aquacontrol

maintainer raffaele-90 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs systemd services and creates a privileged group for configuration access, which is legitimate for hardware control software; the flagged sudoers removal is for backward compatibility and does not indicate malicious privileged installation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs systemd services and creates a privileged group for configuration access, which is legitimate for hardware control software; the flagged sudoers removal is for backward compatibility and does not indicate malicious privileged installation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:25 rm -f /etc/sudoers.d/99-aquacontrol-shutdown

PKGBUILD

      1# AquaControl
    
      2# Copyright (C) 2026 Raffaele Schiavone
    
      3#
    
      4# This program is free software: you can redistribute it and/or modify
    
      5# it under the terms of the GNU General Public License as published by
    
      6# the Free Software Foundation, either version 3 of the License, or
    
      7# (at your option) any later version.
    
      8#
    
      9# This program is distributed in the hope that it will be useful,
    
      10# but WITHOUT ANY WARRANTY; without even the implied warranty of
    
      11# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    
      12# GNU General Public License for more details.
    
      13#
    
      14# You should have received a copy of the GNU General Public License
    
      15# along with this program.  If not, see <http://www.gnu.org/licenses/>.
    
      16
    
      17pkgname=aquacontrol
    
      18pkgver=5.0.1
    
      19pkgrel=1
    
      20pkgdesc="Control suite for Aquaero 6 LT and Farbwerk 360"
    
      21arch=('any')
    
      22url="https://github.com/raffaele-90/aquacontrol"
    
      23license=('GPL3')
    
      24depends=('python' 'pyside6' 'python-hidapi')
    
      25optdepends=('python-pynvml: Nvidia GPU sensor readings'
    
      26            'libpulse: alarm sound playback (paplay)')
    
      27provides=('aquacontrol')
    
      28conflicts=('openaquaero')
    
      29replaces=('openaquaero')
    
      30install="aquacontrol.install"
    
      31source=("$pkgname-$pkgver.tar.gz::https://github.com/raffaele-90/aquacontrol/archive/refs/tags/v$pkgver.tar.gz")
    
      32sha256sums=('6e34ffd3a815bf6eac4735159f9888fbea493b05639d6bcf98db3138f8b85b22')
    
      33
    
      34package() {
    
      35    cd "$pkgname-$pkgver"
    
      36
    
      37    # Directory di sistema.
    
      38    install -dm755 "$pkgdir/usr/lib/$pkgname"
    
      39    install -dm755 "$pkgdir/usr/bin"
    
      40    install -dm755 "$pkgdir/usr/share/applications"
    
      41    install -dm755 "$pkgdir/usr/share/icons/hicolor/512x512/apps"
    
      42    install -dm755 "$pkgdir/usr/lib/systemd/system"   # servizio di sistema (demone root)
    
      43    install -dm755 "$pkgdir/usr/lib/systemd/user"     # servizio utente (agent di sessione)
    
      44
    
      45    # Codice Python e assets
    
      46    install -m644 *.py "$pkgdir/usr/lib/$pkgname/"
    
      47    cp -r assets "$pkgdir/usr/lib/$pkgname/"
    
      48    find "$pkgdir/usr/lib/$pkgname/assets" -type d -exec chmod 755 {} +
    
      49    find "$pkgdir/usr/lib/$pkgname/assets" -type f -exec chmod 644 {} +
    
      50
    
      51    # Wrapper della GUI
    
      52    echo '#!/bin/bash' > "$pkgdir/usr/bin/$pkgname"
    
      53    echo 'exec python3 /usr/lib/aquacontrol/main.py "$@"' >> "$pkgdir/usr/bin/$pkgname"
    
      54    chmod 755 "$pkgdir/usr/bin/$pkgname"
    
      55
    
      56    # Servizio di SISTEMA (demone root)
    
      57    cat > "$pkgdir/usr/lib/systemd/system/aquacontrold.service" <<'EOF'
    
      58[Unit]
    
      59Description=AquaControl Hardware Daemon (root)
    
      60After=multi-user.target
    
      61
    
      62[Service]
    
      63Type=simple
    
      64ExecStart=/usr/bin/python3 /usr/lib/aquacontrol/aquacontrold.py
    
      65Restart=on-failure
    
      66User=root
    
      67
    
      68[Install]
    
      69WantedBy=multi-user.target
    
      70EOF
    
      71
    
      72    # Servizio UTENTE (agent di sessione)
    
      73    cat > "$pkgdir/usr/lib/systemd/user/aquacontrol-agent.service" <<'EOF'
    
      74[Unit]
    
      75Description=AquaControl Session Agent (alarm reaction, login diagnostics)
    
      76After=graphical-session.target
    
      77PartOf=graphical-session.target
    
      78
    
      79[Service]
    
      80Type=simple
    
      81ExecStart=/usr/bin/python3 /usr/lib/aquacontrol/aquacontrol-agent.py
    
      82Restart=on-failure
    
      83
    
      84[Install]
    
      85WantedBy=graphical-session.target
    
      86EOF
    
      87
    
      88    # File .desktop
    
      89    cat > "$pkgdir/usr/share/applications/$pkgname.desktop" <<EOF
    
      90[Desktop Entry]
    
      91Name=AquaControl
    
      92Comment=Control suite for Aquaero 6 LT and Farbwerk 360
    
      93Exec=/usr/bin/$pkgname
    
      94Icon=$pkgname
    
      95Terminal=false
    
      96Type=Application
    
      97Categories=System;HardwareSettings;
    
      98EOF
    
      99    chmod 644 "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      100
    
      101    # Icona
    
      102    install -m644 "$pkgname.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/"
    
      103}
    
      104

Changes since previous scan

--- PKGBUILD @ 2026-07-08 21:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -15,69 +15,90 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 pkgname=aquacontrol
-pkgver=4.0.0
+pkgver=5.0.1
 pkgrel=1
-pkgdesc="Suite di controllo per Aquaero 6 LT e Farbwerk 360"
+pkgdesc="Control suite for Aquaero 6 LT and Farbwerk 360"
 arch=('any')
 url="https://github.com/raffaele-90/aquacontrol"
 license=('GPL3')
 depends=('python' 'pyside6' 'python-hidapi')
-optdepends=('python-pynvml: supporto lettura sensori GPU Nvidia')
+optdepends=('python-pynvml: Nvidia GPU sensor readings'
+            'libpulse: alarm sound playback (paplay)')
 provides=('aquacontrol')
 conflicts=('openaquaero')
 replaces=('openaquaero')
 install="aquacontrol.install"
 source=("$pkgname-$pkgver.tar.gz::https://github.com/raffaele-90/aquacontrol/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('6866cd9c779885a414a7f48da82c9e4743c8ea791c38459ca335f5e2097cdd04')
+sha256sums=('6e34ffd3a815bf6eac4735159f9888fbea493b05639d6bcf98db3138f8b85b22')
 
 package() {
     cd "$pkgname-$pkgver"
 
-    # Directory di sistema
+    # Directory di sistema.
     install -dm755 "$pkgdir/usr/lib/$pkgname"
     install -dm755 "$pkgdir/usr/bin"
     install -dm755 "$pkgdir/usr/share/applications"
     install -dm755 "$pkgdir/usr/share/icons/hicolor/512x512/apps"
-    install -dm755 "$pkgdir/etc/udev/rules.d"
+    install -dm755 "$pkgdir/usr/lib/systemd/system"   # servizio di sistema (demone root)
+    install -dm755 "$pkgdir/usr/lib/systemd/user"     # servizio utente (agent di sessione)
 
-    # Codice Python e Assets
+    # Codice Python e assets
     install -m644 *.py "$pkgdir/usr/lib/$pkgname/"
     cp -r assets "$pkgdir/usr/lib/$pkgname/"
     find "$pkgdir/usr/lib/$pkgname/assets" -type d -exec chmod 755 {} +
     find "$pkgdir/usr/lib/$pkgname/assets" -type f -exec chmod 644 {} +
 
-    # Wrapper Eseguibile
+    # Wrapper della GUI
     echo '#!/bin/bash' > "$pkgdir/usr/bin/$pkgname"
     echo 'exec python3 /usr/lib/aquacontrol/main.py "$@"' >> "$pkgdir/usr/bin/$pkgname"
     chmod 755 "$pkgdir/usr/bin/$pkgname"
 
-    # File .desktop per i DE (Wayland/X11)
-    echo '[Desktop Entry]' > "$pkgdir/usr/share/applications/$pkgname.desktop"
-    echo 'Name=AquaControl' >> "$pkgdir/usr/share/applications/$pkgname.desktop"
-    echo 'Comment=Suite di controllo per Aquaero 6 LT e Farbwerk 360' >> "$pkgdir/usr/share/applications/$pkgname.desktop"
-    echo "Exec=/usr/bin/$pkgname" >> "$pkgdir/usr/share/applications/$pkgname.desktop"
-    echo "Icon=$pkgname" >> "$pkgdir/usr/share/applications/$pkgname.desktop"
-    echo 'Terminal=false' >> "$pkgdir/usr/share/applications/$pkgname.desktop"
-    echo 'Type=Application' >> "$pkgdir/usr/share/applications/$pkgname.desktop"
-    echo 'Categories=System;HardwareSettings;' >> "$pkgdir/usr/share/applications/$pkgname.desktop"
+    # Servizio di SISTEMA (demone root)
+    cat > "$pkgdir/usr/lib/systemd/system/aquacontrold.service" <<'EOF'
+[Unit]
+Description=AquaControl Hardware Daemon (root)
+After=multi-user.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/python3 /usr/lib/aquacontrol/aquacontrold.py
+Restart=on-failure
+User=root
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    # Servizio UTENTE (agent di sessione)
+    cat > "$pkgdir/usr/lib/systemd/user/aquacontrol-agent.service" <<'EOF'
+[Unit]
+Description=AquaControl Session Agent (alarm reaction, login diagnostics)
+After=graphical-session.target
+PartOf=graphical-session.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/python3 /usr/lib/aquacontrol/aquacontrol-agent.py
+Restart=on-failure
+
+[Install]
+WantedBy=graphical-session.target
+EOF
+
+    # File .desktop
+    cat > "$pkgdir/usr/share/applications/$pkgname.desktop" <<EOF
+[Desktop Entry]
+Name=AquaControl
+Comment=Control suite for Aquaero 6 LT and Farbwerk 360
+Exec=/usr/bin/$pkgname
+Icon=$pkgname
+Terminal=false
+Type=Application
+Categories=System;HardwareSettings;
+EOF
     chmod 644 "$pkgdir/usr/share/applications/$pkgname.desktop"
 
     # Icona
     install -m644 "$pkgname.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/"
-
-    # Regole UDEV
-    echo '# AquaControl - Permessi hardware per Aquaero 6 LT e Farbwerk 360' > "$pkgdir/etc/udev/rules.d/99-aquaero.rules"
-    echo 'SUBSYSTEM=="usb", ATTRS{idVendor}=="0c70", ATTRS{idProduct}=="f001", MODE="0666"' >> "$pkgdir/etc/udev/rules.d/99-aquaero.rules"
-    echo 'SUBSYSTEM=="hidraw", ATTRS{idVendor}=="0c70", ATTRS{idProduct}=="f001", MODE="0666"' >> "$pkgdir/etc/udev/rules.d/99-aquaero.rules"
-    echo 'SUBSYSTEM=="usb", ATTRS{idVendor}=="0c70", ATTRS{idProduct}=="f010", MODE="0666"' >> "$pkgdir/etc/udev/rules.d/99-aquaero.rules"
-    echo 'SUBSYSTEM=="hidraw", ATTRS{idVendor}=="0c70", ATTRS{idProduct}=="f010", MODE="0666"' >> "$pkgdir/etc/udev/rules.d/99-aquaero.rules"
-    echo 'ACTION=="add", SUBSYSTEM=="hwmon", ATTRS{name}=="aquaero", RUN+="/bin/sh -c '\''chmod a+w /sys$devpath/pwm*'\''"' >> "$pkgdir/etc/udev/rules.d/99-aquaero.rules"
-    chmod 644 "$pkgdir/etc/udev/rules.d/99-aquaero.rules"
-
-    # Regola Sudoers per lo spegnimento forzato
-    install -dm755 "$pkgdir/etc/sudoers.d"
-    echo '# AquaControl - Spegnimento di emergenza' > "$pkgdir/etc/sudoers.d/99-aquacontrol-shutdown"
-    echo '%wheel ALL=(ALL) NOPASSWD: /usr/bin/systemctl poweroff --force --force' >> "$pkgdir/etc/sudoers.d/99-aquacontrol-shutdown"
-    chmod 440 "$pkgdir/etc/sudoers.d/99-aquacontrol-shutdown"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 03:31:41	MEDIUM	1
2026-07-08 21:29:20	CLEAN	0
2026-07-08 17:29:03	CLEAN	0
2026-06-27 00:27:47	CLEAN	0
2026-06-24 22:21:07	CLEAN	0
2026-06-24 18:20:16	CLEAN	0
2026-06-18 16:11:54	CLEAN	0