abrowser-bin

maintainer figue · 15 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a binary from Trisquel's official archive, a project-associated host, for packaging; the source is not executed remotely and the build process is transparent, posing low risk despite the non-whitelisted domain.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a binary from Trisquel's official archive, a project-associated host, for packaging; the source is not executed remotely and the build process is transparent, posing low risk despite the non-whitelisted domain.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:14 _pkgver_x86_64=$(curl -s 'https://archive.trisquel.info/trisquel/pool/main/f/firefox/?C=M;O=D' | grep abrowser_${pkgver}+ | cut -d+ -f2,3 | cut -d'"' -f1 | grep -e ${_ubuntu} | grep amd64)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://archive.trisquel.info/trisquel/pool/main/f/firefox/${_pkgname}_${pkgver}+${_pkgver_x86_64}")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Joan Figueras <ffigue at gmail dot com>
    
      2
    
      3pkgname=abrowser-bin
    
      4_pkgname=${pkgname%-*}
    
      5pkgver=152.0.6
    
      6pkgrel=1
    
      7pkgdesc="Binary version of Abrowser, safe and easy web browser from Mozilla"
    
      8arch=('x86_64')
    
      9license=('MPL' 'GPL' 'LGPL')
    
      10url="https://trisquel.info/en/wiki/abrowser-help"
    
      11depends=(alsa-lib  gtk3)
    
      12makedepends=(curl)
    
      13_ubuntu=24.04.1
    
      14_pkgver_x86_64=$(curl -s 'https://archive.trisquel.info/trisquel/pool/main/f/firefox/?C=M;O=D' | grep abrowser_${pkgver}+ | cut -d+ -f2,3 | cut -d'"' -f1 | grep -e ${_ubuntu} | grep amd64)
    
      15source=("https://archive.trisquel.info/trisquel/pool/main/f/firefox/${_pkgname}_${pkgver}+${_pkgver_x86_64}")
    
      16sha256sums=('e91b001d077dc85dec7d8650f3066880f56cf793c88b5a51baf10320dde1ded1')
    
      17
    
      18package() {
    
      19  tar xaf ${srcdir}/data.tar.* -C ${pkgdir}/
    
      20  printf '%b' "  \e[1;36m->\e[0m\033[1m Cleaning up unwanted files...\n\e[0m"
    
      21  rm -rv "${pkgdir}"/{etc/apport,etc/apparmor.d,usr/share/apport,usr/share/lintian}
    
      22}
    
      23
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-07-16 00:05
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,21 +2,18 @@
 
 pkgname=abrowser-bin
 _pkgname=${pkgname%-*}
-pkgver=152.0.3
-pkgrel=2
+pkgver=152.0.6
+pkgrel=1
 pkgdesc="Binary version of Abrowser, safe and easy web browser from Mozilla"
 arch=('x86_64')
 license=('MPL' 'GPL' 'LGPL')
 url="https://trisquel.info/en/wiki/abrowser-help"
-depends=('gtk2' 'gtk3' 'gcc-libs' 'libidl2' 'nss>=3.12.10' 'libxt'
-         'libxrender' 'hunspell' 'startup-notification' 'mime-types' 'dbus-glib'
-         'alsa-lib' 'libevent' 'sqlite3>=3.7.4' 'libnotify' 'desktop-file-utils'
-         'libvpx' 'lcms2' 'nspr>=4.8.8' 'libevent' 'libpng' 'cairo')
+depends=(alsa-lib  gtk3)
 makedepends=(curl)
 _ubuntu=24.04.1
 _pkgver_x86_64=$(curl -s 'https://archive.trisquel.info/trisquel/pool/main/f/firefox/?C=M;O=D' | grep abrowser_${pkgver}+ | cut -d+ -f2,3 | cut -d'"' -f1 | grep -e ${_ubuntu} | grep amd64)
 source=("https://archive.trisquel.info/trisquel/pool/main/f/firefox/${_pkgname}_${pkgver}+${_pkgver_x86_64}")
-sha256sums=('34d3b1c30d68b0210f0fe54511f9298d5dc8ecf0814d90a76e179ed0773d9aad')
+sha256sums=('e91b001d077dc85dec7d8650f3066880f56cf793c88b5a51baf10320dde1ded1')
 
 package() {
   tar xaf ${srcdir}/data.tar.* -C ${pkgdir}/

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 07:51:00	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	3