since update	Points
0 – 7 days	+15
8 – 30 days	+13
31 – 90 days	+11
91 – 180 days	+8
181 – 365 days	+5
366 – 730 days	+3
730+ days	+1

If metadata is unavailable, partial credit is awarded by source type.

Out-of-Date Penalty (-10)

If the package is flagged as out-of-date in the AUR, 10 points are deducted from the score.

PKGBUILD Diff Penalties

When upgrading an already-installed package, CPAC diffs the new PKGBUILD against the cached version. Each detected suspicious pattern adds a -10 point penalty signal to the trust report.

Pattern	Example
Remote script execution	curl ... | sh, wget ... | bash
Inline script execution	eval, exec
Aggressive file deletion	rm -rf outside pkgdir/srcdir
Obfuscation	Base64 or hex decoding
Dynamic version from network	pkgver generated via remote call
Language package manager in build	pip install, npm install, cargo install
System path modifications	Writes to /etc/, /usr/, /bin/, /sbin/ outside pkgdir/install

Unknown Metadata Handling

If a package has zero negative signals but has unknown metadata (missing age, maintainer, popularity, or recency), the recommendation is floored at Moderate regardless of score. This prevents packages with simply unavailable metadata from being labeled as Caution or Warning.

Recommendations

Score	Recommendation	Color
80 – 100	Safe	Green
60 – 79	Moderate	Green
40 – 59	Caution	Yellow
20 – 39	Warning	Red
0 – 19	Danger	Red

Scope

This is the Week 1 scoring model. Later phases can add:

• Build history verification
• Package integrity checks
• Security advisory databases
• Local audit history
• Maintainer history from a CPAC trust database
• Crowdsourced PKGBUILD snapshots for fresh-install diffing

See Configuration for the crowdsourced data consent options.