hls-livecam-server

LOW
maintainer thefangeddeity 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The .install script modifies system services and sudoers files during setup, but only as part of expected post-install configuration initiated by the user via sudo hls-livecam-setup; it does not perform unauthorized privileged actions or self-update in a dangerous way.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The .install script modifies system services and sudoers files during setup, but only as part of expected post-install configuration initiated by the user via sudo hls-livecam-setup; it does not perform unauthorized privileged actions or self-update in a dangerous way.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • .install:71 rm -f /etc/sudoers.d/hls-livecam-dark
  • .install:72 rm -f /etc/sudoers.d/hls-livecam-services
  • .install:73 rm -f /etc/sudoers.d/camdash-smart

PKGBUILD

1# Maintainer: Ron <thefangeddeity>
2pkgname=hls-livecam-server
3pkgver=7.0.0
4pkgrel=1
5pkgdesc="Stream a USB webcam via HLS using MediaMTX and ffmpeg, with browser viewer, camdash monitor, and family presence features"
6arch=('any')
7url="https://github.com/thefangeddeity/hls-livecam-server"
8license=('GPL-3.0-or-later')
9depends=('ffmpeg' 'nginx' 'python' 'python-psutil' 'python-flask' 'python-pillow' 'python-numpy' 'python-opencv' 'python-pyfakewebcam' 'pyside6' 'v4l2loopback-dkms' 'smartmontools' 'v4l-utils' 'wget' 'ttf-dejavu')
10install=hls-livecam-server.install
11source=("$pkgname-$pkgver.tar.gz::https://github.com/thefangeddeity/hls-livecam-server/archive/refs/tags/v$pkgver.tar.gz"
12 "hls-livecam-server.install")
13sha256sums=('b513b7a101a5e1bc5a9acc2919fbbe188f4d788a31fe1265f2e771f037b9bd0e'
14 'SKIP')
15
16package() {
17 cd "$pkgname-$pkgver"
18
19 # ── Executables ──────────────────────────────────────────────────────────
20 install -Dm755 pkg/usr/share/hls-livecam-server/hls-livecam-setup-arch \
21 "$pkgdir/usr/local/bin/hls-livecam-setup"
22 install -Dm755 pkg/usr/local/bin/camdash "$pkgdir/usr/local/bin/camdash"
23 install -Dm755 pkg/usr/local/bin/camstack "$pkgdir/usr/local/bin/camstack"
24 install -Dm755 pkg/usr/local/bin/hls-livecam-repair "$pkgdir/usr/local/bin/hls-livecam-repair"
25 install -Dm755 pkg/usr/local/bin/hls-livecam-dark "$pkgdir/usr/local/bin/hls-livecam-dark"
26 install -Dm755 pkg/usr/local/bin/broadcast-api "$pkgdir/usr/local/bin/broadcast-api"
27 install -Dm755 camdash-gui "$pkgdir/usr/local/bin/camdash-gui"
28
29 # ── Operator GUI ─────────────────────────────────────────────────────────
30 # gui/ lives at the repo root rather than under pkg/, deliberately: pkg/ is
31 # packaged wholesale into the .deb, and PySide6 is not available in Debian
32 # bookworm (the pyside6 split packages start at trixie), nor is there a
33 # display on the headless Debian node. Arch installs it from here; the deb
34 # simply never sees it.
35 for f in __init__ app probes tokens video widgets; do
36 install -Dm644 "gui/$f.py" "$pkgdir/usr/share/hls-livecam-server/gui/$f.py"
37 done
38 install -Dm644 gui/assets/icon_1024.png \
39 "$pkgdir/usr/share/hls-livecam-server/gui/assets/icon_1024.png"
40 # The desktop entry is registered by hls-livecam-setup, which also prepares
41 # the per-user config dir the GUI persists window geometry into; shipping it
42 # to share/ keeps setup's copy source in the package.
43 install -Dm644 camdash-gui.desktop \
44 "$pkgdir/usr/share/hls-livecam-server/camdash-gui.desktop"
45
46 # ── Shared data ──────────────────────────────────────────────────────────
47 install -Dm755 pkg/usr/share/hls-livecam-server/camdash \
48 "$pkgdir/usr/share/hls-livecam-server/camdash"
49 install -Dm755 pkg/usr/share/hls-livecam-server/camstack \
50 "$pkgdir/usr/share/hls-livecam-server/camstack"
51 install -Dm755 pkg/usr/share/hls-livecam-server/hls-livecam-setup-arch \
52 "$pkgdir/usr/share/hls-livecam-server/hls-livecam-setup"
53 install -Dm755 pkg/usr/share/hls-livecam-server/hls-livecam-repair \
54 "$pkgdir/usr/share/hls-livecam-server/hls-livecam-repair"
55 install -Dm644 pkg/usr/share/hls-livecam-server/block_art.py \
56 "$pkgdir/usr/share/hls-livecam-server/block_art.py"
57 install -Dm644 pkg/usr/share/hls-livecam-server/cv_processor.py \
58 "$pkgdir/usr/share/hls-livecam-server/cv_processor.py"
59 install -Dm644 pkg/usr/share/hls-livecam-server/cv_detect.py \
60 "$pkgdir/usr/share/hls-livecam-server/cv_detect.py"
61 install -Dm644 pkg/usr/share/hls-livecam-server/cv_notify.py \
62 "$pkgdir/usr/share/hls-livecam-server/cv_notify.py"
63 install -Dm644 pkg/usr/share/hls-livecam-server/cv_scene.py \
64 "$pkgdir/usr/share/hls-livecam-server/cv_scene.py"
65 # cv_persist and cv_occupancy are imported behind try/except in
66 # cv_processor -- absent, they disable themselves and say nothing. That
67 # is the right runtime behaviour and exactly why leaving them out of the
68 # package was invisible: an Arch install simply had no persistence and
69 # no occupancy, with nothing in the log to suggest either had been asked
70 # for. Optional at import time, mandatory in the payload.
71 install -Dm644 pkg/usr/share/hls-livecam-server/cv_persist.py \
72 "$pkgdir/usr/share/hls-livecam-server/cv_persist.py"
73 install -Dm644 pkg/usr/share/hls-livecam-server/cv_occupancy.py \
74 "$pkgdir/usr/share/hls-livecam-server/cv_occupancy.py"
75 # The viewer's header asks for /brand.png. Ship the source of it here;
76 # hls-livecam-setup and post_upgrade put it in the web root.
77 install -Dm644 pkg/usr/share/hls-livecam-server/brand.png \
78 "$pkgdir/usr/share/hls-livecam-server/brand.png"
79 install -Dm755 pkg/usr/share/hls-livecam-server/cv_scene_register.py \
80 "$pkgdir/usr/share/hls-livecam-server/cv_scene_register.py"
81 install -Dm644 pkg/usr/share/hls-livecam-server/index.html \
82 "$pkgdir/usr/share/hls-livecam-server/index.html"
83 # The viewer loads the HLS player from /vendor/hls.min.js, same-origin,
84 # deliberately not from cdnjs (a phone on a captive/filtered network got
85 # a blank viewer otherwise -- see index.html's own comment on the
86 # <script> tag). Missed when vendor/ was added: without this file a
87 # fresh Arch install left Chrome/Firefox viewers silently broken (no
88 # crash -- the page guards every Hls reference -- just no video),
89 # exactly the failure class the vendoring was meant to prevent.
90 install -Dm644 pkg/usr/share/hls-livecam-server/vendor/hls.min.js \
91 "$pkgdir/usr/share/hls-livecam-server/vendor/hls.min.js"
92 # VERSION and PRODUCT are read by broadcast-api at /api/info time. They
93 # were never installed here, so an Arch node reported an empty version
94 # tag in its header and fell back to the built-in product identity --
95 # correct for this fleet by luck, wrong for anyone forking it. Shipping
96 # them makes the header true on a fresh install rather than only on a
97 # node someone hand-copied them to. A forked node overrides PRODUCT in
98 # /etc/hls-livecam/PRODUCT, which no installer touches.
99 install -Dm644 pkg/usr/share/hls-livecam-server/VERSION \
100 "$pkgdir/usr/share/hls-livecam-server/VERSION"
101 install -Dm644 pkg/usr/share/hls-livecam-server/PRODUCT \
102 "$pkgdir/usr/share/hls-livecam-server/PRODUCT"
103 install -Dm644 pkg/usr/share/hls-livecam-server/cams/cams.html \
104 "$pkgdir/usr/share/hls-livecam-server/cams/cams.html"
105 install -Dm644 pkg/usr/share/hls-livecam-server/ffmpeg-cam.service \
106 "$pkgdir/usr/share/hls-livecam-server/ffmpeg-cam.service"
107
108 # NOTE: var/www/hls-livecam/index.html is NOT installed here.
109 # hls-livecam-setup populates /var/www/hls-livecam/ at configure time,
110 # substituting @HOSTNAME@ into share/index.html. Installing a pre-baked
111 # file here would overwrite it with the wrong hostname on every upgrade.
112
113 # ── Systemd services ─────────────────────────────────────────────────────
114 # Arch convention: vendor units go to /usr/lib/systemd/system/
115 install -Dm644 pkg/usr/share/hls-livecam-server/broadcast-api-arch.service \
116 "$pkgdir/usr/lib/systemd/system/broadcast-api.service"
117 install -Dm644 pkg/etc/systemd/system/ffmpeg-cam-dark.service \
118 "$pkgdir/usr/lib/systemd/system/ffmpeg-cam-dark.service"
119 install -Dm644 pkg/usr/lib/systemd/system/ffmpeg-cam.service \
120 "$pkgdir/usr/lib/systemd/system/ffmpeg-cam.service"
121
122 # ── tmpfiles.d ───────────────────────────────────────────────────────────
123 install -Dm644 pkg/usr/lib/tmpfiles.d/hls-livecam.conf \
124 "$pkgdir/usr/lib/tmpfiles.d/hls-livecam.conf"
125
126 # ── nginx ────────────────────────────────────────────────────────────────
127 install -Dm644 pkg/etc/nginx/conf.d/hls-livecam.conf "$pkgdir/etc/nginx/conf.d/hls-livecam.conf"
128
129 # ── Sudoers ───────────────────────────────────────────────────────────────
130 # All sudoers.d entries (hls-livecam-dark, hls-livecam-services, camdash-smart)
131 # are written dynamically by hls-livecam-setup at configure time — setup owns
132 # sudoers, package() does not ship a static copy (v5.2.1: the shipped copy was
133 # a stale fossil that setup immediately overwrites on first run anyway).
134}
135

Changes since previous scan

--- PKGBUILD @ 2026-09-10 00:22
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,6 +1,6 @@
# Maintainer: Ron <thefangeddeity>
pkgname=hls-livecam-server
-pkgver=6.0.6
+pkgver=7.0.0
pkgrel=1
pkgdesc="Stream a USB webcam via HLS using MediaMTX and ffmpeg, with browser viewer, camdash monitor, and family presence features"
arch=('any')
@@ -10,7 +10,7 @@
install=hls-livecam-server.install
source=("$pkgname-$pkgver.tar.gz::https://github.com/thefangeddeity/hls-livecam-server/archive/refs/tags/v$pkgver.tar.gz"
"hls-livecam-server.install")
-sha256sums=('3b1e682c4f9e933d84895929646b64812f0171d0cb93b64f676d23d29d4c722f'
+sha256sums=('b513b7a101a5e1bc5a9acc2919fbbe188f4d788a31fe1265f2e771f037b9bd0e'
'SKIP')
package() {
@@ -80,6 +80,15 @@
"$pkgdir/usr/share/hls-livecam-server/cv_scene_register.py"
install -Dm644 pkg/usr/share/hls-livecam-server/index.html \
"$pkgdir/usr/share/hls-livecam-server/index.html"
+ # The viewer loads the HLS player from /vendor/hls.min.js, same-origin,
+ # deliberately not from cdnjs (a phone on a captive/filtered network got
+ # a blank viewer otherwise -- see index.html's own comment on the
+ # <script> tag). Missed when vendor/ was added: without this file a
+ # fresh Arch install left Chrome/Firefox viewers silently broken (no
+ # crash -- the page guards every Hls reference -- just no video),
+ # exactly the failure class the vendoring was meant to prevent.
+ install -Dm644 pkg/usr/share/hls-livecam-server/vendor/hls.min.js \
+ "$pkgdir/usr/share/hls-livecam-server/vendor/hls.min.js"
# VERSION and PRODUCT are read by broadcast-api at /api/info time. They
# were never installed here, so an Arch node reported an empty version
# tag in its header and fell back to the built-in product identity --

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 23:21:28 Medium 1
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion