laptop-livecam
LOW
maintainer thefangeddeity
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The package installs legitimate scripts and services for a webcam streaming setup, with post-install/upgrade hooks that modify a Python package locally and refresh web assets; the flagged privileged actions are part of normal configuration management and self-contained setup, not malicious remote code execution or unauthorized persistence.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs legitimate scripts and services for a webcam streaming setup, with post-install/upgrade hooks that modify a Python package locally and refresh web assets; the flagged privileged actions are part of normal configuration management and self-contained setup, not malicious remote code execution or unauthorized persistence.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
.install:71
rm -f /etc/sudoers.d/hls-livecam-dark -
.install:72
rm -f /etc/sudoers.d/hls-livecam-services -
.install:73
rm -f /etc/sudoers.d/camdash-smart
PKGBUILD
1
# Maintainer: thefangeddeity
2
pkgname=laptop-livecam
3
pkgver=7.0.4
4
pkgrel=1
5
pkgdesc="Stream a USB webcam via HLS using MediaMTX and ffmpeg, with browser viewer, camdash monitor, and family presence features"
6
arch=('any')
7
# RENAMED from hls-livecam-server, matching the upstream repo rename. These
8
# three are what make it a rename rather than a second package: pacman
9
# replaces the installed hls-livecam-server instead of refusing to install
10
# alongside it. The on-disk layout is deliberately UNCHANGED --
11
# /usr/share/hls-livecam-server, /etc/hls-livecam and the unit names stay --
12
# because every script, systemd unit and config on a live node refers to
13
# them, and renaming the package is not a reason to break a running fleet.
14
provides=('hls-livecam-server')
15
conflicts=('hls-livecam-server')
16
replaces=('hls-livecam-server')
17
url="https://github.com/thefangeddeity/laptop-livecam"
18
license=('GPL-3.0-or-later')
19
depends=('ffmpeg' 'nginx' 'python' 'python-psutil' 'python-flask' 'python-pillow' 'python-numpy' 'python-opencv' 'python-pyfakewebcam' 'pyside6' 'v4l2loopback-dkms' 'smartmontools' 'v4l-utils' 'wget' 'ttf-dejavu')
20
install=laptop-livecam.install
21
source=("$pkgname-$pkgver.tar.gz::https://github.com/thefangeddeity/laptop-livecam/archive/refs/tags/v$pkgver.tar.gz"
22
"laptop-livecam.install")
23
sha256sums=('ac8add79fd63b0563856735fc055b316449c198e53a3a511a2434b27c9ae257d'
24
'SKIP')
25
26
package() {
27
cd "$pkgname-$pkgver"
28
29
# ── Executables ──────────────────────────────────────────────────────────
30
install -Dm755 pkg/usr/share/hls-livecam-server/hls-livecam-setup-arch \
31
"$pkgdir/usr/local/bin/hls-livecam-setup"
32
install -Dm755 pkg/usr/local/bin/camdash "$pkgdir/usr/local/bin/camdash"
33
install -Dm755 pkg/usr/local/bin/camstack "$pkgdir/usr/local/bin/camstack"
34
install -Dm755 pkg/usr/local/bin/hls-livecam-repair "$pkgdir/usr/local/bin/hls-livecam-repair"
35
install -Dm755 pkg/usr/local/bin/hls-livecam-dark "$pkgdir/usr/local/bin/hls-livecam-dark"
36
install -Dm755 pkg/usr/local/bin/broadcast-api "$pkgdir/usr/local/bin/broadcast-api"
37
install -Dm755 camdash-gui "$pkgdir/usr/local/bin/camdash-gui"
38
39
# ── Operator GUI ─────────────────────────────────────────────────────────
40
# gui/ lives at the repo root rather than under pkg/, deliberately: pkg/ is
41
# packaged wholesale into the .deb, and PySide6 is not available in Debian
42
# bookworm (the pyside6 split packages start at trixie), nor is there a
43
# display on the headless Debian node. Arch installs it from here; the deb
44
# simply never sees it.
45
for f in __init__ app probes tokens video widgets; do
46
install -Dm644 "gui/$f.py" "$pkgdir/usr/share/hls-livecam-server/gui/$f.py"
47
done
48
install -Dm644 gui/assets/icon_1024.png \
49
"$pkgdir/usr/share/hls-livecam-server/gui/assets/icon_1024.png"
50
# The desktop entry is registered by hls-livecam-setup, which also prepares
51
# the per-user config dir the GUI persists window geometry into; shipping it
52
# to share/ keeps setup's copy source in the package.
53
install -Dm644 camdash-gui.desktop \
54
"$pkgdir/usr/share/hls-livecam-server/camdash-gui.desktop"
55
56
# ── Shared data ──────────────────────────────────────────────────────────
57
install -Dm755 pkg/usr/share/hls-livecam-server/camdash \
58
"$pkgdir/usr/share/hls-livecam-server/camdash"
59
install -Dm755 pkg/usr/share/hls-livecam-server/camstack \
60
"$pkgdir/usr/share/hls-livecam-server/camstack"
61
install -Dm755 pkg/usr/share/hls-livecam-server/hls-livecam-setup-arch \
62
"$pkgdir/usr/share/hls-livecam-server/hls-livecam-setup"
63
install -Dm755 pkg/usr/share/hls-livecam-server/hls-livecam-repair \
64
"$pkgdir/usr/share/hls-livecam-server/hls-livecam-repair"
65
install -Dm644 pkg/usr/share/hls-livecam-server/block_art.py \
66
"$pkgdir/usr/share/hls-livecam-server/block_art.py"
67
install -Dm644 pkg/usr/share/hls-livecam-server/cv_processor.py \
68
"$pkgdir/usr/share/hls-livecam-server/cv_processor.py"
69
install -Dm644 pkg/usr/share/hls-livecam-server/cv_detect.py \
70
"$pkgdir/usr/share/hls-livecam-server/cv_detect.py"
71
install -Dm644 pkg/usr/share/hls-livecam-server/cv_notify.py \
72
"$pkgdir/usr/share/hls-livecam-server/cv_notify.py"
73
install -Dm644 pkg/usr/share/hls-livecam-server/cv_scene.py \
74
"$pkgdir/usr/share/hls-livecam-server/cv_scene.py"
75
# cv_persist and cv_occupancy are imported behind try/except in
76
# cv_processor -- absent, they disable themselves and say nothing. That
77
# is the right runtime behaviour and exactly why leaving them out of the
78
# package was invisible: an Arch install simply had no persistence and
79
# no occupancy, with nothing in the log to suggest either had been asked
80
# for. Optional at import time, mandatory in the payload.
81
install -Dm644 pkg/usr/share/hls-livecam-server/cv_persist.py \
82
"$pkgdir/usr/share/hls-livecam-server/cv_persist.py"
83
install -Dm644 pkg/usr/share/hls-livecam-server/cv_occupancy.py \
84
"$pkgdir/usr/share/hls-livecam-server/cv_occupancy.py"
85
# The viewer's header asks for /brand.png. Ship the source of it here;
86
# hls-livecam-setup and post_upgrade put it in the web root.
87
install -Dm644 pkg/usr/share/hls-livecam-server/brand.png \
88
"$pkgdir/usr/share/hls-livecam-server/brand.png"
89
install -Dm755 pkg/usr/share/hls-livecam-server/cv_scene_register.py \
90
"$pkgdir/usr/share/hls-livecam-server/cv_scene_register.py"
91
install -Dm644 pkg/usr/share/hls-livecam-server/index.html \
92
"$pkgdir/usr/share/hls-livecam-server/index.html"
93
# The viewer loads the HLS player from /vendor/hls.min.js, same-origin,
94
# deliberately not from cdnjs (a phone on a captive/filtered network got
95
# a blank viewer otherwise -- see index.html's own comment on the
96
# <script> tag). Missed when vendor/ was added: without this file a
97
# fresh Arch install left Chrome/Firefox viewers silently broken (no
98
# crash -- the page guards every Hls reference -- just no video),
99
# exactly the failure class the vendoring was meant to prevent.
100
install -Dm644 pkg/usr/share/hls-livecam-server/vendor/hls.min.js \
101
"$pkgdir/usr/share/hls-livecam-server/vendor/hls.min.js"
102
# VERSION and PRODUCT are read by broadcast-api at /api/info time. They
103
# were never installed here, so an Arch node reported an empty version
104
# tag in its header and fell back to the built-in product identity --
105
# correct for this fleet by luck, wrong for anyone forking it. Shipping
106
# them makes the header true on a fresh install rather than only on a
107
# node someone hand-copied them to. A forked node overrides PRODUCT in
108
# /etc/hls-livecam/PRODUCT, which no installer touches.
109
install -Dm644 pkg/usr/share/hls-livecam-server/VERSION \
110
"$pkgdir/usr/share/hls-livecam-server/VERSION"
111
install -Dm644 pkg/usr/share/hls-livecam-server/PRODUCT \
112
"$pkgdir/usr/share/hls-livecam-server/PRODUCT"
113
install -Dm644 pkg/usr/share/hls-livecam-server/cams/cams.html \
114
"$pkgdir/usr/share/hls-livecam-server/cams/cams.html"
115
install -Dm644 pkg/usr/share/hls-livecam-server/ffmpeg-cam.service \
116
"$pkgdir/usr/share/hls-livecam-server/ffmpeg-cam.service"
117
118
# NOTE: var/www/hls-livecam/index.html is NOT installed here.
119
# hls-livecam-setup populates /var/www/hls-livecam/ at configure time,
120
# substituting @HOSTNAME@ into share/index.html. Installing a pre-baked
121
# file here would overwrite it with the wrong hostname on every upgrade.
122
123
# ── Systemd services ─────────────────────────────────────────────────────
124
# Arch convention: vendor units go to /usr/lib/systemd/system/
125
install -Dm644 pkg/usr/share/hls-livecam-server/broadcast-api-arch.service \
126
"$pkgdir/usr/lib/systemd/system/broadcast-api.service"
127
install -Dm644 pkg/etc/systemd/system/ffmpeg-cam-dark.service \
128
"$pkgdir/usr/lib/systemd/system/ffmpeg-cam-dark.service"
129
install -Dm644 pkg/usr/lib/systemd/system/ffmpeg-cam.service \
130
"$pkgdir/usr/lib/systemd/system/ffmpeg-cam.service"
131
132
# ── tmpfiles.d ───────────────────────────────────────────────────────────
133
install -Dm644 pkg/usr/lib/tmpfiles.d/hls-livecam.conf \
134
"$pkgdir/usr/lib/tmpfiles.d/hls-livecam.conf"
135
136
# ── nginx ────────────────────────────────────────────────────────────────
137
install -Dm644 pkg/etc/nginx/conf.d/hls-livecam.conf "$pkgdir/etc/nginx/conf.d/hls-livecam.conf"
138
139
# ── Sudoers ───────────────────────────────────────────────────────────────
140
# All sudoers.d entries (hls-livecam-dark, hls-livecam-services, camdash-smart)
141
# are written dynamically by hls-livecam-setup at configure time — setup owns
142
# sudoers, package() does not ship a static copy (v5.2.1: the shipped copy was
143
# a stale fossil that setup immediately overwrites on first run anyway).
144
}
145
Changes since previous scan
--- PKGBUILD @ 2026-10-15 00:28+++ PKGBUILD @ 2026-10-17 00:21@@ -1,6 +1,6 @@ # Maintainer: thefangeddeity pkgname=laptop-livecam-pkgver=7.0.1+pkgver=7.0.4 pkgrel=1 pkgdesc="Stream a USB webcam via HLS using MediaMTX and ffmpeg, with browser viewer, camdash monitor, and family presence features" arch=('any')@@ -20,7 +20,7 @@ install=laptop-livecam.install source=("$pkgname-$pkgver.tar.gz::https://github.com/thefangeddeity/laptop-livecam/archive/refs/tags/v$pkgver.tar.gz" "laptop-livecam.install")-sha256sums=('3fd0c92de6abb5ef56b11a30ac41ed4ab81cc64cb7531286cd6a79223f1e6599'+sha256sums=('ac8add79fd63b0563856735fc055b316449c198e53a3a511a2434b27c9ae257d' 'SKIP') package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 01:21:20 | Medium | 2 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |
| 2026-10-13 00:23:45 | Low | 3 |
| 2026-10-12 23:19:21 | Low | 3 |
| 2026-10-12 23:15:20 | Medium | 2 |