alacrium-browser
LOW
maintainer brauliobo
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package builds from source using a git checkout from the maintainer's own GitHub repository, which is a normal AUR practice; the non-whitelisted host is the maintainer's plausible project fork, not a source of prebuilt executables or unreviewed remote code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using a git checkout from the maintainer's own GitHub repository, which is a normal AUR practice; the non-whitelisted host is the maintainer's plausible project fork, not a source of prebuilt executables or unreviewed remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:66
"depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=${_depot_tools_commit}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Braulio Oliveira <brauliobo at gmail dot com>
2
3
pkgname=alacrium-browser
4
pkgver=156.0.8078.47
5
pkgrel=1
6
pkgdesc='Performance-focused Chromium browser tracking stable releases'
7
arch=('x86_64')
8
url='https://github.com/brauliobo/alacrium'
9
license=('BSD-3-Clause')
10
depends=(
11
'alsa-lib'
12
'at-spi2-core'
13
'cairo'
14
'dbus'
15
'expat'
16
'glib2'
17
'gtk3'
18
'libcups'
19
'libx11'
20
'libxcb'
21
'libxcomposite'
22
'libxdamage'
23
'libxext'
24
'libxfixes'
25
'libxkbcommon'
26
'libxrandr'
27
'mesa'
28
'nspr'
29
'nss'
30
'pango'
31
'systemd-libs'
32
'ttf-liberation'
33
'vulkan-icd-loader'
34
'xdg-utils'
35
)
36
makedepends=(
37
'bison'
38
'clang'
39
'flex'
40
'git'
41
'gperf'
42
'java-runtime-headless'
43
'lld'
44
'nasm'
45
'ninja'
46
'nodejs'
47
'perl'
48
'pkgconf'
49
'python'
50
'rust'
51
'unzip'
52
'wget'
53
'yasm'
54
)
55
optdepends=(
56
'gnome-keyring: password storage in GNOME'
57
'kdialog: native file dialogs in KDE'
58
'kwallet: password storage in KDE'
59
'pipewire: WebRTC desktop sharing under Wayland'
60
)
61
options=('!debug' '!strip')
62
_commit=d8a004be31e6af45d27a96cec066c866417763bf
63
_depot_tools_commit=7bd73dcd391b3f83437f2bd50724c04044806728
64
source=(
65
"alacrium::git+https://github.com/brauliobo/alacrium.git#commit=${_commit}"
66
"depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=${_depot_tools_commit}"
67
)
68
sha256sums=('SKIP' 'SKIP')
69
70
prepare() {
71
export HOME="$srcdir"
72
export PATH="$srcdir/depot_tools:$PATH"
73
74
cd alacrium
75
./trunk.sh
76
./version.sh
77
./setup.sh
78
}
79
80
build() {
81
local jobs
82
83
jobs="$(nproc)"
84
if [[ ${MAKEFLAGS:-} =~ -j([0-9]+) ]]; then
85
jobs="${BASH_REMATCH[1]}"
86
fi
87
88
export HOME="$srcdir"
89
export PATH="$srcdir/depot_tools:$PATH"
90
91
cd alacrium
92
./build.sh "$jobs"
93
}
94
95
package() {
96
local deb_path="$srcdir/alacrium/chromium/src/out/alacrium/alacrium-browser_${pkgver}_AVX.deb"
97
local logo size
98
99
bsdtar -xOf "$deb_path" data.tar.xz | bsdtar -xf - -C "$pkgdir"
100
rm -rf "$pkgdir/etc/cron.daily"
101
chmod 4755 "$pkgdir/opt/alacrium-browser/chrome-sandbox"
102
for logo in "$pkgdir"/opt/alacrium-browser/product_logo_*.png; do
103
size="${logo##*_}"
104
size="${size%.png}"
105
[[ "$size" =~ ^[0-9]+$ ]] || continue
106
install -Dm644 "$logo" \
107
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/alacrium-browser.png"
108
done
109
install -Dm644 "$pkgdir/opt/alacrium-browser/alacrium.svg" \
110
"$pkgdir/usr/share/icons/hicolor/scalable/apps/alacrium-browser.svg"
111
install -Dm644 "$srcdir/alacrium/LICENSE.md" \
112
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
113
}
114
Changes since previous scan
--- PKGBUILD @ 2026-10-21 03:30+++ PKGBUILD @ 2026-11-01 00:21@@ -1,8 +1,8 @@ # Maintainer: Braulio Oliveira <brauliobo at gmail dot com> pkgname=alacrium-browser-pkgver=155.0.8059.84-pkgrel=2+pkgver=156.0.8078.47+pkgrel=1 pkgdesc='Performance-focused Chromium browser tracking stable releases' arch=('x86_64') url='https://github.com/brauliobo/alacrium'@@ -59,7 +59,7 @@ 'pipewire: WebRTC desktop sharing under Wayland' ) options=('!debug' '!strip')-_commit=e1d0ebc8b2a2225627f9e698e81b54bc15aa861b+_commit=d8a004be31e6af45d27a96cec066c866417763bf _depot_tools_commit=7bd73dcd391b3f83437f2bd50724c04044806728 source=( "alacrium::git+https://github.com/brauliobo/alacrium.git#commit=${_commit}"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 19:33:05 | Medium | 1 |
| 2026-10-21 03:30:06 | Medium | 2 |
| 2026-10-21 01:29:42 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 09:15:55 | Medium | 2 |