A Python 3.14+ CLI tool (stdlib only) for detecting malware in packages from the Arch User Repository. It scans currently installed AUR packages, historical pacman logs, systemd services, eBPF rootkit artifacts, and npm/bun/yarn/pnpm caches against configurable campaign-based threat lists (e.g., the June 2026 atomic-lockfile attack, CHAOS RAT 2025, Russian spam campaigns). The architecture is modular: campaign configuration is data-driven (JSON), the scanner is split into focused mixin classes (PackageMixin, SystemMixin, CacheMixin) combined via the AurScanner class, and all results are typed dataclasses. The package runs with zero external dependencies, has comprehensive unit tests, and includes an integration layer (pacman hook + systemd timer) for continuous monitoring. The code demonstrates high craftsmanship: strict typing, defensive I/O, locale-safe date parsing, cache-efficient file scanning, and a clean exit-code scheme based on Nagios conventions.
Dotter is a dotfile manager and templater written in Rust. It manages symbolic links and Handlebars-based templates for configuration files, supporting conditional deployment based on variables, packages, and host-specific configurations. The architecture is a single CLI binary with subcommands for deploy, undeploy, init, watch, and shell completion generation. It reads TOML configuration files (global.toml, local.toml) that define packages, files, and variables, then merges them with optional includes and patches. The deployment logic uses a trait-based Filesystem abstraction to support real operations and dry-run simulation, with platform-specific handling for Unix (sudo elevation) and Windows (symlink detection). The codebase demonstrates strong Rust practices: extensive use of traits for testability, mockall for unit testing, comprehensive error handling with anyhow, and a modular structure separating concerns (config, actions, filesystem, handlebars helpers, diff). It is actively maintained with recent commits, CI/CD pipelines, and a well-documented wiki.
Aura is a command-line package manager for Arch Linux and the Arch User Repository (AUR). It acts as a drop-in replacement for pacman, passing all pacman operations through unchanged while adding AUR-specific workflows: searching and building packages from the AUR, maintaining a local package cache for downgrades, taking JSON snapshots of installed package state for rollback, viewing and searching ALPM logs, identifying orphaned packages, analyzing licenses, and generating dependency graphs. The system integrates directly with pacman, makepkg, git, sudo/doas, shellcheck, and Graphviz, and uses a custom FAUR metadata server to query AUR package data efficiently. The primary implementation is a modern Rust workspace (aura-pm binary, aura-core library, and r2d2-alpm connection pool), with extensive localization via Project Fluent covering more than 20 languages. A legacy Haskell implementation remains in the repository but is superseded by the Rust rewrite, which is the actively maintained codebase.
This repository repackages Anthropic's official Claude Desktop Linux .deb with a comprehensive set of Linux-native enhancements and community features. It applies 48 surgical JavaScript patches (compiled from Nim sources) to the minified Electron bundle, adding custom theme engine with 97 bundled dual light/dark palettes, multi-profile isolation, Quick Entry global hotkey, Computer Use desktop automation backends (X11, wlroots, GNOME, KWin portals), and an in-app Extra settings panel for themes, feature flags, and third-party inference configuration. The project produces packages for Arch (pacman), Debian/Ubuntu (APT), Fedora/RHEL (RPM), NixOS (flake), and AppImage, with automated CI that polls upstream every 2 hours, validates patch integrity, and publishes signed repositories. The architecture is a patch overlay on a third-party Electron desktop app. Patches are organized into three groups: linux (31 patches, always-on), core (7 patches, infrastructure), and community (10 patches, opt-in). A Nim-based build system compiles each patch into a native binary that performs regex-based transformations on the minified JS, with strict idempotency checks that fail the build if any pattern doesn't match. The patching system also handles upstream code-split chunks and concatenates/splits them as needed. The theme engine injects CSS custom properties via Electron's insertCSS, supports live reload via file watcher, and includes a full browser UI (theme picker SPA) with search, keyboard navigation, and wallpaper-driven generation via matugen. While the codebase demonstrates high engineering craftsmanship—consistent IPC validation, atomic config writes, robust fallback chains for Computer Use backends, and a reproducible build workflow with byte-identical artifact checks—it is tightly coupled to a single upstream app's minified bundle shape and DOM structure. The 48 patches are a significant maintenance burden that must be re-validated on every upstream release. However, the project is actively maintained, with automated CI catching most regressions, and several patterns (spinner injector, theme engine, config utilities) could be extracted for reuse in other Electron or web applications.