hls-livecam-server
maintainer thefangeddeity
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package modifies sudoers files during setup (not install) and patches a Python package post-install, but these actions are part of legitimate configuration and compatibility fixes for the software's intended functionality.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package modifies sudoers files during setup (not install) and patches a Python package post-install, but these actions are part of legitimate configuration and compatibility fixes for the software's intended functionality.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
.install:53
rm -f /etc/sudoers.d/hls-livecam-dark -
.install:54
rm -f /etc/sudoers.d/hls-livecam-services -
.install:55
rm -f /etc/sudoers.d/camdash-smart
PKGBUILD
1
# Maintainer: Ron <thefangeddeity>
2
pkgname=hls-livecam-server
3
pkgver=5.2.2
4
pkgrel=1
5
pkgdesc="Stream a USB webcam via HLS using MediaMTX and ffmpeg, with browser viewer, camdash monitor, and family presence features"
6
arch=('any')
7
url="https://github.com/thefangeddeity/hls-livecam-server"
8
license=('GPL-3.0-or-later')
9
depends=('ffmpeg' 'nginx' 'python' 'python-psutil' 'python-flask' 'python-pillow' 'python-numpy' 'python-pyfakewebcam' 'v4l2loopback-dkms' 'smartmontools' 'v4l-utils' 'wget' 'ttf-dejavu')
10
install=hls-livecam-server.install
11
source=("$pkgname-$pkgver.tar.gz::https://github.com/thefangeddeity/hls-livecam-server/archive/refs/tags/v$pkgver.tar.gz"
12
"hls-livecam-server.install")
13
sha256sums=('5f1be1bd327b8ff7ddf72abb1c0a12525a07bb6dd54a3400ca20b15fa63bb7cc'
14
'SKIP')
15
16
package() {
17
cd "$pkgname-$pkgver"
18
19
# ── Executables ──────────────────────────────────────────────────────────
20
install -Dm755 pkg/usr/share/hls-livecam-server/hls-livecam-setup-arch \
21
"$pkgdir/usr/local/bin/hls-livecam-setup"
22
install -Dm755 pkg/usr/local/bin/camdash "$pkgdir/usr/local/bin/camdash"
23
install -Dm755 pkg/usr/local/bin/hls-livecam-repair "$pkgdir/usr/local/bin/hls-livecam-repair"
24
install -Dm755 pkg/usr/local/bin/hls-livecam-dark "$pkgdir/usr/local/bin/hls-livecam-dark"
25
install -Dm755 pkg/usr/local/bin/broadcast-api "$pkgdir/usr/local/bin/broadcast-api"
26
27
# ── Shared data ──────────────────────────────────────────────────────────
28
install -Dm755 pkg/usr/share/hls-livecam-server/camdash \
29
"$pkgdir/usr/share/hls-livecam-server/camdash"
30
install -Dm755 pkg/usr/share/hls-livecam-server/hls-livecam-setup-arch \
31
"$pkgdir/usr/share/hls-livecam-server/hls-livecam-setup"
32
install -Dm755 pkg/usr/share/hls-livecam-server/hls-livecam-repair \
33
"$pkgdir/usr/share/hls-livecam-server/hls-livecam-repair"
34
install -Dm644 pkg/usr/share/hls-livecam-server/block_art.py \
35
"$pkgdir/usr/share/hls-livecam-server/block_art.py"
36
install -Dm644 pkg/usr/share/hls-livecam-server/index.html \
37
"$pkgdir/usr/share/hls-livecam-server/index.html"
38
install -Dm644 pkg/usr/share/hls-livecam-server/cams/cams.html \
39
"$pkgdir/usr/share/hls-livecam-server/cams/cams.html"
40
install -Dm644 pkg/usr/share/hls-livecam-server/ffmpeg-cam.service \
41
"$pkgdir/usr/share/hls-livecam-server/ffmpeg-cam.service"
42
43
# NOTE: var/www/hls-livecam/index.html is NOT installed here.
44
# hls-livecam-setup populates /var/www/hls-livecam/ at configure time,
45
# substituting @HOSTNAME@ into share/index.html. Installing a pre-baked
46
# file here would overwrite it with the wrong hostname on every upgrade.
47
48
# ── Systemd services ─────────────────────────────────────────────────────
49
# Arch convention: vendor units go to /usr/lib/systemd/system/
50
install -Dm644 pkg/usr/share/hls-livecam-server/broadcast-api-arch.service \
51
"$pkgdir/usr/lib/systemd/system/broadcast-api.service"
52
install -Dm644 pkg/etc/systemd/system/ffmpeg-cam-dark.service \
53
"$pkgdir/usr/lib/systemd/system/ffmpeg-cam-dark.service"
54
install -Dm644 pkg/usr/lib/systemd/system/ffmpeg-cam.service \
55
"$pkgdir/usr/lib/systemd/system/ffmpeg-cam.service"
56
57
# ── tmpfiles.d ───────────────────────────────────────────────────────────
58
install -Dm644 pkg/usr/lib/tmpfiles.d/hls-livecam.conf \
59
"$pkgdir/usr/lib/tmpfiles.d/hls-livecam.conf"
60
61
# ── nginx ────────────────────────────────────────────────────────────────
62
install -Dm644 pkg/etc/nginx/conf.d/hls-livecam.conf "$pkgdir/etc/nginx/conf.d/hls-livecam.conf"
63
64
# ── Sudoers ───────────────────────────────────────────────────────────────
65
# All sudoers.d entries (hls-livecam-dark, hls-livecam-services, camdash-smart)
66
# are written dynamically by hls-livecam-setup at configure time — setup owns
67
# sudoers, package() does not ship a static copy (v5.2.1: the shipped copy was
68
# a stale fossil that setup immediately overwrites on first run anyway).
69
}
70
Changes since previous scan
--- PKGBUILD @ 2026-07-18 00:14+++ PKGBUILD @ 2026-08-03 00:08@@ -1,6 +1,6 @@ # Maintainer: Ron <thefangeddeity> pkgname=hls-livecam-server-pkgver=5.2.0+pkgver=5.2.2 pkgrel=1 pkgdesc="Stream a USB webcam via HLS using MediaMTX and ffmpeg, with browser viewer, camdash monitor, and family presence features" arch=('any')@@ -10,7 +10,7 @@ install=hls-livecam-server.install source=("$pkgname-$pkgver.tar.gz::https://github.com/thefangeddeity/hls-livecam-server/archive/refs/tags/v$pkgver.tar.gz" "hls-livecam-server.install")-sha256sums=('6fc9e84f0d3d319ec853ec2ad8dd8d30257c7178e69d5594c159e4207b11fdf5'+sha256sums=('5f1be1bd327b8ff7ddf72abb1c0a12525a07bb6dd54a3400ca20b15fa63bb7cc' 'SKIP') package() {@@ -62,10 +62,9 @@ install -Dm644 pkg/etc/nginx/conf.d/hls-livecam.conf "$pkgdir/etc/nginx/conf.d/hls-livecam.conf" # ── Sudoers ───────────────────────────────────────────────────────────────- # Ships http user for broadcast-api (Arch has no www-data).- # Per-user entries (hls-livecam-dark, hls-livecam-services, camdash-smart)- # are written dynamically by hls-livecam-setup at configure time.- install -Dm440 pkg/etc/sudoers.d/hls-livecam-dark \- "$pkgdir/etc/sudoers.d/hls-livecam-dark"+ # All sudoers.d entries (hls-livecam-dark, hls-livecam-services, camdash-smart)+ # are written dynamically by hls-livecam-setup at configure time — setup owns+ # sudoers, package() does not ship a static copy (v5.2.1: the shipped copy was+ # a stale fossil that setup immediately overwrites on first run anyway). } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 23:59:51 | MEDIUM | 1 |
| 2026-07-18 21:59:23 | MEDIUM | 1 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |