A security gate that vets every AUR package before it is built — time-delay, whitelist, anti-revert guard, static scan and AI review of the PKGBUILD diff.
June 2026: 400+ AUR packages were backdoored in a supply-chain attack — malicious PKGBUILDs silently fetching and running an infostealer. AUR packages are unsigned, community-maintained recipes built on your machine. aurveto puts a gate in front of them.
Every AUR update runs the gauntlet. Anything uncertain is delayed or blocked — never installed by default.
Trusted signed-binary repackagers skip the delay — but still get scanned & reviewed.
Installs the git revision from N days ago, exposed long enough for the community to flag it.
Refuses a revision that was cleaned/reverted since — a backdoor lingers in git history.
Delegates to aur-scan: 70+ rules and a known-IOC database.
An LLM reads the exact PKGBUILD diff and votes safe / suspicious before any build.
One command shows official updates, AUR updates, and a clear verdict for each — allowed, delayed, or blocked with a reason.
Fail-closed by design: on any doubt, it delays or blocks — it never silently downgrades or installs.
Lag mode builds the exact git revision that was public N days ago — you always get updates, just safely behind.
Groq, Anthropic, OpenAI or a local llama.cpp model — configurable. One call when safe; extra confirmation votes only to back up a block.
aurveto upgrade does pacman -Syu then the guarded AUR — so you never bypass the gate.
Scriptable CLI, a keyboard TUI, and a polished libadwaita app with editable whitelist and suggestions.
gettext-based i18n following your system locale. English and French included, more easy to add.
API keys come from the environment or a 0600 file — never written to config or logs.
Straight from the AUR with your favourite helper — -bin for precompiled binaries or build from source. Optionally add aur-scan for the static layer.