shelf-sh-bin

LOW

maintainer rubiin 0 votes scanned 2026-11-04 00:25:23.536954

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub releases, disables self-updates to comply with package manager ownership, and generates completions using the shipped binary; no actual privileged installation or self-update occurs.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, disables self-updates to comply with package manager ownership, and generates completions using the shipped binary; no actual privileged installation or self-update occurs.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:29 install -Dm644 "/dev/null" "${pkgdir}/usr/lib/shelf/.disable-self-update"

PKGBUILD

1 offending line(s) highlighted

      1# This file was generated by GoReleaser. DO NOT EDIT.
    
      2# Maintainer: rubiin <roobin.bhandari@gmail.com>
    
      3
    
      4pkgname='shelf-sh-bin'
    
      5pkgver=0.5.0
    
      6pkgrel=1
    
      7pkgdesc='Fast, configurable shell plugin manager written in Go.'
    
      8url='https://github.com/rubiin/shelf'
    
      9arch=('aarch64' 'i686' 'x86_64')
    
      10license=('GPL-3.0-only')
    
      11provides=('shelf-sh-bin')
    
      12conflicts=('shelf-sh-bin')
    
      13
    
      14source_aarch64=("${pkgname}_${pkgver}_aarch64.tar.gz::https://github.com/rubiin/shelf/releases/download/v${pkgver}/shelf_Linux_arm64.tar.gz")
    
      15sha256sums_aarch64=('404447b462f04d6010a98f857a6c6c4cf8477e8aab036380110fd5e7b6ffd287')
    
      16
    
      17source_i686=("${pkgname}_${pkgver}_i686.tar.gz::https://github.com/rubiin/shelf/releases/download/v${pkgver}/shelf_Linux_i386.tar.gz")
    
      18sha256sums_i686=('f543c72fb3f87dd240d672a1159137eef944f3e7d8401395d08ea565fe0aedeb')
    
      19
    
      20source_x86_64=("${pkgname}_${pkgver}_x86_64.tar.gz::https://github.com/rubiin/shelf/releases/download/v${pkgver}/shelf_Linux_x86_64.tar.gz")
    
      21sha256sums_x86_64=('8f9e971af1c98387bb56fcb2b1913e8f76a3f0815f0fac33db5c214e56cf4d5b')
    
      22
    
      23package() {
    
      24  # bin
    
      25  install -Dm755 "./shelf" "${pkgdir}/usr/bin/shelf"
    
      26  # license
    
      27  install -Dm644 "./LICENSE" "${pkgdir}/usr/share/licenses/shelf/LICENSE"
    
      28  # disable self-update: the package manager owns this install
    
      29  install -Dm644 "/dev/null" "${pkgdir}/usr/lib/shelf/.disable-self-update"
    
      30  # completions (generated at package time from the shipped binary)
    
      31  ./shelf completion bash > shelf.bash
    
      32  ./shelf completion zsh > _shelf
    
      33  ./shelf completion fish > shelf.fish
    
      34  install -Dm644 "shelf.bash" "${pkgdir}/usr/share/bash-completion/completions/shelf"
    
      35  install -Dm644 "_shelf" "${pkgdir}/usr/share/zsh/site-functions/_shelf"
    
      36  install -Dm644 "shelf.fish" "${pkgdir}/usr/share/fish/vendor_completions.d/shelf.fish"
    
      37}
    
      38

Changes since previous scan

--- PKGBUILD @ 2026-09-24 00:24
+++ PKGBUILD @ 2026-11-04 00:25
@@ -2,7 +2,7 @@
 # Maintainer: rubiin <roobin.bhandari@gmail.com>
 
 pkgname='shelf-sh-bin'
-pkgver=0.4.4
+pkgver=0.5.0
 pkgrel=1
 pkgdesc='Fast, configurable shell plugin manager written in Go.'
 url='https://github.com/rubiin/shelf'
@@ -12,19 +12,21 @@
 conflicts=('shelf-sh-bin')
 
 source_aarch64=("${pkgname}_${pkgver}_aarch64.tar.gz::https://github.com/rubiin/shelf/releases/download/v${pkgver}/shelf_Linux_arm64.tar.gz")
-sha256sums_aarch64=('08c59352105df5cb5ac8e974b29140076203cb995566207f86e1403ed6b8759c')
+sha256sums_aarch64=('404447b462f04d6010a98f857a6c6c4cf8477e8aab036380110fd5e7b6ffd287')
 
 source_i686=("${pkgname}_${pkgver}_i686.tar.gz::https://github.com/rubiin/shelf/releases/download/v${pkgver}/shelf_Linux_i386.tar.gz")
-sha256sums_i686=('b1920b9ec42294b14b87bc8905fb40d0837e9822c019ec40025dfd44e08f35ac')
+sha256sums_i686=('f543c72fb3f87dd240d672a1159137eef944f3e7d8401395d08ea565fe0aedeb')
 
 source_x86_64=("${pkgname}_${pkgver}_x86_64.tar.gz::https://github.com/rubiin/shelf/releases/download/v${pkgver}/shelf_Linux_x86_64.tar.gz")
-sha256sums_x86_64=('86ad1016fe9b2baa8856665af43e666cfcb4d216c80b48c82e21a5f7d1284e11')
+sha256sums_x86_64=('8f9e971af1c98387bb56fcb2b1913e8f76a3f0815f0fac33db5c214e56cf4d5b')
 
 package() {
   # bin
   install -Dm755 "./shelf" "${pkgdir}/usr/bin/shelf"
   # license
   install -Dm644 "./LICENSE" "${pkgdir}/usr/share/licenses/shelf/LICENSE"
+  # disable self-update: the package manager owns this install
+  install -Dm644 "/dev/null" "${pkgdir}/usr/lib/shelf/.disable-self-update"
   # completions (generated at package time from the shipped binary)
   ./shelf completion bash > shelf.bash
   ./shelf completion zsh > _shelf

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-04 00:25:23	Low	2
2026-11-03 00:01:00	Low	2
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 21:26:37	Medium	1
2026-09-24 00:24:14	Clean	2
2026-09-23 21:40:52	Low	1
2026-09-23 00:28:13	Clean	2