devolo-dlan-cockpit

MEDIUM
maintainer japama 11 votes scanned 2026-11-01 14:00:44.307000
View on AUR
Why flagged

The package downloads a prebuilt .run installer from a non-standard, untrusted host (devolo.scalecommerce.cloud) which is not the official devolo domain, posing a supply-chain risk if the host is compromised or malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:23 source=("https://devolo.scalecommerce.cloud/media/62/e1/13/1758704956/${_name}" 'devolonetsvc.service')
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .run installer from a non-standard, untrusted host (devolo.scalecommerce.cloud) which is not the official devolo domain, posing a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: japama <9z4jprfo@duck.com>
2# Contributor: japama <9z4jprfo@duck.com> 29/06/2022
3
4pkgname=devolo-dlan-cockpit
5pkgver=5.2.0.185
6pkgrel=2.4
7
8_name=devolo-cockpit-v${pkgver//./-}-linux.run
9install=${pkgname}.install
10pkgdesc="Display and configure settings of your devolo device"
11arch=('i686' 'x86_64')
12url="https://www.devolo.com/support/downloads/download/devolo-cockpit.html"
13license=('nonfree')
14depends=( 'lib32-gtk2' 'lib32-curl' 'lib32-libxt' 'lib32-libxslt' 'lib32-nss' )
15makedepends=( 'gcc' 'lib32-glibc' 'lib32-gcc-libs' )
16
17if [ "${CARCH}" = "x86_64" ]; then
18 _arch="amd64"
19else
20 _arch="i386"
21fi
22
23source=("https://devolo.scalecommerce.cloud/media/62/e1/13/1758704956/${_name}" 'devolonetsvc.service')
24
25#source=("https://www.devolo.fr/fileadmin/Web-Content/DE/products/hnw/devolo-cockpit/software/$_name" 'devolonetsvc.service')
26
27build() {
28 cd $srcdir
29 skip=$(grep -a -m1 -n "HERE_BE_DRAG[O]NS" $_name | cut -d: -f1)
30 tail $_name -n +$((skip+1)) | tar -x -C .
31 ar x "devolo-dlan-cockpit_${pkgver}-0_${_arch}.deb"
32 find . -name "adobeair*${_arch}.deb" -print | xargs ar x
33 tar xJf data.tar.xz
34 tar xJf data.tar.lzma
35 sed -i 's/\.appdata\//~\/\.appdata\//g' "${srcdir}/opt/devolo/dlancockpit/bin/dlancockpit-run.sh"
36 echo "StartupWMClass=dlancockpit" >> "${srcdir}/usr/share/applications/devolo-dlan-cockpit.desktop"
37
38 # libCore.so (Adobe AIR 2.6) référence la variable xmlLoadExtDtdDefaultValue,
39 # absente du libxml2 32 bits actuel : dlopen échoue. Shim 32 bits qui la définit.
40 echo 'int xmlLoadExtDtdDefaultValue = 0;' > xmlshim.c
41 gcc -m32 -shared -fPIC -O2 xmlshim.c -o libxmlshim.so
42
43 # Charge le shim uniquement pour le processus dlancockpit (1re commande du pipeline)
44 sed -i 's|^/opt/devolo/dlancockpit/bin/dlancockpit |LD_PRELOAD=/opt/devolo/dlancockpit/bin/libxmlshim.so &|' "${srcdir}/opt/devolo/dlancockpit/bin/dlancockpit-run.sh"
45 grep -q 'LD_PRELOAD=' "${srcdir}/opt/devolo/dlancockpit/bin/dlancockpit-run.sh" || { echo "ERREUR : LD_PRELOAD non inséré dans dlancockpit-run.sh"; return 1; }
46}
47
48package() {
49 cp -r "${srcdir}/etc/opt" "${srcdir}/opt" "${srcdir}/usr" "${srcdir}/var" "${pkgdir}/"
50 mkdir -p "${pkgdir}/var/lib/devolonetsvc"
51 printf "<?xml version="1.0" encoding="utf-8"?>\n<data_collection><allowed>2</allowed></data_collection>" > "${srcdir}/config.xml"
52 install -Dm644 "${srcdir}/config.xml" "${pkgdir}/var/lib/devolonetsvc/config.xml"
53 install -Dm644 "${srcdir}/devolonetsvc.service" "${pkgdir}/usr/lib/systemd/system/devolonetsvc.service"
54 install -Dm755 "${srcdir}/libxmlshim.so" "${pkgdir}/opt/devolo/dlancockpit/bin/libxmlshim.so"
55}
56
57sha256sums=('976099b5aa4785edc9ceabb6246abe724b78d2e717d1906eb91bf137f585a1e6'
58 '6f187ca5c7a599b5394ea09cd68885168dbd19b5bd72df5ce083e721e2f0a12c')
59

Changes since previous scan

--- PKGBUILD @ 2026-11-01 00:21
+++ PKGBUILD @ 2026-11-01 14:00
@@ -1,9 +1,10 @@
-# Maintainer: Christophe LAVIE <christophe.lavie@laposte.net>
-# Contributor: Christophe LAVIE <christophe.lavie@laposte.net> 29/06/2022
+# Maintainer: japama <9z4jprfo@duck.com>
+# Contributor: japama <9z4jprfo@duck.com> 29/06/2022
pkgname=devolo-dlan-cockpit
pkgver=5.2.0.185
-pkgrel=2.1
+pkgrel=2.4
+
_name=devolo-cockpit-v${pkgver//./-}-linux.run
install=${pkgname}.install
pkgdesc="Display and configure settings of your devolo device"
@@ -11,6 +12,7 @@
url="https://www.devolo.com/support/downloads/download/devolo-cockpit.html"
license=('nonfree')
depends=( 'lib32-gtk2' 'lib32-curl' 'lib32-libxt' 'lib32-libxslt' 'lib32-nss' )
+makedepends=( 'gcc' 'lib32-glibc' 'lib32-gcc-libs' )
if [ "${CARCH}" = "x86_64" ]; then
_arch="amd64"
@@ -18,7 +20,9 @@
_arch="i386"
fi
-source=("https://www.devolo.fr/fileadmin/Web-Content/DE/products/hnw/devolo-cockpit/software/$_name" 'devolonetsvc.service')
+source=("https://devolo.scalecommerce.cloud/media/62/e1/13/1758704956/${_name}" 'devolonetsvc.service')
+
+#source=("https://www.devolo.fr/fileadmin/Web-Content/DE/products/hnw/devolo-cockpit/software/$_name" 'devolonetsvc.service')
build() {
cd $srcdir
@@ -30,17 +34,26 @@
tar xJf data.tar.lzma
sed -i 's/\.appdata\//~\/\.appdata\//g' "${srcdir}/opt/devolo/dlancockpit/bin/dlancockpit-run.sh"
echo "StartupWMClass=dlancockpit" >> "${srcdir}/usr/share/applications/devolo-dlan-cockpit.desktop"
+
+ # libCore.so (Adobe AIR 2.6) référence la variable xmlLoadExtDtdDefaultValue,
+ # absente du libxml2 32 bits actuel : dlopen échoue. Shim 32 bits qui la définit.
+ echo 'int xmlLoadExtDtdDefaultValue = 0;' > xmlshim.c
+ gcc -m32 -shared -fPIC -O2 xmlshim.c -o libxmlshim.so
+
+ # Charge le shim uniquement pour le processus dlancockpit (1re commande du pipeline)
+ sed -i 's|^/opt/devolo/dlancockpit/bin/dlancockpit |LD_PRELOAD=/opt/devolo/dlancockpit/bin/libxmlshim.so &|' "${srcdir}/opt/devolo/dlancockpit/bin/dlancockpit-run.sh"
+ grep -q 'LD_PRELOAD=' "${srcdir}/opt/devolo/dlancockpit/bin/dlancockpit-run.sh" || { echo "ERREUR : LD_PRELOAD non inséré dans dlancockpit-run.sh"; return 1; }
}
package() {
cp -r "${srcdir}/etc/opt" "${srcdir}/opt" "${srcdir}/usr" "${srcdir}/var" "${pkgdir}/"
mkdir -p "${pkgdir}/var/lib/devolonetsvc"
printf "<?xml version="1.0" encoding="utf-8"?>\n<data_collection><allowed>2</allowed></data_collection>" > "${srcdir}/config.xml"
- install -Dm644 "${srcdir}/config.xml" "${pkgdir}/var/lib/devolonetsvc/config.xml"
+ install -Dm644 "${srcdir}/config.xml" "${pkgdir}/var/lib/devolonetsvc/config.xml"
install -Dm644 "${srcdir}/devolonetsvc.service" "${pkgdir}/usr/lib/systemd/system/devolonetsvc.service"
+ install -Dm755 "${srcdir}/libxmlshim.so" "${pkgdir}/opt/devolo/dlancockpit/bin/libxmlshim.so"
}
sha256sums=('976099b5aa4785edc9ceabb6246abe724b78d2e717d1906eb91bf137f585a1e6'
'6f187ca5c7a599b5394ea09cd68885168dbd19b5bd72df5ce083e721e2f0a12c')
-

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 14:00:44 Medium 2
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion