ats-mini-controller-git

LOW

maintainer 9M2PJU 0 votes scanned 2026-10-22 17:38:03.788451

View on AUR

Why flagged

The .install hook creates a system user/group and sets directory ownership, which is standard practice for daemon packages; no sudoers/setuid manipulation or remote code execution is present. The package builds from the maintainer's own GitHub fork (a packaging branch), installs Python dependencies via pip from requirements.txt into a venv, and the flagged 'privileged install' is just normal useradd/chown for a service account. Main concerns are the SKIP'd checksum on a git source and pip pulling unverified dependencies at build time, but neither constitutes clear malice.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The .install hook creates a system user/group and sets directory ownership, which is standard practice for daemon packages; no sudoers/setuid manipulation or remote code execution is present. The package builds from the maintainer's own GitHub fork (a packaging branch), installs Python dependencies via pip from requirements.txt into a venv, and the flagged 'privileged install' is just normal useradd/chown for a service account. Main concerns are the SKIP'd checksum on a git source and pip pulling unverified dependencies at build time, but neither constitutes clear malice.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:15 chmod 2750 "$_app_dir/data"

PKGBUILD

      1# Maintainer: 9M2PJU <9M2PJU@users.noreply.github.com>
    
      2# Tracks the native-packaging branch until the upstream PR merges;
    
      3# then point _gitbranch at main (or switch to the stable ats-mini-controller package).
    
      4pkgname=ats-mini-controller-git
    
      5_pkgbase=ats-mini-controller
    
      6pkgver=2.12.0.r27.g834e4c8
    
      7pkgrel=1
    
      8pkgdesc="RTL-SDR station browser, live signal scanner and automatic CW decoder (web UI)"
    
      9arch=('x86_64' 'aarch64' 'armv7h')
    
      10url="https://github.com/jsawyerdev/ats-mini-controller"
    
      11license=('MIT')
    
      12depends=('python' 'libusb' 'rtl-sdr')
    
      13makedepends=('git' 'python-virtualenv' 'python-pip')
    
      14provides=('ats-mini-controller')
    
      15conflicts=('ats-mini-controller')
    
      16install=ats-mini-controller-git.install
    
      17source=("git+https://github.com/9M2PJU/ats-mini-controller.git#branch=packaging/native-packages")
    
      18sha256sums=('SKIP')
    
      19
    
      20pkgver() {
    
      21  cd "$_pkgbase"
    
      22  _ver="$(grep -m1 -oP '^APP_VERSION = "\K[^"]+' app.py)"
    
      23  printf "%s.r%s.g%s" "$_ver" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      24}
    
      25
    
      26package() {
    
      27  local src="$srcdir/$_pkgbase" appdir="$pkgdir/opt/ats-mini-controller"
    
      28
    
      29  install -dm755 "$appdir"
    
      30  python -m venv "$appdir/venv"
    
      31  "$appdir/venv/bin/pip" install --no-cache-dir -r "$src/requirements.txt"
    
      32
    
      33  install -m644 "$src"/app.py "$src"/radio_bridge.py "$src"/cw_decoder.py \
    
      34    "$src"/cw_monitor.py "$src"/audio_passthrough.py "$src"/stations_db.py "$appdir/"
    
      35  install -dm755 "$appdir/static" "$appdir/data/recordings"
    
      36  install -m644 "$src/static/index.html" "$appdir/static/"
    
      37  install -m644 "$src/data/stations.db" "$appdir/data/"
    
      38
    
      39  install -Dm644 "$src/packaging/ats-mini-controller.service" \
    
      40    "$pkgdir/usr/lib/systemd/system/ats-mini-controller.service"
    
      41  install -Dm644 "$src/packaging/66-rtl-sdr.rules" \
    
      42    "$pkgdir/usr/lib/udev/rules.d/66-rtl-sdr.rules"
    
      43  install -Dm644 "$src/packaging/blacklist-rtlsdr.conf" \
    
      44    "$pkgdir/usr/lib/modprobe.d/blacklist-rtlsdr.conf"
    
      45
    
      46  install -dm755 "$pkgdir/usr/bin"
    
      47  printf '#!/bin/sh\nexec /opt/ats-mini-controller/venv/bin/python -m uvicorn app:app --host "${HOST:-0.0.0.0}" --port "${PORT:-8731}"\n' \
    
      48    > "$pkgdir/usr/bin/ats-mini-controller"
    
      49  chmod 755 "$pkgdir/usr/bin/ats-mini-controller"
    
      50
    
      51  install -Dm644 "$src/LICENSE" \
    
      52    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-22 17:38:03	Low	3
2026-10-22 17:35:31	Medium	2