Self-update installs releases from the upstream author's repo as root #19

New issue

Closed

opened 2026-08-17 16:57:01 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-08-17 16:57:01 -04:00

Owner

update_thread (aqomui_service.py:560-610) fetches
https://api.github.com/repos/corrad1nho/aqomui/releases/latest and installs
from https://github.com/corrad1nho/aqomui/ (aqomui_service.py:562), running
pip install / dpkg -i as root.

That is the original upstream author's repository, not this fork. So it is
both wrong (points at a different project, which has been dormant since 2019)
and a supply-chain hazard: a root service self-updating from a hardcoded
third-party URL.

Distro packaging (packaging/arch/PKGBUILD, debian/) is the correct update
path and already exists. Remove the self-update, or repoint and gate it.

`update_thread` (`aqomui_service.py:560-610`) fetches `https://api.github.com/repos/corrad1nho/aqomui/releases/latest` and installs from `https://github.com/corrad1nho/aqomui/` (`aqomui_service.py:562`), running `pip install` / `dpkg -i` as root. That is the **original upstream author's** repository, not this fork. So it is both wrong (points at a different project, which has been dormant since 2019) and a supply-chain hazard: a root service self-updating from a hardcoded third-party URL. Distro packaging (`packaging/arch/PKGBUILD`, `debian/`) is the correct update path and already exists. Remove the self-update, or repoint and gate it.

mysticalsoap added the

security

label

2026-08-17 16:57:01 -04:00

mysticalsoap referenced this issue

2026-08-18 18:10:49 -04:00

Support Debian/Ubuntu packaging #44

mysticalsoap referenced this issue

2026-08-18 18:11:16 -04:00

Drop the inherited Debian packaging #45

mysticalsoap referenced this issue from a pull request that will close it,

2026-08-18 19:18:18 -04:00