howdy-next

maintainer nathawat_a · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a setuid binary as part of its legitimate functionality (facial recognition authentication), which is expected for PAM modules, and does not involve remote code execution or unauthorized privilege escalation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a setuid binary as part of its legitimate functionality (facial recognition authentication), which is expected for PAM modules, and does not involve remote code execution or unauthorized privilege escalation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:42 chmod 4755 "$pkgdir/usr/lib/howdy/howdy-auth-helper"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: nathawat <nathawat[at]noreply[dot]codeberg[dot]org>
    
      2
    
      3pkgname=howdy-next
    
      4pkgver=3.3.0
    
      5pkgrel=2
    
      6pkgdesc="C++ rewrite of Howdy facial-recognition authentication on Linux"
    
      7arch=('x86_64')
    
      8url="https://codeberg.org/nathawat/howdy-next"
    
      9license=('MIT')
    
      10depends=('libinih' 'libevdev' 'pam' 'opencv>=5.0.0' 'curl' 'openssl' 'qt6-base' 'yyjson>=0.12.0')
    
      11makedepends=('meson>=1.11.0' 'gettext')
    
      12optdepends=('linux-enable-ir-emitter: Enables infrared cameras that are not directly enabled out-of-the box')
    
      13provides=('howdy')
    
      14conflicts=('howdy' 'howdy-next-git')
    
      15replaces=('howdy-next-git')
    
      16backup=('etc/howdy/config.ini')
    
      17install=howdy-next.install
    
      18
    
      19_tag="v${pkgver}"
    
      20source=(
    
      21	"${pkgname}-${pkgver}.tar.gz::${url}/archive/${_tag}.tar.gz"
    
      22	"polkit-agent-helper-howdy.conf"
    
      23)
    
      24b2sums=('396a21c434fccc4c3ac5de95308afee8beeeb90c220163e8ae242bd94b3b8108fc4119c54aa800bb8c219428960f4df57d04e9aac42906ca8c1c61e7568322e3'
    
      25		'ac6c1a82d6b4a00e4d518ad49592d5eb0aa4590e6c584328230fe875af0604b56861235cfbf9cd8a93bc9f1130eafb02392705cfa3a247770eb013da8576922b')
    
      26
    
      27build() {
    
      28	arch-meson "$srcdir/howdy-next" "$srcdir/build" \
    
      29		-Dconfig_dir=/etc/howdy \
    
      30		-Duser_models_dir=/etc/howdy/models
    
      31
    
      32	meson compile -C "$srcdir/build"
    
      33}
    
      34
    
      35check() {
    
      36	meson test -C "$srcdir/build" --print-errorlogs
    
      37}
    
      38
    
      39package() {
    
      40	meson install -C "$srcdir/build" --destdir "$pkgdir"
    
      41
    
      42	chmod 4755 "$pkgdir/usr/lib/howdy/howdy-auth-helper"
    
      43
    
      44	install -d -m750 "$pkgdir/etc/howdy/models"
    
      45	install -m640 "$srcdir/howdy-next/config/config.ini" "$pkgdir/etc/howdy/config.ini"
    
      46
    
      47	install -Dm644 "$srcdir/howdy-next/LICENSE" \
    
      48		"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      49
    
      50	# Workaround for polkit 127+ breaking howdy (boltgolt/howdy#1077)
    
      51	install -Dm644 "$srcdir/polkit-agent-helper-howdy.conf" \
    
      52		"$pkgdir/usr/lib/systemd/system/polkit-agent-helper@.service.d/10-howdy.conf"
    
      53}
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-07-18 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -21,7 +21,7 @@
 	"${pkgname}-${pkgver}.tar.gz::${url}/archive/${_tag}.tar.gz"
 	"polkit-agent-helper-howdy.conf"
 )
-b2sums=('2dce843867b81de0f713019ad2e2e9b8500570556d6fa51e7eb8ab8706a15534b94442c81b22bc3c204adfef9696336ec134d28d86c3168ee85067a706e787d3'
+b2sums=('396a21c434fccc4c3ac5de95308afee8beeeb90c220163e8ae242bd94b3b8108fc4119c54aa800bb8c219428960f4df57d04e9aac42906ca8c1c61e7568322e3'
 		'ac6c1a82d6b4a00e4d518ad49592d5eb0aa4590e6c584328230fe875af0604b56861235cfbf9cd8a93bc9f1130eafb02392705cfa3a247770eb013da8576922b')
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 19:59:04	MEDIUM	1
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2