frzr-sk

LOW

maintainer honjow 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs its own scripts and systemd units, which is normal for AUR packages; no actual privileged installation or self-update mechanism is present despite the static analyzer's false positive on install paths.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs its own scripts and systemd units, which is normal for AUR packages; no actual privileged installation or self-update mechanism is present despite the static analyzer's false positive on install paths.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:39 install -m 644 "$srcdir/$_pkgname/frzr-autoupdate.service" "$pkgdir/etc/systemd/system"
PKGBUILD:40 install -m 644 "$srcdir/$_pkgname/frzr-autoupdate.timer" "$pkgdir/etc/systemd/system"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: honjow <honjow@gmail.com>
    
      2
    
      3pkgname=frzr-sk
    
      4_pkgname=frzr
    
      5pkgver=3.5.4
    
      6pkgrel=1
    
      7pkgdesc="A deployment and update system for read-only btrfs subvolume based operating systems"
    
      8arch=('any')
    
      9provides=('frzr')
    
      10conflicts=('frzr')
    
      11url="https://github.com/honjow/frzr"
    
      12license=('MIT')
    
      13depends=('btrfs-progs' 'parted' 'libnewt' 'dosfstools' 'jq' 'util-linux' 'dmidecode' 'zstd' 'xz' 'aria2')
    
      14makedepends=('fakeroot')
    
      15
    
      16# 3.5.4 release snapshot, pinned to the reviewed source commit (not a Git tag).
    
      17_commit=ab6eb064abd963e203b7f3999b452e31385bf97f
    
      18source=("git+$url#commit=${_commit}")
    
      19md5sums=('SKIP')
    
      20
    
      21backup=('etc/frzr-sk.conf')
    
      22
    
      23# pkgver() {
    
      24#     cd "$srcdir/$_pkgname"
    
      25#     # printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      26#     git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      27# }
    
      28
    
      29package() {
    
      30  mkdir -p "$pkgdir/usr/bin"
    
      31  mkdir -p "$pkgdir/etc/systemd/system"
    
      32  install -m 755 "$srcdir/$_pkgname/frzr-bootstrap" "$pkgdir/usr/bin"
    
      33  install -m 755 "$srcdir/$_pkgname/frzr-deploy" "$pkgdir/usr/bin"
    
      34  install -m 755 "$srcdir/$_pkgname/__frzr-deploy" "$pkgdir/usr/bin"
    
      35  install -m 755 "$srcdir/$_pkgname/frzr-release" "$pkgdir/usr/bin"
    
      36  install -m 755 "$srcdir/$_pkgname/frzr-unlock" "$pkgdir/usr/bin"
    
      37  install -m 755 "$srcdir/$_pkgname/frzr-initramfs" "$pkgdir/usr/bin"
    
      38  install -m 755 "$srcdir/$_pkgname/frzr-tweaks" "$pkgdir/usr/bin"
    
      39  install -m 644 "$srcdir/$_pkgname/frzr-autoupdate.service" "$pkgdir/etc/systemd/system"
    
      40  install -m 644 "$srcdir/$_pkgname/frzr-autoupdate.timer" "$pkgdir/etc/systemd/system"
    
      41
    
      42  install -dm755 "$pkgdir/etc"
    
      43  install -m644 -t "$pkgdir/etc" "$srcdir/$_pkgname/etc"/*.conf
    
      44  install -m644 -t "$pkgdir/etc" "$srcdir/$_pkgname/etc"/*.json || true
    
      45}
    
      46

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,7 +2,7 @@
 
 pkgname=frzr-sk
 _pkgname=frzr
-pkgver=3.5.3
+pkgver=3.5.4
 pkgrel=1
 pkgdesc="A deployment and update system for read-only btrfs subvolume based operating systems"
 arch=('any')
@@ -13,8 +13,9 @@
 depends=('btrfs-progs' 'parted' 'libnewt' 'dosfstools' 'jq' 'util-linux' 'dmidecode' 'zstd' 'xz' 'aria2')
 makedepends=('fakeroot')
 
-_tag=$pkgver
-source=("git+$url#tag=${_tag}")
+# 3.5.4 release snapshot, pinned to the reviewed source commit (not a Git tag).
+_commit=ab6eb064abd963e203b7f3999b452e31385bf97f
+source=("git+$url#commit=${_commit}")
 md5sums=('SKIP')
 
 backup=('etc/frzr-sk.conf')

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 11:16:23	Medium	1
2026-06-18 16:11:54	Clean	0