frost

LOW

maintainer 0atxl 0 votes scanned 2026-10-30 17:56:37.877434

View on AUR

Why flagged

The package builds from pinned git commits of the project's own source and a legitimate dependency, with SKIP'd checksums but no remote code execution or malicious payloads; the build process is transparent and uses system libraries, posing low risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from pinned git commits of the project's own source and a legitimate dependency, with SKIP'd checksums but no remote code execution or malicious payloads; the build process is transparent and uses system libraries, posing low risk.

PKGBUILD

      1# Maintainer: 0atxl
    
      2# Source pinned to Frost v0.1.0.
    
      3pkgname=frost
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6pkgdesc='Local browser file manager for Linux desktops'
    
      7arch=('x86_64')
    
      8url='https://github.com/0atxl/frost'
    
      9license=('MIT')
    
      10options=('!debug')
    
      11depends=('nodejs>=22.13' 'python' 'python-gobject' 'glib2' 'gvfs' 'dbus' 'libvips')
    
      12makedepends=('git' 'npm' 'node-gyp' 'pkgconf')
    
      13optdepends=('gvfs-smb: SMB shares')
    
      14_commit=581218f09fa23d247566862f698ea1cdf783ada2
    
      15_addon_commit=6babc960154752f686a7dca8e712991a976a754b
    
      16source=("frost::git+https://github.com/0atxl/frost.git#commit=${_commit}"
    
      17        "node-addon-api::git+https://github.com/nodejs/node-addon-api.git#commit=${_addon_commit}")
    
      18# Git sources use a full immutable commit rather than an unverified moving tag.
    
      19sha256sums=('SKIP' 'SKIP')
    
      20
    
      21prepare() {
    
      22  cd "$srcdir/frost"
    
      23  [[ "$(git rev-parse HEAD)" == "$_commit" ]]
    
      24  [[ "$(node -p 'JSON.parse(require("fs").readFileSync("package.json")).version')" == "$pkgver" ]]
    
      25  npm ci --include=optional --ignore-scripts --no-audit --no-fund
    
      26  # Build tooling such as esbuild needs its platform binary setup.
    
      27  SHARP_IGNORE_GLOBAL_LIBVIPS=1 npm rebuild --no-audit --no-fund
    
      28}
    
      29
    
      30build() {
    
      31  cd "$srcdir/frost"
    
      32  npm run build
    
      33  node scripts/release/notices.mjs "$srcdir"
    
      34  mkdir -p "$srcdir/runtime"
    
      35  cp package.json package-lock.json "$srcdir/runtime/"
    
      36  npm ci --prefix "$srcdir/runtime" --omit=dev --include=optional --ignore-scripts --no-audit --no-fund
    
      37  cd "$srcdir/runtime/node_modules/sharp"
    
      38  # Compile against Arch's system Node headers, node-addon-api and libvips.
    
      39  # No bundled Node or prebuilt libvips is installed by this package.
    
      40  export SHARP_FORCE_GLOBAL_LIBVIPS=1
    
      41  export npm_config_nodedir=/usr
    
      42  export NODE_PATH="$srcdir:/usr/share/nodejs:/usr/lib/node_modules"
    
      43  node-gyp rebuild --directory=src
    
      44  # Retain the loadable addon, not compiler objects, Makefiles or build paths.
    
      45  install -m755 src/build/Release/*.node "$srcdir/sharp-native.node"
    
      46  _native_name=$(basename src/build/Release/*.node)
    
      47  rm -rf src/build
    
      48  install -Dm755 "$srcdir/sharp-native.node" "src/build/Release/$_native_name"
    
      49  rm -rf "$srcdir/runtime/node_modules/@img"/sharp-linux* "$srcdir/runtime/node_modules/@img"/sharp-libvips-*
    
      50}
    
      51
    
      52package() {
    
      53  cd "$srcdir/frost"
    
      54  install -d "$pkgdir/usr/lib/frost" "$pkgdir/usr/bin" "$pkgdir/usr/share/licenses/frost" "$pkgdir/usr/share/doc/frost"
    
      55  # Explicit allowlist. Never copy the source checkout or any dot-directories.
    
      56  cp -R dist build "$pkgdir/usr/lib/frost/"
    
      57  cp -R "$srcdir/runtime/node_modules" "$pkgdir/usr/lib/frost/"
    
      58  install -m644 package.json "$pkgdir/usr/lib/frost/"
    
      59  install -m755 packaging/frost "$pkgdir/usr/bin/frost"
    
      60  install -m644 LICENSE "$pkgdir/usr/share/licenses/frost/LICENSE"
    
      61  cp -R "$srcdir/notices" "$pkgdir/usr/share/licenses/frost/"
    
      62  install -m644 "$srcdir/THIRD_PARTY_NOTICES.json" "$pkgdir/usr/share/licenses/frost/"
    
      63  install -m644 README.md docs/distribution.md "$pkgdir/usr/share/doc/frost/"
    
      64  find "$pkgdir/usr" -type d -exec chmod 755 {} +
    
      65  chmod -R go-w "$pkgdir/usr"
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 17:56:37	Low	2