alacrium-browser

maintainer brauliobo · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build clones the maintainer's own GitHub repo and runs several unreviewed shell scripts (trunk.sh, version.sh, setup.sh, build.sh) that download and build Chromium at build time, then packages a locally-built RPM; the SKIP'd checksums and opaque scripts mean the full build pipeline is unverifiable, but the primary risk is the maintainer-controlled scripts executing arbitrary code during build rather than a clearly malicious payload.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:67 "depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=${_depot_tools_commit}"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): The build clones the maintainer's own GitHub repo and runs several unreviewed shell scripts (trunk.sh, version.sh, setup.sh, build.sh) that download and build Chromium at build time, then packages a locally-built RPM; the SKIP'd checksums and opaque scripts mean the full build pipeline is unverifiable, but the primary risk is the maintainer-controlled scripts executing arbitrary code during build rather than a clearly malicious payload.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Braulio Oliveira <brauliobo at gmail dot com>
    
      2
    
      3pkgname=alacrium-browser
    
      4pkgver=151.0.7922.71
    
      5pkgrel=1
    
      6pkgdesc='Performance-focused Chromium browser tracking stable releases'
    
      7arch=('x86_64')
    
      8url='https://github.com/brauliobo/alacrium'
    
      9license=('BSD-3-Clause')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'cairo'
    
      14  'dbus'
    
      15  'expat'
    
      16  'glib2'
    
      17  'gtk3'
    
      18  'libcups'
    
      19  'libx11'
    
      20  'libxcb'
    
      21  'libxcomposite'
    
      22  'libxdamage'
    
      23  'libxext'
    
      24  'libxfixes'
    
      25  'libxkbcommon'
    
      26  'libxrandr'
    
      27  'mesa'
    
      28  'nspr'
    
      29  'nss'
    
      30  'pango'
    
      31  'systemd-libs'
    
      32  'ttf-liberation'
    
      33  'vulkan-icd-loader'
    
      34  'xdg-utils'
    
      35)
    
      36makedepends=(
    
      37  'bison'
    
      38  'clang'
    
      39  'flex'
    
      40  'git'
    
      41  'gperf'
    
      42  'java-runtime-headless'
    
      43  'lld'
    
      44  'nasm'
    
      45  'ninja'
    
      46  'nodejs'
    
      47  'perl'
    
      48  'pkgconf'
    
      49  'python'
    
      50  'rpm-tools'
    
      51  'rust'
    
      52  'unzip'
    
      53  'wget'
    
      54  'yasm'
    
      55)
    
      56optdepends=(
    
      57  'gnome-keyring: password storage in GNOME'
    
      58  'kdialog: native file dialogs in KDE'
    
      59  'kwallet: password storage in KDE'
    
      60  'pipewire: WebRTC desktop sharing under Wayland'
    
      61)
    
      62options=('!debug' '!strip')
    
      63_commit=028ee37e0da2eda3f069f380e40322faddf2a39b
    
      64_depot_tools_commit=7bd73dcd391b3f83437f2bd50724c04044806728
    
      65source=(
    
      66  "alacrium::git+https://github.com/brauliobo/alacrium.git#commit=${_commit}"
    
      67  "depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=${_depot_tools_commit}"
    
      68)
    
      69sha256sums=('SKIP' 'SKIP')
    
      70
    
      71prepare() {
    
      72  export HOME="$srcdir"
    
      73  export PATH="$srcdir/depot_tools:$PATH"
    
      74
    
      75  cd alacrium
    
      76  ./trunk.sh
    
      77  ./version.sh
    
      78  ./setup.sh
    
      79}
    
      80
    
      81build() {
    
      82  local jobs
    
      83
    
      84  jobs="$(nproc)"
    
      85  if [[ ${MAKEFLAGS:-} =~ -j([0-9]+) ]]; then
    
      86    jobs="${BASH_REMATCH[1]}"
    
      87  fi
    
      88
    
      89  export HOME="$srcdir"
    
      90  export PATH="$srcdir/depot_tools:$PATH"
    
      91
    
      92  cd alacrium
    
      93  ./build.sh "$jobs"
    
      94}
    
      95
    
      96package() {
    
      97  local rpm_path="$srcdir/alacrium/chromium/src/out/alacrium/alacrium-browser_${pkgver}_AVX.rpm"
    
      98
    
      99  rpm2cpio "$rpm_path" | bsdtar -xf - -C "$pkgdir"
    
      100  rm -rf "$pkgdir/etc/cron.daily"
    
      101  ln -s /opt/alacrium-browser/alacrium-browser \
    
      102    "$pkgdir/usr/bin/alacrium-browser"
    
      103  chmod 4755 "$pkgdir/opt/alacrium-browser/chrome-sandbox"
    
      104  install -Dm644 "$srcdir/alacrium/LICENSE.md" \
    
      105    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      106}
    
      107

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 11:19:29	MEDIUM	3
2026-07-31 11:17:50	MEDIUM	3