Patch for https://aur.archlinux.org/packages/falco. Note that cpp-httplib is in AUR: https://aur.archlinux.org/packages/cpp-httplib

falco.PKGBUILD.patch

diff --git a/PKGBUILD b/PKGBUILD
index 89562c7..47ede28 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -7,12 +7,12 @@ pkgname=falco
 provides=(falco)
 conflicts=(falco-bin)
 backup=('etc/falco/falco_rules.yaml'  'etc/falco/falco.yaml')
-pkgver=0.37.1
-pkgrel=2
+pkgver=0.39.2
+pkgrel=1
 pkgdesc="Cloud native runtime security. Modern ebpf and config files"
 arch=(x86_64)
 license=(Apache)
-makedepends=(cmake git c-ares jq grpc yaml-cpp clang linux-headers llvm bpf automake gcc)
+makedepends=(cmake git c-ares jq grpc yaml-cpp clang linux-headers llvm bpf automake gcc nlohmann-json cxxopts cpp-httplib)
 optdepends=(
     "falco-probe-ebpf: ebpf probe"
     "falco-module-dkms: dkms module"
@@ -20,23 +20,25 @@ optdepends=(
     "falcosidekick: connect Falco to your ecosystem"
 )
 url="https://github.com/falcosecurity/falco"
-_rules_tag="falco-rules-3.0.1"
+_rules_tag="falco-sandbox-rules-4.1.0"
 source_x86_64=(
     "falco-${pkgver}.tar.gz::$url/archive/refs/tags/$pkgver.tar.gz"
     "git+https://github.com/falcosecurity/rules#tag=${_rules_tag}"
     "falco-modern-bpf.service"
 )
-sha256sums_x86_64=('f602bd025ff2997ecce1bd1f479592ab666276912d72212ab8d1fffd38ab8c94'
-                   'SKIP'
+sha256sums_x86_64=('769d837b8a6c3e34330cb87bef813414005afc8b4418dc3b8c6df27b89942f6b'
+                   'd29f1ada7c69d84eeda8d185ddffc2041d29936a8b763b58d5795518c16b4b78'
                    '0709add709184db8a275a5c7c6b6b4123b6dc418e72f7c9d4ab6dcc1d5ab2644')

 prepare() {
     cd "${srcdir}/falco-${pkgver}"
     [[ -d build ]] || mkdir build
     [[ -d skeleton ]] || mkdir skeleton
+    rm rules
+    ln -s ../rules ./rules
     cd skeleton
-    cmake .. -DUSE_BUNDLED_DEPS=false \
-        -DBUILD_FALCO_MODERN_BPF=ON \
+    cmake .. -DUSE_BUNDLED_DEPS=On \
+        -DBUILD_FALCO_MODERN_BPF=On \
         -DCREATE_TEST_TARGETS=Off \
         -DFALCO_VERSION=${pkgver}
     make ProbeSkeleton
@@ -47,13 +49,13 @@ build() {
     cmake .. \
         -DCMAKE_BUILD_TYPE=Release \
         -DCMAKE_INSTALL_PREFIX=/usr \
-        -DUSE_BUNDLED_DEPS=false \
-        -DBUILD_FALCO_MODERN_BPF=ON \
+        -DUSE_BUNDLED_DEPS=On \
+        -DBUILD_FALCO_MODERN_BPF=On \
         -DMODERN_BPF_SKEL_DIR=${srcdir}/falco-${pkgver}/skeleton/skel_dir \
         -DBUILD_DRIVER=Off \
         -DBUILD_BPF=Off \
         -DFALCO_VERSION=${pkgver}
-    make falco -j6
+    make falco -j$(nproc)
 }

 package() {

See falcosecurity/falco#1325 for why DUSE_BUNDLED_DEPS changed