cef-vaapi

maintainer bnema · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a Chromium source tarball from Google's official storage domain, which is a legitimate and expected source for this project; the non-whitelisted host is not a security risk given the project context and verifiable checksum.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Chromium source tarball from Google's official storage domain, which is a legitimate and expected source for this project; the non-whitelisted host is not a security risk given the project context and verifiable checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:71 source=("chromium-$_chromium_ver-lite.tar.xz::https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$_chromium_ver-lite.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christian Heusel <gromit@archlinux.org>
    
      2# Maintainer: Jonathan Grotelüschen <tippfehlr@archlinux.org>
    
      3# Contributor: Sven-Hendrik Haase <svenstaro@archlinux.org>
    
      4
    
      5# Note: This PKGBUILD and the chromium PKGBUILD are loosely kept in sync to ease maintenance.
    
      6# As such care should be taken to minimize the differences between these PKGBUILDs.
    
      7pkgname=cef-vaapi
    
      8# pkgver is updated automatically.
    
      9# To update this package, update the _cef_commit and _chromium_ver variables.
    
      10# For the CEF versioning scheme, see
    
      11# https://chromiumembedded.github.io/cef/branches_and_building#version-number-format
    
      12pkgver=150.0.17
    
      13# See https://github.com/chromiumembedded/cef/tree/<release branch>
    
      14# Also see https://chromiumembedded.github.io/cef/branches_and_building
    
      15_cef_commit=94c17267eb4595a1ad17fb67dee6cdb8ded41c6d
    
      16# the chromium version must match CHROMIUM_BUILD_COMPATIBILITY.txt in the CEF repo
    
      17_chromium_ver=150.0.7871.187
    
      18_system_clang=1
    
      19pkgrel=1
    
      20pkgdesc="Chromium Embedded Framework (CEF), simple framework for embedding Chromium-based browsers in other applications (VAAPI-enabled variant)"
    
      21provides=("cef=$pkgver")  # provides="cef=$pkgver"
    
      22conflicts=('cef')  # conflicts='cef'
    
      23arch=('x86_64')
    
      24url="https://chromiumembedded.github.io/cef"
    
      25license=('BSD-3-Clause')
    
      26depends=(
    
'alsa-lib'
    
'at-spi2-core'
    
'dbus'
    
'libdrm'
    
'libffi'
    
'libpulse'
    
'libxcomposite'
    
'libxdamage'
    
'libxkbcommon'
    
'libxrandr'
    
'mesa'
    
'nss'
    
'pango'
    
'systemd-libs'
    
'libva'
    
      42)
    
      43optdepends=(
    
'libva-mesa-driver: VAAPI driver for AMD GPUs'
    
'intel-media-driver: VAAPI driver for modern Intel GPUs'
    
'libva-utils: VAAPI diagnostics such as vainfo'
    
      47)
    
      48
    
      49makedepends=(
    
'clang'
    
'compiler-rt'
    
'git'
    
'gn'
    
'gperf'
    
'java-runtime-headless'
    
'lld'
    
'ninja'
    
'nodejs'
    
'npm'
    
'pipewire'
    
'python'
    
'python-httplib2'
    
'python-pyparsing'
    
'python-six'
    
'rsync'
    
'rust'
    
'rust-bindgen'
    
'libxtst'
    
      69)
    
      70options=('!lto') # Chromium adds its own flags for ThinLTO
    
      71source=("chromium-$_chromium_ver-lite.tar.xz::https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$_chromium_ver-lite.tar.xz"
    
"cef::git+https://github.com/chromiumembedded/cef.git#commit=${_cef_commit}"
    
chromium-138-nodejs-version-check.patch
    
chromium-145-fix-SYS_SECCOMP.patch
    
chromium-147-revert-clang-no-lifetime-dse-flag.patch
    
chromium-147-rust-1.95-bytemuck.patch
    
chromium-149-drop-unknown-clang-flag.patch
    
chromium-149-unbundle-minizip-undo-unicode.patch
    
chromium-149-use-of-undeclared-identifier-ERROR.patch
    
chromium-149-build-with-wasm-rollup.patch
    
chromium-150-fix-ar-unbundle.patch
    
chromium-150-fix-sysroot-path-error.patch
    
chromium-150-revert-avx-flag-change.patch
    
compiler-rt-adjust-paths.patch
    
increase-fortify-level.patch
    
glibc-2.42-baud-rate-fix.patch
    
cef-no-sysroot.patch
    
cef-no-libxml-visibility-patch.patch
    
chromium-disable-font-tests.patch
    
FindCEF.cmake
    
      91)
    
      92sha256sums=('63e1e8b3c40d1c9b51c55d27356f6d6b074e5c7f210e776290b1ef6d290a7df1'
    
          'ec791113ae4a8d93ef9d7dd06b60e55990a5f7561575e890af5b53c793f7eab8'
    
          '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
    
          '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'
    
          'c382830318c5b37826ecf44f3ba9def6be8affdad1bce819ecb83f3222ff4b3a'
    
          'b9e6339221efe03540ffb360c161d93604a1fc93a5a1c53e5e9849066f987d05'
    
          '5ade4cdba7afebfcc09fa969f15bf27404579beac5b7bafb59a0214d407e4ad2'
    
          'c22338d13f12772cdbcb5cfc1ace94438b9f9c72353cdb165a3ff3ef3d677c78'
    
          '951514535be65f0e2f84e82305d96292be1da353c1427ba1048ea24be70003c4'
    
          'c4df27d25d298ac95d85e6f06b558b73bb67de5110a19a0228cb7f8519291ea5'
    
          'f056d12571823d06c2a938158734fb4c7eeccb5c6f68228634d0c73d75feaa78'
    
          '5c42260b11b87dd01c4ef11598033e9687bdf384af2e45adab2fd00964e977e8'
    
          '5f6ccb7b945c8a13c690493723bad816b36f2f25792d47e677b56f8200907e60'
    
          'ec8e49b7114e2fa2d359155c9ef722ff1ba5fe2c518fa48e30863d71d3b82863'
    
          'd634d2ce1fc63da7ac41f432b1e84c59b7cceabf19d510848a7cff40c8025342'
    
          '1c1898f263eaacbc069a8e1a3e732852350350d1dad4cb1a6bba430e3b796cd0'
    
          'cdc046c3da5a57dae8fba0de49cadbe65d4f8fbfffb172f7a768222232595faa'
    
          '6695d7bcac489f74b8290a05dac540c2b5c5fed997ee119ae05419d36509445d'
    
          '44dcc0da55a8c6c6af875addcfb9c552c722b56a31479eb7d99f16d0a27f4ebb'
    
          'e576250c4d0f3dd307bd22c6d4f9f7aba54fdf4d5899520c0bd1c3527aec65ed')
    
      112
    
      113# Possible replacements are listed in build/linux/unbundle/replace_gn_files.py
    
      114# Keys are the names in the above script; values are the dependencies in Arch
    
      115declare -gA _system_libs=(
    
[brotli]=brotli
    
#[dav1d]=dav1d
    
#[ffmpeg]=ffmpeg    # YouTube playback stopped working in Chromium 120
    
[flac]=flac
    
[fontconfig]=fontconfig
    
[freetype]=freetype2
    
[harfbuzz]=harfbuzz
    
#[icu]=icu
    
#[jsoncpp]=jsoncpp  # needs libstdc++
    
#[libaom]=aom
    
#[libavif]=libavif  # needs -DAVIF_ENABLE_EXPERIMENTAL_GAIN_MAP=ON
    
[libdrm]=libdrm
    
[libjpeg]=libjpeg-turbo
    
# [libpng]=libpng
    
#[libvpx]=libvpx
    
[libwebp]=libwebp
    
[libxml]=libxml2
    
[libxslt]=libxslt
    
[openh264]=openh264
    
[opus]=opus
    
#[re2]=re2          # needs libstdc++
    
#[snappy]=snappy    # needs libstdc++
    
#[woff2]=woff2      # needs libstdc++
    
[zlib]=minizip
    
[zstd]=zstd
    
      141)
    
      142_unwanted_bundled_libs=(
    
$(printf "%s\n" ${!_system_libs[@]} | sed 's/^libjpeg$/&_turbo/')
    
      144)
    
      145depends+=(${_system_libs[@]})
    
      146
    
      147_validate_cef_vaapi_invariants() {
    
local _pkgbuild="${BASH_SOURCE[0]}"
    
local _required_flags=(
    
  'ffmpeg_branding="Chrome"'
    
  'proprietary_codecs=true'
    
  'rtc_use_pipewire=true'
    
  'link_pulseaudio=true'
    
  'use_vaapi=true'
    
)
    
local _flag _actual _flag_ok
    
for _flag in "${_required_flags[@]}"; do
    
  _flag_ok=0
    
  for _actual in "${_flags[@]}"; do
    
    if [[ "$_actual" == "$_flag" ]]; then
    
      _flag_ok=1
    
      break
    
    fi
    
  done
    
  if (( ! _flag_ok )); then
    
    echo "ERROR: required GN flag missing or changed: ${_flag}" >&2
    
    exit 1
    
  fi
    
done
    
      170
    
if grep -Eq '^[[:space:]]*\[ffmpeg\]=' "$_pkgbuild"; then
    
  echo "ERROR: _system_libs[ffmpeg] must stay commented or absent" >&2
    
  exit 1
    
fi
    
      175
    
local _source_ok=0 _s
    
for _s in "${source[@]}"; do
    
  if [[ "$_s" == cef::git+https://github.com/chromiumembedded/cef.git* ]]; then
    
    _source_ok=1
    
    break
    
  fi
    
done
    
if (( ! _source_ok )); then
    
  echo "ERROR: source must use cef::git+https://github.com/chromiumembedded/cef.git" >&2
    
  exit 1
    
fi
    
      187
    
local _provides_ok=0 _p
    
for _p in "${provides[@]}"; do
    
  if [[ "$_p" == cef=* ]]; then
    
    _provides_ok=1
    
    break
    
  fi
    
done
    
if (( ! _provides_ok )); then
    
  echo "ERROR: provides must include cef=\$pkgver" >&2
    
  exit 1
    
fi
    
      199
    
local _conflicts_ok=0 _c
    
for _c in "${conflicts[@]}"; do
    
  if [[ "$_c" == cef ]]; then
    
    _conflicts_ok=1
    
    break
    
  fi
    
done
    
if (( ! _conflicts_ok )); then
    
  echo "ERROR: conflicts must include cef" >&2
    
  exit 1
    
fi
    
      211
    
if declare -p replaces >/dev/null 2>&1 && (( ${#replaces[@]} > 0 )); then
    
  echo "ERROR: replaces must not be set" >&2
    
  exit 1
    
fi
    
      216
    
local _libva_ok=0 _d
    
for _d in "${depends[@]}"; do
    
  if [[ "$_d" == libva ]]; then
    
    _libva_ok=1
    
    break
    
  fi
    
done
    
if (( ! _libva_ok )); then
    
  echo "ERROR: depends must include libva" >&2
    
  exit 1
    
fi
    
      228}
    
      229
    
      230prepare() {
    
cd chromium-$_chromium_ver
    
      232
    
# Move CEF into the chromium source tree
    
mv "$srcdir/cef" cef
    
      235
    
# Allow building against system libraries in official builds
    
sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' \
    
  tools/generate_shim_headers/generate_shim_headers.py
    
      239
    
# https://crbug.com/893950
    
sed -i -e 's/\<xmlMalloc\>/malloc/' -e 's/\<xmlFree\>/free/' \
    
  -e '1i #include <cstdlib>' \
    
  third_party/blink/renderer/core/xml/*.cc \
    
  third_party/blink/renderer/core/xml/parser/xml_document_parser.cc \
    
  third_party/libxml/chromium/*.cc
    
      246
    
# Fixes from Gentoo
    
patch -Np1 -i ../chromium-138-nodejs-version-check.patch
    
      249
    
# Allow libclang_rt.builtins from compiler-rt >= 16 to be used
    
patch -Np1 -i ../compiler-rt-adjust-paths.patch
    
      252
    
# Increase _FORTIFY_SOURCE level to match Arch's default flags
    
patch -Np1 -i ../increase-fortify-level.patch
    
      255
    
# clang 22 lacks -fsanitize-ignore-for-ubsan-feature, which is needed to use
    
# -fsanitize=array-bounds without triggering UBSan feature detection. Without
    
# feature detection suppression, V8 compiles in __sanitizer_set_death_callback
    
# calls that require the UBSan runtime, which is not linked in a trap-mode
    
# build. Drop the entire sanitize_c_array_bounds cflags block.
    
# Can be dropped when arch has LLVM 23.
    
patch -Np1 -i ../chromium-149-drop-unknown-clang-flag.patch
    
      263
    
# Causes a build failure with our clang version
    
patch -Np1 -i ../chromium-147-revert-clang-no-lifetime-dse-flag.patch
    
      266
    
# https://crbug.com/456218403
    
patch -Np1 -i ../chromium-145-fix-SYS_SECCOMP.patch
    
      269
    
patch -Np1 -i ../chromium-149-build-with-wasm-rollup.patch
    
      271
    
patch -Np1 -i ../chromium-147-rust-1.95-bytemuck.patch
    
      273
    
patch -Np1 -i ../chromium-disable-font-tests.patch
    
      275
    
# https://crbug.com/456677057
    
patch -Np1 -i ../glibc-2.42-baud-rate-fix.patch
    
      278
    
# Chromium bundles a patched minizip with extra features
    
patch -Np1 -i ../chromium-149-unbundle-minizip-undo-unicode.patch
    
      281
    
patch -Np1 -i ../chromium-149-use-of-undeclared-identifier-ERROR.patch
    
      283
    
# Fix issue about missing AR file
    
# Credit: https://github.com/ungoogled-software/ungoogled-chromium/pull/3837
    
patch -Np1 -i ../chromium-150-fix-ar-unbundle.patch
    
      287
    
# Fix issue about missing sysroot path
    
# Credit: https://github.com/ungoogled-software/ungoogled-chromium/pull/3837#issuecomment-4836756738
    
patch -Np1 -i ../chromium-150-fix-sysroot-path-error.patch
    
      291
    
# Fix issue about missing AVX functions
    
# Credit: https://github.com/ungoogled-software/ungoogled-chromium/pull/3837
    
patch -Np1 -i ../chromium-150-revert-avx-flag-change.patch
    
      295
    
# CEF: Remove sysroot requirement for non-x64 builds
    
patch -Np1 -i ../cef-no-sysroot.patch
    
      298
    
# CEF: Remove libxml_visibility patch (fails with system libxml2)
    
patch -Np1 -i ../cef-no-libxml-visibility-patch.patch
    
      301
    
# CEF: Override clang_exe to use system clang
    
echo 'clang_exe = "clang"' >>cef/tools/clang_util.py
    
      304
    
# Link to system tools required by the build
    
mkdir -p third_party/node/linux/node-linux-x64/bin \
    
  third_party/jdk/current/bin \
    
  third_party/rust-toolchain/bin
    
      309
    
ln -s /usr/bin/node third_party/node/linux/node-linux-x64/bin/
    
ln -s /usr/bin/java third_party/jdk/current/bin/
    
      312
    
# the build uses system rust, but CEF checks for it here.
    
ln -s /usr/bin/rustc third_party/rust-toolchain/bin/
    
      315
    
# remove x86_64 binary and use our own
    
rm -f third_party/gperf/cipd/bin/gperf
    
ln -s /usr/bin/gperf third_party/gperf/cipd/bin/
    
      319
    
if ((!_system_clang)); then
    
  # Use prebuilt rust as system rust cannot be used due to the error:
    
  #   error: the option `Z` is only accepted on the nightly compiler
    
  ./tools/rust/update_rust.py
    
      324
    
  # To link to rust libraries we need to compile with prebuilt clang
    
  ./tools/clang/scripts/update.py
    
fi
    
      328
    
# Remove bundled libraries for which we will use the system copies; this
    
# *should* do what the remove_bundled_libraries.py script does, with the
    
# added benefit of not having to list all the remaining libraries
    
local _lib
    
for _lib in ${_unwanted_bundled_libs[@]}; do
    
  find "third_party/$_lib" -type f \
    
    \! -path "third_party/$_lib/chromium/*" \
    
    \! -path "third_party/$_lib/google/*" \
    
    \! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
    
    \! -regex '.*\.\(gn\|gni\|isolate\)' \
    
    -delete
    
done
    
      341
    
./build/linux/unbundle/replace_gn_files.py \
    
  --system-libraries "${!_system_libs[@]}"
    
      344
    
# check if the right chromium version is available.
    
local _expected_chromium_ver=$(grep -oP "refs/tags/\K[0-9.]+" cef/CHROMIUM_BUILD_COMPATIBILITY.txt)
    
if [[ "$_expected_chromium_ver" != "$_chromium_ver" ]]; then
    
  echo "Error: CEF expects chromium $_expected_chromium_ver, but $_chromium_ver was set in PKGBUILD" >&2
    
  exit 1
    
fi
    
      351}
    
      352
    
      353pkgver() {
    
cd chromium-$_chromium_ver
    
      355
    
# python tool to get the full CEF version. For the full output, look at
    
# /usr/include/cef/include/cef_version.h in the built package.
    
python cef/tools/make_version_header.py cef_version_header
    
grep -oP 'CEF_VERSION "\K[^"]+' cef_version_header | sed -E 's/\+.*//'
    
      360}
    
      361
    
      362build() {
    
cd chromium-$_chromium_ver
    
      364
    
if ((_system_clang)); then
    
  export CC=clang
    
  export CXX=clang++
    
  export AR=ar
    
  export NM=nm
    
else
    
  local _clang_path="$PWD/third_party/llvm-build/Release+Asserts/bin"
    
  export CC=$_clang_path/clang
    
  export CXX=$_clang_path/clang++
    
  export AR=$_clang_path/llvm-ar
    
  export NM=$_clang_path/llvm-nm
    
fi
    
      377
    
# Add depot_tools to PATH (needed by CEF's gclient_hook.py)
    
export PATH="$PATH:$PWD/third_party/depot_tools"
    
      380
    
# Use system ninja, remove the wrapper which only supports x86_64
    
rm -f third_party/depot_tools/ninja
    
      383
    
# GN defines passed to CEF's gclient_hook.py via GN_DEFINES env var
    
local _flags=(
    
  'custom_toolchain="//build/toolchain/linux/unbundle:default"'
    
  'host_toolchain="//build/toolchain/linux/unbundle:default"'
    
  'is_official_build=true' # implies is_cfi=true on x86_64
    
  'symbol_level=0'         # sufficient for backtraces on x86(_64)
    
  'treat_warnings_as_errors=false'
    
  'fatal_linker_warnings=false'
    
  'disable_fieldtrial_testing_config=true'
    
  'blink_enable_generated_code_formatting=false'
    
  'ffmpeg_branding="Chrome"'
    
  'proprietary_codecs=true'
    
  'rtc_use_pipewire=true'
    
  'link_pulseaudio=true'
    
  'use_custom_libcxx=true' # https://github.com/llvm/llvm-project/issues/61705
    
  'use_sysroot=false'
    
  'use_system_libffi=true'
    
  'use_qt5=false'
    
  'use_qt6=false'
    
  'use_gtk=false'
    
  'use_cups=false'
    
  'use_gio=false'
    
  'use_kerberos=false'
    
  'use_libpci=false'
    
  'use_udev=true'
    
  'cef_use_gtk=false'
    
  'enable_remoting=false'
    
  'use_vaapi=true'
    
  'use_clang_modules=false'
    
  'devtools_bundle=false'
    
)
    
      415
    
if [[ -n ${_system_libs[icu]+set} ]]; then
    
  _flags+=('icu_use_data_file=false')
    
fi
    
      419
    
if ((_system_clang)); then
    
  local _clang_version=$(
    
    clang --version | grep -m1 version | sed 's/.* \([0-9]\+\).*/\1/'
    
  )
    
      424
    
  _flags+=(
    
    'clang_base_path="/usr"'
    
    'clang_use_chrome_plugins=false'
    
    "clang_version=\"$_clang_version\""
    
    'chrome_pgo_phase=0' # needs newer clang to read the bundled PGO profile
    
  )
    
      431
    
  # Allow the use of nightly features with stable Rust compiler
    
  # https://github.com/ungoogled-software/ungoogled-chromium/pull/2696#issuecomment-1918173198
    
  export RUSTC_BOOTSTRAP=1
    
      435
    
  _flags+=(
    
    'rust_sysroot_absolute="/usr"'
    
    'rust_bindgen_root="/usr"'
    
    "rustc_version=\"$(rustc --version | awk '{ print $2 ;}')\""
    
  )
    
fi
    
      442
    
_validate_cef_vaapi_invariants
    
      444
    
export GN_DEFINES="${_flags[*]}"
    
# Only build Release config
    
export GN_OUT_CONFIGS="Release_GN_x64"
    
      448
    
# Facilitate deterministic builds (taken from build/config/compiler/BUILD.gn)
    
CFLAGS+='   -Wno-builtin-macro-redefined'
    
CXXFLAGS+=' -Wno-builtin-macro-redefined'
    
CPPFLAGS+=' -D__DATE__=  -D__TIME__=  -D__TIMESTAMP__='
    
      453
    
# Do not warn about unknown warning options
    
CFLAGS+='   -Wno-unknown-warning-option'
    
CXXFLAGS+=' -Wno-unknown-warning-option'
    
      457
    
# Let Chromium set its own symbol level
    
CFLAGS=${CFLAGS/-g /}
    
CXXFLAGS=${CXXFLAGS/-g /}
    
      461
    
# https://github.com/ungoogled-software/ungoogled-chromium-archlinux/issues/123
    
CFLAGS=${CFLAGS/-fexceptions/}
    
CFLAGS=${CFLAGS/-fcf-protection/}
    
CXXFLAGS=${CXXFLAGS/-fexceptions/}
    
CXXFLAGS=${CXXFLAGS/-fcf-protection/}
    
      467
    
# This appears to cause random segfaults when combined with ThinLTO
    
# https://bugs.archlinux.org/task/73518
    
CFLAGS=${CFLAGS/-fstack-clash-protection/}
    
CXXFLAGS=${CXXFLAGS/-fstack-clash-protection/}
    
      472
    
# https://crbug.com/957519#c122
    
CXXFLAGS=${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}
    
      475
    
python3 cef/tools/gclient_hook.py
    
sed -i '/__sanitizer_set_death_callback/d' v8/src/sandbox/testing.cc
    
ninja -C out/Release_GN_x64 libcef chrome_sandbox
    
      479
    
# Build the CEF binary distribution
    
python3 cef/tools/make_distrib.py \
    
  --distrib-subdir=distrib \
    
  --output-dir=.. \
    
  --ninja-build \
    
  --x64-build \
    
  --minimal \
    
  --no-docs \
    
  --no-archive
    
      489}
    
      490
    
      491package() {
    
cd distrib_minimal
    
      493
    
install -d "$pkgdir/usr/lib/cef/"
    
cp -r Release/* "$pkgdir/usr/lib/cef/"
    
install -Dvm4755 Release/chrome-sandbox "$pkgdir/usr/lib/cef/chrome-sandbox"
    
cp -r Resources/* "$pkgdir/usr/lib/cef/"
    
      498
    
# Headers
    
install -d "$pkgdir/usr/include/cef"
    
cp -a "include" "$pkgdir/usr/include/cef/"
    
      502
    
# libcef_dll wrapper source
    
install -d "$pkgdir/usr/src/cef"
    
cp -a "libcef_dll" "$pkgdir/usr/src/cef/"
    
      506
    
# Remove include file targets, since includes are in a different path
    
sed -i -e '/\.\.\/include/d' "$pkgdir/usr/src/cef/libcef_dll/CMakeLists.txt"
    
      509
    
# The FindCEF.cmake from CEF expects one unified directory.
    
# We provide a custom FindCEF.cmake that looks in the right places.
    
# Copied from https://src.fedoraproject.org/rpms/cef/blob/rawhide/f/FindCEF.cmake (thanks Fedora!)
    
install -Dm644 "$srcdir/FindCEF.cmake" -t "$pkgdir/usr/share/cmake/Modules/"
    
      514
    
install -Dm644 LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE-CEF"
    
install -Dm644 ../chromium-$_chromium_ver/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE-CHROMIUM"
    
      517}
    
      518
    
      519# vim:set ts=2 sw=2 et:
    
      520

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,12 +9,12 @@
 # To update this package, update the _cef_commit and _chromium_ver variables.
 # For the CEF versioning scheme, see
 # https://chromiumembedded.github.io/cef/branches_and_building#version-number-format
-pkgver=150.0.14
+pkgver=150.0.17
 # See https://github.com/chromiumembedded/cef/tree/<release branch>
 # Also see https://chromiumembedded.github.io/cef/branches_and_building
-_cef_commit=7c1aa68455db1f1fad159c2b83070ad318212b3d
+_cef_commit=94c17267eb4595a1ad17fb67dee6cdb8ded41c6d
 # the chromium version must match CHROMIUM_BUILD_COMPATIBILITY.txt in the CEF repo
-_chromium_ver=150.0.7871.129
+_chromium_ver=150.0.7871.187
 _system_clang=1
 pkgrel=1
 pkgdesc="Chromium Embedded Framework (CEF), simple framework for embedding Chromium-based browsers in other applications (VAAPI-enabled variant)"
@@ -89,8 +89,8 @@
   chromium-disable-font-tests.patch
   FindCEF.cmake
 )
-sha256sums=('851ced572bf2dc41c1afaad4a64975f6b6aa2d9d6a7fafc4cb2484ca09067aaa'
-            '85878445be27590f372e3628384b8f2d2a89eac51712d46ed8e8c9e1007c23c3'
+sha256sums=('63e1e8b3c40d1c9b51c55d27356f6d6b074e5c7f210e776290b1ef6d290a7df1'
+            'ec791113ae4a8d93ef9d7dd06b60e55990a5f7561575e890af5b53c793f7eab8'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'
             'c382830318c5b37826ecf44f3ba9def6be8affdad1bce819ecb83f3222ff4b3a'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 07:14:03	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 07:16:26	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2