Repository navigation
Expand file tree
/
Copy pathupdate.conf.example
More file actions
126 lines (109 loc) · 6.43 KB
/
Copy pathupdate.conf.example
File metadata and controls
126 lines (109 loc) · 6.43 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
# =============================================================================
# update.sh configuration (example / template)
# =============================================================================
#
# This file is sourced by update.sh as ROOT (the script self-elevates), so it
# is plain bash: you may use variables, arrays, and comments. Keep it simple --
# assignments only, no commands. update.sh refuses to source this file if it is
# world-writable or not owned by you/root (see the safety gate in the script).
#
# Live location (auto-created from this template on first run):
# ~/.config/update.sh/config
# Override per-run with: update.sh --config /path/to/config
# Skip entirely with: update.sh --no-config
# See the merged, effective settings with: update.sh --print-config
#
# Precedence (lowest to highest):
# built-in defaults < this config file < command-line flags
#
# Every setting below is OPTIONAL. Anything you leave commented out keeps the
# script's built-in default. The values shown are those built-in defaults.
# -----------------------------------------------------------------------------
# -----------------------------------------------------------------------------
# 1. DEFAULT BEHAVIOR
# -----------------------------------------------------------------------------
# DEFAULT_ACTIONS -- which checks run when you invoke update.sh with NO action
# flags (e.g. just `update.sh`, or `update.sh -P` with only a modifier).
# Order here does not matter; the script always runs them in its fixed order.
# Valid tokens: clean orphans update rebuilds python-rebuild pacnew firmware
# kernel aur-audit aur-scan all
# Note: `kernel`, `aur-audit`, and `aur-scan` are intentionally NOT in the
# default set upstream (kernel is interactive; the AUR security checks are
# explicit-only). You can add them here if you want them every run.
#DEFAULT_ACTIONS=(clean orphans update rebuilds python-rebuild pacnew firmware)
# SYSTEM_UPDATER / AUR_UPDATER -- `-u/--update` runs TWO steps, each with its own
# tool, so it's always clear which tool does what:
#
# SYSTEM_UPDATER -- official repositories
# pacman (default) plain pacman -Syuu
# pamac pamac update
#
# AUR_UPDATER -- AUR packages
# yay (default) yay, with PKGBUILD review + the install-time
# supply-chain hooks (~/.config/yay/init.lua)
# pamac pamac (NOTE: pamac is all-in-one, so choosing pamac
# here means pamac updates the repos too)
# none skip the AUR entirely (repos-only update)
#
# Override per-run with `--system-updater TOOL` / `--aur-updater TOOL`.
# (The old single `UPDATER=` key is deprecated; if still set it is mapped with a
# warning: yay->pacman+yay, pacman->pacman+none, pamac->pamac+pamac.)
#SYSTEM_UPDATER="pacman"
#AUR_UPDATER="yay"
# AUTO_REBUILD -- if true, the rebuild checks (-r and -y) will offer to rebuild
# the affected packages (after a confirmation prompt) instead of only listing
# them. Overridden on the command line by -R/--auto-rebuild.
#AUTO_REBUILD=false
# AUR_RECENT_DAYS -- in the AUR audit (-A), a package whose PKGBUILD changed
# within this many days is tagged RECENTLY-CHANGED (a "give it a look" signal,
# not a verdict). Lower = noisier/more cautious.
#AUR_RECENT_DAYS=21
# AUR_IOC_CAMPAIGNS -- which threat-intel campaigns from lenucksi/aur-malware-check
# the audit (-A) and scan (-S) pull live IOC lists from. Remove ones you do not
# care about, or add new campaign directory names as they are published.
#AUR_IOC_CAMPAIGNS=(aur-infected chaos-rat russian-spam)
# -----------------------------------------------------------------------------
# 1b. INSTALL-TIME PRE-CHECK (the yay hook + aur-precheck.sh)
# -----------------------------------------------------------------------------
# These are read by aur-precheck.sh, which the yay AURPreInstall hook runs when
# you install/upgrade an AUR package. They warn (never block) on orphaned /
# out-of-date / stale / compromised packages right at install time. (This config
# is also sourced by the helper, which runs as your user.)
# AUR_PRECHECK -- master switch for the network-backed install-time checks.
# Set to false to disable them (the hook's local PKGBUILD build-logic scan and
# the maintainer-change warning still run, since those need no network).
#AUR_PRECHECK=true
# AUR_PRECHECK_MAX_AGE_DAYS -- at install time, warn if the package's PKGBUILD
# was last updated more than this many days ago (a "stale, eyeball it" signal).
#AUR_PRECHECK_MAX_AGE_DAYS=365
# AUR_IOC_CACHE_TTL -- seconds to cache the fetched IOC lists (so a bulk upgrade
# doesn't refetch them for every package). Default is 6 hours.
#AUR_IOC_CACHE_TTL=21600
# -----------------------------------------------------------------------------
# 2. EXCLUSIONS
# -----------------------------------------------------------------------------
# All three lists accept EXACT package names and shell GLOBS, e.g.:
# "mailspring" -> exact match
# "python-*" -> every package starting with python-
# "*-git" -> every -git package
# Matching is case-sensitive (package names are lowercase by convention).
# EXCLUDE_ALIEN -- foreign/AUR packages to SUPPRESS from the noise of the
# foreign-package report (alien-pkgs.txt) and the AUR audit/scan output. Use
# this for packages you have already vetted and do not want to keep re-reading.
# The script prints how many entries it suppressed so nothing is hidden silently.
# Example:
#EXCLUDE_ALIEN=(brave-bin google-chrome visual-studio-code-bin)
# KEEP_ORPHANS -- orphaned packages that should NEVER be offered for removal by
# `-o/--orphans`. Use this to protect intentionally-installed leaf packages that
# nothing depends on (so they look like orphans but you want to keep them).
# Everything NOT matched here is listed and you are prompted before each removal.
# Example:
#KEEP_ORPHANS=(downgrade nvchecker python-pipx)
# LUA_ALLOWLIST -- packages allowlisted in the advisory yay PKGBUILD tripwire
# (the AURPreInstall hook). Listed packages are skipped by the hook's
# supply-chain pattern scan, suppressing its warnings for software you trust to
# legitimately use Node/Electron/JS build tooling. update.sh writes this list to
# ~/.config/yay/allowlist.txt, which the hook reads at install time -- this file
# is the single source of truth (do not hand-edit allowlist.txt).
# Globs are honored here too (e.g. "*-electron").
#LUA_ALLOWLIST=(mailspring)