deviceshelf-bin

maintainer deviceshelf · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Prebuilt binary downloaded from downloads.deviceshelf.app, which is plausibly the project's own official download infrastructure (matching the package's declared url), with a pinned sha256 checksum; the main concern is that it is proprietary closed-source software with no way to audit the binary, but there is no obfuscation, no exfiltration, and the host appears to be the vendor's own domain.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Prebuilt binary downloaded from downloads.deviceshelf.app, which is plausibly the project's own official download infrastructure (matching the package's declared url), with a pinned sha256 checksum; the main concern is that it is proprietary closed-source software with no way to audit the binary, but there is no obfuscation, no exfiltration, and the host appears to be the vendor's own domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("${pkgname}-${pkgver}.deb::https://downloads.deviceshelf.app/DeviceShelf-${pkgver}.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christof Müller <hello@deviceshelf.app>
    
      2pkgname=deviceshelf-bin
    
      3pkgver=1.7.7
    
      4pkgrel=1
    
      5pkgdesc="Local-first network scanner: discover and identify every device on your LAN, with open ports and a security report"
    
      6arch=('x86_64')
    
      7url="https://deviceshelf.app"
    
      8# Proprietary, paid software with a 7-day trial. The terms live on the website;
    
      9# the package ships no licence file of its own, so LicenseRef- it is.
    
      10license=('LicenseRef-DeviceShelf')
    
      11# Matches the Depends line of the upstream .deb: gtk3, webkit2gtk-4.1, libpcap.
    
      12# libpcap is not optional — the binary links wpcap/libpcap at load time.
    
      13depends=('gtk3' 'webkit2gtk-4.1' 'libpcap')
    
      14provides=('deviceshelf')
    
      15conflicts=('deviceshelf')
    
      16options=('!strip' '!debug')
    
      17source=("${pkgname}-${pkgver}.deb::https://downloads.deviceshelf.app/DeviceShelf-${pkgver}.deb")
    
      18sha256sums=('b1982c5285c0df29622529552f2aeadfd6c6ca1aea781b71fee99d1a4440db78')
    
      19
    
      20package() {
    
      21  # The .deb already follows the FHS: /usr/bin/deviceshelf, a .desktop entry and
    
      22  # a 512px hicolor icon. Unpacking data.tar.gz straight into $pkgdir is enough.
    
      23  bsdtar -xf data.tar.gz -C "$pkgdir"
    
      24
    
      25  # Upstream puts its README under /usr/share/doc/deviceshelf; keep it, and add
    
      26  # a licence pointer where pacman users look for one.
    
      27  install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      28  ln -s /usr/share/doc/deviceshelf/README "$pkgdir/usr/share/licenses/$pkgname/README"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 11:24:03	LOW	3
2026-08-01 11:20:22	MEDIUM	3