arch-audit(1)

📦 version 0.2.0, in arch rolling

🎀 arch-audit(1) — the manual, but make it group chat 🎀

okay so bestie, welcome to arch-audit(1), the General Commands Manual page that's gonna tell you everything about this little icon of a utility. buckle up, we're going through it together 💅

✨ NAME ✨

arch-audit — a utility like pkg-audit for Arch Linux. that's it, that's the whole name section, she's concise and she knows it 🫶

🌸 SYNOPSIS 🌸

arch-audit [OPTION]...

literally just run it with options. classic. no drama, no positional arguments, just vibes and flags ⭐

🦋 DESCRIPTION 🦋

arch-audit is a utility like pkg-audit for Arch Linux — like, same energy, different distro, you know how it is.

it's based on data from https://security.archlinux.org collected by the awesome Arch Security Team. they're the main characters of this whole story, ngl, and we love them for it 👑

💖 OPTIONS 💖

  • -q, --quiet — show only vulnerable package names and their versions. set it twice and the versions dip too, leaving you with purely the names, minimal, clean, very demure 🙈
  • -r, --recursive — prints packages that depend on vulnerable packages and are thus potentially vulnerable as well. set it twice and it shows ALL the packages that require them — the full dependency lore, no skipping 💀
  • -t, --show-testing — show packages which are in the [testing] repos. more deets over at https://wiki.archlinux.org/index.php/Official_repositories#Testing_repositories if you're curious 🧚
  • -u, --upgradable — show only packages that have already been fixed. the glow-up has happened, you just need to actually update 💅
  • -c, --show-cve — print the CVE numbers. receipts, basically 🎀
  • -C, --color [WHEN] — colorize the output; WHEN can be 'auto' (the default if you omit it), 'always', or 'never'. aesthetics matter, periodt 🌈
  • -b, --dbpath [DBPATH] — set an alternate database location. by default, arch-audit uses /var/lib/pacman. like yeah she has a usual spot but she's flexible ✨
  • -f, --format [FORMAT] — specify a format to control the output. the placeholders are:
    • %n — pkgname
    • %c — CVEs
    • %v — fixed version
    • %t — type
    • %s — severity
    • %r — required by (only when -r is also used) yes, %r is a package deal with -r, don't come for me, that's just how it is 🫶
  • --json — print results as json object. for the machine besties 🤖
  • --proxy [PROXY] — send requests through a proxy. the format looks like 'socks5://127.0.0.1:9050'. copy it exactly, bestie, character for character 🧦
  • --no-proxy — do not use a proxy even if one is configured. respectfully opting out 🙅
  • --source [SOURCE] — specify the URL or file path to the security tracker json data. by default, arch-audit uses https://security.archlinux.org/all.json 🌐
  • --sort [SORT]... — specify how to sort the output. by default, arch-audit uses 'severity,pkgname'. possible values are: severity, pkgname, upgradable, reverse. yes it takes multiple, that's what the ... is doing, she's greedy and we respect it 👑
  • -V, --version — prints version information. know your queen's birthday 💖
  • -h, --help — prints help information. when in doubt, ask her directly 🦋

💜 INFOS 💜

read more at https://wiki.archlinux.org/index.php/Arch_Security_Team — the lore goes deep, iykyk 🌸

🍓 BUGS 🍓

bugs can be reported on the bug tracker at https://gitlab.archlinux.org/archlinux/arch-audit/-/issues. found a gremlin? put it there, not in my DMs 🙈

⭐ AUTHORS ⭐

Andrea Scarpino <andrea@archlinux.org> — an absolute legend, no cap 🫶

okay that's the whole page, you ate that, congrats 🎉 this manual dropped 2026-03-26 and it's from the arch-audit source, so like, that's the version-and-date era we're living in. go audit some packages, bestie, you're gonna slay 💅💖

📦 where this page comes from