alacrium-browser
LOW
maintainer brauliobo
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a git checkout from the maintainer's own GitHub repository, which is a normal practice for AUR packages; building from a non-whitelisted host is not inherently dangerous when it's the project's own source code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git checkout from the maintainer's own GitHub repository, which is a normal practice for AUR packages; building from a non-whitelisted host is not inherently dangerous when it's the project's own source code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:66
"depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=${_depot_tools_commit}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Braulio Oliveira <brauliobo at gmail dot com>
2
3
pkgname=alacrium-browser
4
pkgver=153.0.8010.47
5
pkgrel=1
6
pkgdesc='Performance-focused Chromium browser tracking stable releases'
7
arch=('x86_64')
8
url='https://github.com/brauliobo/alacrium'
9
license=('BSD-3-Clause')
10
depends=(
11
'alsa-lib'
12
'at-spi2-core'
13
'cairo'
14
'dbus'
15
'expat'
16
'glib2'
17
'gtk3'
18
'libcups'
19
'libx11'
20
'libxcb'
21
'libxcomposite'
22
'libxdamage'
23
'libxext'
24
'libxfixes'
25
'libxkbcommon'
26
'libxrandr'
27
'mesa'
28
'nspr'
29
'nss'
30
'pango'
31
'systemd-libs'
32
'ttf-liberation'
33
'vulkan-icd-loader'
34
'xdg-utils'
35
)
36
makedepends=(
37
'bison'
38
'clang'
39
'flex'
40
'git'
41
'gperf'
42
'java-runtime-headless'
43
'lld'
44
'nasm'
45
'ninja'
46
'nodejs'
47
'perl'
48
'pkgconf'
49
'python'
50
'rust'
51
'unzip'
52
'wget'
53
'yasm'
54
)
55
optdepends=(
56
'gnome-keyring: password storage in GNOME'
57
'kdialog: native file dialogs in KDE'
58
'kwallet: password storage in KDE'
59
'pipewire: WebRTC desktop sharing under Wayland'
60
)
61
options=('!debug' '!strip')
62
_commit=837899bf0f57af21d3e5c6557478e097058ca207
63
_depot_tools_commit=7bd73dcd391b3f83437f2bd50724c04044806728
64
source=(
65
"alacrium::git+https://github.com/brauliobo/alacrium.git#commit=${_commit}"
66
"depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=${_depot_tools_commit}"
67
)
68
sha256sums=('SKIP' 'SKIP')
69
70
prepare() {
71
export HOME="$srcdir"
72
export PATH="$srcdir/depot_tools:$PATH"
73
74
cd alacrium
75
./trunk.sh
76
./version.sh
77
./setup.sh
78
}
79
80
build() {
81
local jobs
82
83
jobs="$(nproc)"
84
if [[ ${MAKEFLAGS:-} =~ -j([0-9]+) ]]; then
85
jobs="${BASH_REMATCH[1]}"
86
fi
87
88
export HOME="$srcdir"
89
export PATH="$srcdir/depot_tools:$PATH"
90
91
cd alacrium
92
./build.sh "$jobs"
93
}
94
95
package() {
96
local deb_path="$srcdir/alacrium/chromium/src/out/alacrium/alacrium-browser_${pkgver}_AVX.deb"
97
local logo size
98
99
bsdtar -xOf "$deb_path" data.tar.xz | bsdtar -xf - -C "$pkgdir"
100
rm -rf "$pkgdir/etc/cron.daily"
101
chmod 4755 "$pkgdir/opt/alacrium-browser/chrome-sandbox"
102
for logo in "$pkgdir"/opt/alacrium-browser/product_logo_*.png; do
103
size="${logo##*_}"
104
size="${size%.png}"
105
[[ "$size" =~ ^[0-9]+$ ]] || continue
106
install -Dm644 "$logo" \
107
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/alacrium-browser.png"
108
done
109
install -Dm644 "$pkgdir/opt/alacrium-browser/alacrium.svg" \
110
"$pkgdir/usr/share/icons/hicolor/scalable/apps/alacrium-browser.svg"
111
install -Dm644 "$srcdir/alacrium/LICENSE.md" \
112
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
113
}
114
Changes since previous scan
--- PKGBUILD @ 2026-09-16 00:03+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ # Maintainer: Braulio Oliveira <brauliobo at gmail dot com> pkgname=alacrium-browser-pkgver=153.0.8010.36+pkgver=153.0.8010.47 pkgrel=1 pkgdesc='Performance-focused Chromium browser tracking stable releases' arch=('x86_64')@@ -59,7 +59,7 @@ 'pipewire: WebRTC desktop sharing under Wayland' ) options=('!debug' '!strip')-_commit=a58a842c4146da041132e6949204398ebe140d5e+_commit=837899bf0f57af21d3e5c6557478e097058ca207 _depot_tools_commit=7bd73dcd391b3f83437f2bd50724c04044806728 source=( "alacrium::git+https://github.com/brauliobo/alacrium.git#commit=${_commit}"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 09:21:46 | Medium | 1 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 09:14:07 | Medium | 1 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |