Sanity check paste checker

runbooks/atomic-rootkit-scan/scan.py

@@ -0,0 +1,33 @@
+from sys import argv
+from requests import get
+from subprocess import check_output
+
+def local_package_list():
+    pkgs = check_output('pacman -Qqm'.split())
+    return [ pkg.decode() for pkg in pkgs.splitlines()]
+
+
+def get_remote(url):
+    pkgs = get(url)
+    pkgs = [pkg.decode() for pkg in pkgs.content.splitlines()]
+    return set(pkgs)
+
+
+def pkg_in_remote(pkg_name, remote_set):
+    return pkg_name in remote_set
+    
+
+if __name__ == '__main__':
+    if len(argv) == 2:
+        paste_url = argv[1]
+    else:
+        paste_url = 'https://paste.cachyos.org/73a714d'
+
+    remote_package_list = get_remote(paste_url)
+    for pkg in local_package_list():
+        if pkg_in_remote(pkg, remote_package_list):
+            print(f'COMPROMISED - {pkg}')
+        else:
+            print(f'CLEAN - {pkg}')
+
+