shelly-cli

maintainer ZoeyErinBauer · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate project Git repository, uses SKIP only due to the git source, and installs compiled binaries and completions; no remote code execution or malicious payloads are present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project Git repository, uses SKIP only due to the git source, and installs compiled binaries and completions; no remote code execution or malicious payloads are present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Zoey Bauer <zoey.erin.bauer@gmail.com>
    
      2
    
      3pkgbase=shelly-cli
    
      4pkgname=('shelly-cli' 'shelly-cli-flatpak-backend')
    
      5pkgver=3.0.1r3739.gb9a199b
    
      6pkgrel=1
    
      7arch=('x86_64')
    
      8url='https://github.com/Seafoam-Labs/Shelly-ALPM'
    
      9license=('GPL-3.0-only')
    
      10makedepends=(
    
      11  'git'
    
      12  'pkgconf'
    
      13  'zig>=0.16.0'
    
      14  'flatpak'
    
      15)
    
      16source=("${pkgname}::git+https://github.com/Seafoam-Labs/Shelly-ALPM.git#branch=development")
    
      17sha256sums=('SKIP')
    
      18
    
      19pkgver() {
    
      20  cd "${srcdir}/${pkgname}"
    
      21
    
      22  printf '3.0.1r%s.g%s' \
    
      23    "$(git rev-list --count HEAD)" \
    
      24    "$(git rev-parse --short=7 HEAD)"
    
      25}
    
      26
    
      27build() {
    
      28  cd "${srcdir}/${pkgbase}"
    
      29
    
      30  (cd Shelly.Flatpak.Backend && zig build --verbose \
    
      31    --prefix "${srcdir}/zig-out-flatpak-backend" \
    
      32    -Dcpu=baseline \
    
      33    -Doptimize=ReleaseSafe)
    
      34
    
      35  (cd Shelly.Cli.Zig && zig build --verbose \
    
      36    --prefix "${srcdir}/zig-out" \
    
      37    -Dcpu=baseline \
    
      38    -Doptimize=ReleaseSmall)
    
      39
    
      40  for shell in bash fish zsh; do
    
      41    "${srcdir}/zig-out/bin/shelly" utility --completions "${shell}" \
    
      42      > "${srcdir}/shelly-beta.${shell}"
    
      43  done
    
      44  sed -i \
    
      45    -e 's/_shelly/_shelly_beta/g' \
    
      46    -e 's/complete -F _shelly_beta shelly/complete -F _shelly_beta shelly-beta/' \
    
      47    "${srcdir}/shelly-beta.bash"
    
      48  sed -i 's/complete -c shelly/complete -c shelly-beta/g' \
    
      49    "${srcdir}/shelly-beta.fish"
    
      50  sed -i \
    
      51    -e 's/^#compdef shelly$/#compdef shelly-beta/' \
    
      52    -e 's/_shelly/_shelly-beta/g' \
    
      53    "${srcdir}/shelly-beta.zsh"
    
      54}
    
      55
    
      56check() {
    
      57  cd "${srcdir}/${pkgbase}"
    
      58
    
      59  (cd Shelly.Flatpak.Backend && zig build test abi-test integration-test)
    
      60  (cd Shelly.PackageManager && zig build flatpak-test)
    
      61  (cd Shelly.Cli.Zig && zig build test)
    
      62  scripts/check-flatpak-separation.sh \
    
      63    "${srcdir}/zig-out/bin/shelly" \
    
      64    "${srcdir}/zig-out-flatpak-backend/lib/libshelly-flatpak-backend.so.1"
    
      65}
    
      66
    
      67package_shelly-cli() {
    
      68  pkgdesc='Native Shelly package-manager CLI beta'
    
      69  provides=('shelly-beta')
    
      70  depends=(
    
      71    'diffutils'
    
      72    'git'
    
      73    'glibc'
    
      74    'libarchive'
    
      75    'pacman'
    
      76    'sudo'
    
      77  )
    
      78  optdepends=(
    
      79    'base-devel: build and install AUR packages'
    
      80    'devtools: build AUR packages in a clean chroot'
    
      81    'desktop-file-utils: update AppImage desktop entries'
    
      82    'fuse2: run AppImages that require FUSE 2'
    
      83    'shelly-cli-flatpak-backend: Flatpak package management support'
    
      84    'gtk-update-icon-cache: update AppImage icons'
    
      85    'opendoas: alternative privilege elevator to sudo'
    
      86    'plocate: locate-based pacfile discovery'
    
      87    'vim: default visual pacfile diff viewer'
    
      88  )
    
      89
    
      90  cd "${srcdir}/${pkgbase}"
    
      91
    
      92  install -Dm755 "${srcdir}/zig-out/bin/shelly" \
    
      93    "${pkgdir}/usr/bin/shelly-beta"
    
      94  install -Dm644 "${srcdir}/shelly-beta.bash" \
    
      95    "${pkgdir}/usr/share/bash-completion/completions/shelly-beta"
    
      96  install -Dm644 "${srcdir}/shelly-beta.fish" \
    
      97    "${pkgdir}/usr/share/fish/vendor_completions.d/shelly-beta.fish"
    
      98  install -Dm644 "${srcdir}/shelly-beta.zsh" \
    
      99    "${pkgdir}/usr/share/zsh/site-functions/_shelly-beta"
    
      100  install -Dm644 LICENSE \
    
      101    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      102}
    
      103
    
      104package_shelly-cli-flatpak-backend() {
    
      105  pkgdesc='Optional native Flatpak backend for the Shelly CLI beta'
    
      106  depends=("shelly-cli=${pkgver}-${pkgrel}" 'flatpak')
    
      107  provides=("shelly-flatpak-backend=${pkgver}")
    
      108  conflicts=(
    
      109    'shelly-flatpak-backend'
    
      110    'shelly-flatpak-backend-git'
    
      111    'shelly-flatpak-backend-bin'
    
      112  )
    
      113  optdepends=()
    
      114
    
      115  install -Dm755 \
    
      116    "${srcdir}/zig-out-flatpak-backend/lib/libshelly-flatpak-backend.so.1.0.0" \
    
      117    "${pkgdir}/usr/lib/shelly/libshelly-flatpak-backend.so.1.0.0"
    
      118  ln -s libshelly-flatpak-backend.so.1.0.0 \
    
      119    "${pkgdir}/usr/lib/shelly/libshelly-flatpak-backend.so.1"
    
      120}
    
      121

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,38 +1,17 @@
 # Maintainer: Zoey Bauer <zoey.erin.bauer@gmail.com>
 
-pkgname=shelly-cli
 pkgbase=shelly-cli
-pkgver=3.0.0+8r3542.g11ff868
+pkgname=('shelly-cli' 'shelly-cli-flatpak-backend')
+pkgver=3.0.1r3739.gb9a199b
 pkgrel=1
-pkgdesc='Native Shelly package-manager CLI beta'
 arch=('x86_64')
 url='https://github.com/Seafoam-Labs/Shelly-ALPM'
 license=('GPL-3.0-only')
-provides=('shelly-beta')
-depends=(
-  'diffutils'
-  'flatpak'
-  'git'
-  'glibc'
-  'glib2'
-  'libarchive'
-  'pacman'
-  'sudo'
-)
 makedepends=(
   'git'
   'pkgconf'
   'zig>=0.16.0'
-)
-optdepends=(
-  'base-devel: build and install AUR packages'
-  'devtools: build AUR packages in a clean chroot'
-  'desktop-file-utils: update AppImage desktop entries'
-  'fuse2: run AppImages that require FUSE 2'
-  'gtk-update-icon-cache: update AppImage icons'
-  'opendoas: alternative privilege elevator to sudo'
-  'plocate: locate-based pacfile discovery'
-  'vim: default visual pacfile diff viewer'
+  'flatpak'
 )
 source=("${pkgname}::git+https://github.com/Seafoam-Labs/Shelly-ALPM.git#branch=development")
 sha256sums=('SKIP')
@@ -40,18 +19,23 @@
 pkgver() {
   cd "${srcdir}/${pkgname}"
 
-  printf '3.0.0+8r%s.g%s' \
+  printf '3.0.1r%s.g%s' \
     "$(git rev-list --count HEAD)" \
     "$(git rev-parse --short=7 HEAD)"
 }
 
 build() {
-  cd "${srcdir}/${pkgname}/Shelly.Cli.Zig"
+  cd "${srcdir}/${pkgbase}"
 
-  zig build \
+  (cd Shelly.Flatpak.Backend && zig build --verbose \
+    --prefix "${srcdir}/zig-out-flatpak-backend" \
+    -Dcpu=baseline \
+    -Doptimize=ReleaseSafe)
+
+  (cd Shelly.Cli.Zig && zig build --verbose \
     --prefix "${srcdir}/zig-out" \
     -Dcpu=baseline \
-    -Doptimize=ReleaseSmall
+    -Doptimize=ReleaseSmall)
 
   for shell in bash fish zsh; do
     "${srcdir}/zig-out/bin/shelly" utility --completions "${shell}" \
@@ -69,8 +53,41 @@
     "${srcdir}/shelly-beta.zsh"
 }
 
-package() {
-  cd "${srcdir}/${pkgname}"
+check() {
+  cd "${srcdir}/${pkgbase}"
+
+  (cd Shelly.Flatpak.Backend && zig build test abi-test integration-test)
+  (cd Shelly.PackageManager && zig build flatpak-test)
+  (cd Shelly.Cli.Zig && zig build test)
+  scripts/check-flatpak-separation.sh \
+    "${srcdir}/zig-out/bin/shelly" \
+    "${srcdir}/zig-out-flatpak-backend/lib/libshelly-flatpak-backend.so.1"
+}
+
+package_shelly-cli() {
+  pkgdesc='Native Shelly package-manager CLI beta'
+  provides=('shelly-beta')
+  depends=(
+    'diffutils'
+    'git'
+    'glibc'
+    'libarchive'
+    'pacman'
+    'sudo'
+  )
+  optdepends=(
+    'base-devel: build and install AUR packages'
+    'devtools: build AUR packages in a clean chroot'
+    'desktop-file-utils: update AppImage desktop entries'
+    'fuse2: run AppImages that require FUSE 2'
+    'shelly-cli-flatpak-backend: Flatpak package management support'
+    'gtk-update-icon-cache: update AppImage icons'
+    'opendoas: alternative privilege elevator to sudo'
+    'plocate: locate-based pacfile discovery'
+    'vim: default visual pacfile diff viewer'
+  )
+
+  cd "${srcdir}/${pkgbase}"
 
   install -Dm755 "${srcdir}/zig-out/bin/shelly" \
     "${pkgdir}/usr/bin/shelly-beta"
@@ -84,3 +101,21 @@
     "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
+package_shelly-cli-flatpak-backend() {
+  pkgdesc='Optional native Flatpak backend for the Shelly CLI beta'
+  depends=("shelly-cli=${pkgver}-${pkgrel}" 'flatpak')
+  provides=("shelly-flatpak-backend=${pkgver}")
+  conflicts=(
+    'shelly-flatpak-backend'
+    'shelly-flatpak-backend-git'
+    'shelly-flatpak-backend-bin'
+  )
+  optdepends=()
+
+  install -Dm755 \
+    "${srcdir}/zig-out-flatpak-backend/lib/libshelly-flatpak-backend.so.1.0.0" \
+    "${pkgdir}/usr/lib/shelly/libshelly-flatpak-backend.so.1.0.0"
+  ln -s libshelly-flatpak-backend.so.1.0.0 \
+    "${pkgdir}/usr/lib/shelly/libshelly-flatpak-backend.so.1"
+}
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 03:13:55	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 17:28:09	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 05:22:32	MEDIUM	1
2026-07-23 00:14:47	LOW	2
2026-07-22 05:19:42	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 03:15:42	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 07:13:42	MEDIUM	1