cef-vaapi

LOW

maintainer bnema 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source uses a Chromium tarball from Google's official storage domain, which is a legitimate and expected source for this package; the non-whitelisted host is a false alarm as commondatastorage.googleapis.com is part of Google Cloud Platform used by Chromium projects.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source uses a Chromium tarball from Google's official storage domain, which is a legitimate and expected source for this package; the non-whitelisted host is a false alarm as commondatastorage.googleapis.com is part of Google Cloud Platform used by Chromium projects.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:72 source=("chromium-$_chromium_ver-lite.tar.xz::https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$_chromium_ver-lite.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christian Heusel <gromit@archlinux.org>
    
      2# Maintainer: Jonathan Grotelüschen <tippfehlr@archlinux.org>
    
      3# Contributor: Sven-Hendrik Haase <svenstaro@archlinux.org>
    
      4
    
      5# Note: This PKGBUILD and the chromium PKGBUILD are loosely kept in sync to ease maintenance.
    
      6# As such care should be taken to minimize the differences between these PKGBUILDs.
    
      7pkgname=cef-vaapi
    
      8# pkgver is updated automatically.
    
      9# To update this package, update the _cef_commit and _chromium_ver variables.
    
      10# For the CEF versioning scheme, see
    
      11# https://chromiumembedded.github.io/cef/branches_and_building#version-number-format
    
      12pkgver=152.0.6
    
      13# See https://github.com/chromiumembedded/cef/tree/<release branch>
    
      14# Also see https://chromiumembedded.github.io/cef/branches_and_building
    
      15_cef_commit=708dc140cbc3286826a8abef89dc23a44ff9ea72
    
      16# the chromium version must match CHROMIUM_BUILD_COMPATIBILITY.txt in the CEF repo
    
      17_chromium_ver=152.0.7977.83
    
      18_system_clang=1
    
      19pkgrel=1
    
      20pkgdesc="Chromium Embedded Framework (CEF), simple framework for embedding Chromium-based browsers in other applications (VAAPI-enabled variant)"
    
      21provides=("cef=$pkgver")  # provides="cef=$pkgver"
    
      22conflicts=('cef')  # conflicts='cef'
    
      23arch=('x86_64')
    
      24url="https://chromiumembedded.github.io/cef"
    
      25license=('BSD-3-Clause')
    
      26depends=(
    
'alsa-lib'
    
'at-spi2-core'
    
'dbus'
    
'libdrm'
    
'libffi'
    
'libpulse'
    
'libxcomposite'
    
'libxdamage'
    
'libxkbcommon'
    
'libxrandr'
    
'mesa'
    
'nss'
    
'pango'
    
'systemd-libs'
    
'libva'
    
      42)
    
      43optdepends=(
    
'libva-mesa-driver: VAAPI driver for AMD GPUs'
    
'intel-media-driver: VAAPI driver for modern Intel GPUs'
    
'libva-utils: VAAPI diagnostics such as vainfo'
    
      47)
    
      48
    
      49makedepends=(
    
'clang'
    
'compiler-rt'
    
'git'
    
'gn'
    
'go'
    
'gperf'
    
'java-runtime-headless'
    
'lld'
    
'ninja'
    
'nodejs'
    
'npm'
    
'pipewire'
    
'python'
    
'python-httplib2'
    
'python-pyparsing'
    
'python-six'
    
'rsync'
    
'rust'
    
'rust-bindgen'
    
'libxtst'
    
      70)
    
      71options=('!lto') # Chromium adds its own flags for ThinLTO
    
      72source=("chromium-$_chromium_ver-lite.tar.xz::https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$_chromium_ver-lite.tar.xz"
    
"cef::git+https://github.com/chromiumembedded/cef.git#commit=${_cef_commit}"
    
chromium-138-nodejs-version-check.patch
    
chromium-145-fix-SYS_SECCOMP.patch
    
chromium-147-revert-clang-no-lifetime-dse-flag.patch
    
chromium-147-rust-1.95-bytemuck.patch
    
chromium-149-drop-unknown-clang-flag.patch
    
chromium-149-use-of-undeclared-identifier-ERROR.patch
    
chromium-149-build-with-wasm-rollup.patch
    
chromium-150-revert-avx-flag-change.patch
    
chromium-152-crubit.patch
    
chromium-152-dawn-llvm-22.patch
    
chromium-152-fix-gn-no-public_inputs.patch
    
chromium-152-unbundle-minizip-undo-unicode.patch
    
chromium-152-unbundle-opus-devtools.patch
    
compiler-rt-adjust-paths.patch
    
increase-fortify-level.patch
    
glibc-2.42-baud-rate-fix.patch
    
cef-no-sysroot.patch
    
cef-no-libxml-visibility-patch.patch
    
chromium-disable-font-tests.patch
    
FindCEF.cmake
    
      94)
    
      95sha256sums=('ba910f09b487b076f79fa8badfa0cefd130cc50fcae88d61a7d92ee2d9665ad2'
    
          'a9470d579bb7be8fcee09bbbbf989c3c4c273a5e034c7f599f868d140db7d1be'
    
          '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
    
          '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'
    
          'c382830318c5b37826ecf44f3ba9def6be8affdad1bce819ecb83f3222ff4b3a'
    
          'b9e6339221efe03540ffb360c161d93604a1fc93a5a1c53e5e9849066f987d05'
    
          'e25cf8fb60f5958127053c515b8decc2b45acceebf9a57654066d093df11f8e9'
    
          '951514535be65f0e2f84e82305d96292be1da353c1427ba1048ea24be70003c4'
    
          'c4df27d25d298ac95d85e6f06b558b73bb67de5110a19a0228cb7f8519291ea5'
    
          '5f6ccb7b945c8a13c690493723bad816b36f2f25792d47e677b56f8200907e60'
    
          '6cf0b76bc5d9c9bb82ecde1fa87ed1f4380b4bbd29ea485261e5f2aada5d71ea'
    
          '5e465d199c1a28d58078af08bcab151561d6423f43c6dba57d4db3f5de534140'
    
          '5c4640a211d02ba8249299842ea2999ccc239d85bfd59a0f7c302483683adc07'
    
          '890e5d98088ef1c7c075a551442f03385d1db266cad8a65576704a22720683f9'
    
          '3276453f2ce655b6286476f48d4df837be952d9447afa46583f79ec71f2288c3'
    
          'ec8e49b7114e2fa2d359155c9ef722ff1ba5fe2c518fa48e30863d71d3b82863'
    
          'd634d2ce1fc63da7ac41f432b1e84c59b7cceabf19d510848a7cff40c8025342'
    
          '1c1898f263eaacbc069a8e1a3e732852350350d1dad4cb1a6bba430e3b796cd0'
    
          'cdc046c3da5a57dae8fba0de49cadbe65d4f8fbfffb172f7a768222232595faa'
    
          '6695d7bcac489f74b8290a05dac540c2b5c5fed997ee119ae05419d36509445d'
    
          '44dcc0da55a8c6c6af875addcfb9c552c722b56a31479eb7d99f16d0a27f4ebb'
    
          'e576250c4d0f3dd307bd22c6d4f9f7aba54fdf4d5899520c0bd1c3527aec65ed')
    
      117
    
      118# Possible replacements are listed in build/linux/unbundle/replace_gn_files.py
    
      119# Keys are the names in the above script; values are the dependencies in Arch
    
      120declare -gA _system_libs=(
    
[brotli]=brotli
    
[dav1d]=dav1d
    
#[ffmpeg]=ffmpeg    # YouTube playback stopped working in Chromium 120
    
[flac]=flac
    
[fontconfig]=fontconfig
    
[freetype]=freetype2
    
[harfbuzz]=harfbuzz
    
#[icu]=icu
    
#[jsoncpp]=jsoncpp  # needs libstdc++
    
#[libaom]=aom
    
#[libavif]=libavif  # needs -DAVIF_ENABLE_EXPERIMENTAL_GAIN_MAP=ON
    
[libdrm]=libdrm
    
[libjpeg]=libjpeg-turbo
    
# [libpng]=libpng
    
#[libvpx]=libvpx
    
[libwebp]=libwebp
    
[libxml]=libxml2
    
[libxslt]=libxslt
    
[openh264]=openh264
    
[opus]=opus
    
#[re2]=re2          # needs libstdc++
    
#[snappy]=snappy    # needs libstdc++
    
#[woff2]=woff2      # needs libstdc++
    
[zlib]=minizip
    
[zstd]=zstd
    
      146)
    
      147_unwanted_bundled_libs=(
    
$(printf "%s\n" ${!_system_libs[@]} | sed 's/^libjpeg$/&_turbo/')
    
      149)
    
      150depends+=(${_system_libs[@]})
    
      151
    
      152_validate_cef_vaapi_invariants() {
    
local _pkgbuild="${BASH_SOURCE[0]}"
    
local _required_flags=(
    
  'ffmpeg_branding="Chrome"'
    
  'proprietary_codecs=true'
    
  'rtc_use_pipewire=true'
    
  'link_pulseaudio=true'
    
  'use_vaapi=true'
    
)
    
local _flag _actual _flag_ok
    
for _flag in "${_required_flags[@]}"; do
    
  _flag_ok=0
    
  for _actual in "${_flags[@]}"; do
    
    if [[ "$_actual" == "$_flag" ]]; then
    
      _flag_ok=1
    
      break
    
    fi
    
  done
    
  if (( ! _flag_ok )); then
    
    echo "ERROR: required GN flag missing or changed: ${_flag}" >&2
    
    exit 1
    
  fi
    
done
    
      175
    
if grep -Eq '^[[:space:]]*\[ffmpeg\]=' "$_pkgbuild"; then
    
  echo "ERROR: _system_libs[ffmpeg] must stay commented or absent" >&2
    
  exit 1
    
fi
    
      180
    
local _source_ok=0 _s
    
for _s in "${source[@]}"; do
    
  if [[ "$_s" == cef::git+https://github.com/chromiumembedded/cef.git* ]]; then
    
    _source_ok=1
    
    break
    
  fi
    
done
    
if (( ! _source_ok )); then
    
  echo "ERROR: source must use cef::git+https://github.com/chromiumembedded/cef.git" >&2
    
  exit 1
    
fi
    
      192
    
local _provides_ok=0 _p
    
for _p in "${provides[@]}"; do
    
  if [[ "$_p" == cef=* ]]; then
    
    _provides_ok=1
    
    break
    
  fi
    
done
    
if (( ! _provides_ok )); then
    
  echo "ERROR: provides must include cef=\$pkgver" >&2
    
  exit 1
    
fi
    
      204
    
local _conflicts_ok=0 _c
    
for _c in "${conflicts[@]}"; do
    
  if [[ "$_c" == cef ]]; then
    
    _conflicts_ok=1
    
    break
    
  fi
    
done
    
if (( ! _conflicts_ok )); then
    
  echo "ERROR: conflicts must include cef" >&2
    
  exit 1
    
fi
    
      216
    
if declare -p replaces >/dev/null 2>&1 && (( ${#replaces[@]} > 0 )); then
    
  echo "ERROR: replaces must not be set" >&2
    
  exit 1
    
fi
    
      221
    
local _libva_ok=0 _d
    
for _d in "${depends[@]}"; do
    
  if [[ "$_d" == libva ]]; then
    
    _libva_ok=1
    
    break
    
  fi
    
done
    
if (( ! _libva_ok )); then
    
  echo "ERROR: depends must include libva" >&2
    
  exit 1
    
fi
    
      233}
    
      234
    
      235prepare() {
    
cd chromium-$_chromium_ver
    
      237
    
# Move CEF into the chromium source tree
    
mv "$srcdir/cef" cef
    
      240
    
# Allow building against system libraries in official builds
    
sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' \
    
  tools/generate_shim_headers/generate_shim_headers.py
    
      244
    
# https://crbug.com/893950
    
sed -i -e 's/\<xmlMalloc\>/malloc/' -e 's/\<xmlFree\>/free/' \
    
  -e '1i #include <cstdlib>' \
    
  third_party/blink/renderer/core/xml/*.cc \
    
  third_party/blink/renderer/core/xml/parser/xml_document_parser.cc \
    
  third_party/libxml/chromium/*.cc
    
      251
    
# Fixes from Gentoo
    
patch -Np1 -i ../chromium-138-nodejs-version-check.patch
    
      254
    
# Allow libclang_rt.builtins from compiler-rt >= 16 to be used
    
patch -Np1 -i ../compiler-rt-adjust-paths.patch
    
      257
    
# Increase _FORTIFY_SOURCE level to match Arch's default flags
    
patch -Np1 -i ../increase-fortify-level.patch
    
      260
    
# clang 22 lacks -fsanitize-ignore-for-ubsan-feature, which is needed to use
    
# -fsanitize=array-bounds without triggering UBSan feature detection. Without
    
# feature detection suppression, V8 compiles in __sanitizer_set_death_callback
    
# calls that require the UBSan runtime, which is not linked in a trap-mode
    
# build. Drop the entire sanitize_c_array_bounds cflags block.
    
# Can be dropped when arch has LLVM 23.
    
patch -Np1 -i ../chromium-149-drop-unknown-clang-flag.patch
    
      268
    
# Causes a build failure with our clang version
    
patch -Np1 -i ../chromium-147-revert-clang-no-lifetime-dse-flag.patch
    
      271
    
# https://crbug.com/456218403
    
patch -Np1 -i ../chromium-145-fix-SYS_SECCOMP.patch
    
      274
    
patch -Np1 -i ../chromium-149-build-with-wasm-rollup.patch
    
      276
    
patch -Np1 -i ../chromium-147-rust-1.95-bytemuck.patch
    
      278
    
patch -Np1 -i ../chromium-disable-font-tests.patch
    
      280
    
# https://crbug.com/456677057
    
patch -Np1 -i ../glibc-2.42-baud-rate-fix.patch
    
      283
    
patch -Np1 -i ../chromium-149-use-of-undeclared-identifier-ERROR.patch
    
      285
    
# Fix issue about missing AVX functions
    
# Credit: https://github.com/ungoogled-software/ungoogled-chromium/pull/3837
    
patch -Np1 -i ../chromium-150-revert-avx-flag-change.patch
    
      289
    
patch -Np1 -i ../chromium-152-crubit.patch
    
      291
    
patch -Np1 -i ../chromium-152-dawn-llvm-22.patch
    
      293
    
# Just the reverted commit 8dab8b761385b7946588232e4e2a8c116f9293c3
    
patch -Np1 -i "$srcdir/chromium-152-fix-gn-no-public_inputs.patch" -d third_party/devtools-frontend/src
    
      296
    
patch -Np1 -i ../chromium-152-unbundle-minizip-undo-unicode.patch
    
      298
    
patch -Np1 -i ../chromium-152-unbundle-opus-devtools.patch
    
      300
    
# CEF: Remove sysroot requirement for non-x64 builds
    
patch -Np1 -i ../cef-no-sysroot.patch
    
      303
    
# CEF: Remove libxml_visibility patch (fails with system libxml2)
    
patch -Np1 -i ../cef-no-libxml-visibility-patch.patch
    
      306
    
# CEF: Override clang_exe to use system clang
    
echo 'clang_exe = "clang"' >>cef/tools/clang_util.py
    
      309
    
# Link to system tools required by the build
    
mkdir -p \
    
  third_party/node/linux/node-linux-x64/bin \
    
  third_party/node/linux/node-linux-arm64/bin \
    
  third_party/jdk/current/bin \
    
  third_party/rust-toolchain/bin \
    
  third_party/dawn/tools/golang/linux-amd64/bin \
    
  third_party/dawn/tools/golang/linux-arm64/bin
    
      318
    
ln -s /usr/bin/node third_party/node/linux/node-linux-x64/bin/
    
ln -s /usr/bin/node third_party/node/linux/node-linux-arm64/bin/
    
ln -s /usr/bin/java third_party/jdk/current/bin/
    
ln -s /usr/bin/rustc third_party/rust-toolchain/bin/
    
ln -s /usr/bin/go third_party/dawn/tools/golang/linux-amd64/bin/
    
ln -s /usr/bin/go third_party/dawn/tools/golang/linux-arm64/bin/
    
      325
    
# remove x86_64 binary and use our own
    
rm -f third_party/gperf/cipd/bin/gperf
    
ln -s /usr/bin/gperf third_party/gperf/cipd/bin/
    
      329
    
if ((!_system_clang)); then
    
  # Use prebuilt rust as system rust cannot be used due to the error:
    
  #   error: the option `Z` is only accepted on the nightly compiler
    
  ./tools/rust/update_rust.py
    
      334
    
  # To link to rust libraries we need to compile with prebuilt clang
    
  ./tools/clang/scripts/update.py
    
fi
    
      338
    
# Remove bundled libraries for which we will use the system copies; this
    
# *should* do what the remove_bundled_libraries.py script does, with the
    
# added benefit of not having to list all the remaining libraries
    
local _lib
    
for _lib in ${_unwanted_bundled_libs[@]}; do
    
  find "third_party/$_lib" -type f \
    
    \! -path "third_party/$_lib/chromium/*" \
    
    \! -path "third_party/$_lib/google/*" \
    
    \! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
    
    \! -regex '.*\.\(gn\|gni\|isolate\)' \
    
    -delete
    
done
    
      351
    
./build/linux/unbundle/replace_gn_files.py \
    
  --system-libraries "${!_system_libs[@]}"
    
      354
    
# check if the right chromium version is available.
    
local _expected_chromium_ver=$(grep -oP "refs/tags/\K[0-9.]+" cef/CHROMIUM_BUILD_COMPATIBILITY.txt)
    
if [[ "$_expected_chromium_ver" != "$_chromium_ver" ]]; then
    
  echo "Error: CEF expects chromium $_expected_chromium_ver, but $_chromium_ver was set in PKGBUILD" >&2
    
  exit 1
    
fi
    
      361}
    
      362
    
      363pkgver() {
    
cd chromium-$_chromium_ver
    
      365
    
# python tool to get the full CEF version. For the full output, look at
    
# /usr/include/cef/include/cef_version.h in the built package.
    
python cef/tools/make_version_header.py cef_version_header
    
grep -oP 'CEF_VERSION "\K[^"]+' cef_version_header | sed -E 's/\+.*//'
    
      370}
    
      371
    
      372build() {
    
cd chromium-$_chromium_ver
    
      374
    
if ((_system_clang)); then
    
  export CC=clang
    
  export CXX=clang++
    
  export AR=ar
    
  export NM=nm
    
else
    
  local _clang_path="$PWD/third_party/llvm-build/Release+Asserts/bin"
    
  export CC=$_clang_path/clang
    
  export CXX=$_clang_path/clang++
    
  export AR=$_clang_path/llvm-ar
    
  export NM=$_clang_path/llvm-nm
    
fi
    
      387
    
# Add depot_tools to PATH (needed by CEF's gclient_hook.py)
    
export PATH="$PATH:$PWD/third_party/depot_tools"
    
      390
    
# Use system ninja, remove the wrapper which only supports x86_64
    
rm -f third_party/depot_tools/ninja
    
      393
    
# GN defines passed to CEF's gclient_hook.py via GN_DEFINES env var
    
local _flags=(
    
  'custom_toolchain="//build/toolchain/linux/unbundle:default"'
    
  'host_toolchain="//build/toolchain/linux/unbundle:default"'
    
  'is_official_build=true' # implies is_cfi=true on x86_64
    
  'symbol_level=0'         # sufficient for backtraces on x86(_64)
    
  'treat_warnings_as_errors=false'
    
  'fatal_linker_warnings=false'
    
  'disable_fieldtrial_testing_config=true'
    
  'blink_enable_generated_code_formatting=false'
    
  'ffmpeg_branding="Chrome"'
    
  'proprietary_codecs=true'
    
  'rtc_use_pipewire=true'
    
  'link_pulseaudio=true'
    
  'use_custom_libcxx=true' # https://github.com/llvm/llvm-project/issues/61705
    
  'use_sysroot=false'
    
  'use_system_libffi=true'
    
  'use_qt5=false'
    
  'use_qt6=false'
    
  'use_gtk=false'
    
  'use_cups=false'
    
  'use_gio=false'
    
  'use_kerberos=false'
    
  'use_libpci=false'
    
  'use_udev=true'
    
  'cef_use_gtk=false'
    
  'enable_remoting=false'
    
  'use_vaapi=true'
    
  'use_clang_modules=false'
    
  'devtools_bundle=false'
    
)
    
      425
    
if [[ -n ${_system_libs[icu]+set} ]]; then
    
  _flags+=('icu_use_data_file=false')
    
fi
    
      429
    
if ((_system_clang)); then
    
  local _clang_version=$(
    
    clang --version | grep -m1 version | sed 's/.* \([0-9]\+\).*/\1/'
    
  )
    
      434
    
  _flags+=(
    
    'clang_base_path="/usr"'
    
    'clang_use_chrome_plugins=false'
    
    "clang_version=\"$_clang_version\""
    
    'chrome_pgo_phase=0' # needs newer clang to read the bundled PGO profile
    
  )
    
      441
    
  # Allow the use of nightly features with stable Rust compiler
    
  # https://github.com/ungoogled-software/ungoogled-chromium/pull/2696#issuecomment-1918173198
    
  export RUSTC_BOOTSTRAP=1
    
      445
    
  _flags+=(
    
    'rust_sysroot_absolute="/usr"'
    
    'rust_bindgen_root="/usr"'
    
    "rustc_version=\"$(rustc --version | awk '{ print $2 ;}')\""
    
  )
    
fi
    
      452
    
_validate_cef_vaapi_invariants
    
      454
    
export GN_DEFINES="${_flags[*]}"
    
# Only build Release config
    
if [[ $CARCH == "aarch64" ]]; then
    
  export GN_DEFINES+=' target_cpu="arm64"'
    
  export GN_OUT_CONFIGS="Release_GN_arm64"
    
else
    
  export GN_OUT_CONFIGS="Release_GN_x64"
    
fi
    
      463
    
# Facilitate deterministic builds (taken from build/config/compiler/BUILD.gn)
    
CFLAGS+='   -Wno-builtin-macro-redefined'
    
CXXFLAGS+=' -Wno-builtin-macro-redefined'
    
CPPFLAGS+=' -D__DATE__=  -D__TIME__=  -D__TIMESTAMP__='
    
      468
    
# Do not warn about unknown warning options
    
CFLAGS+='   -Wno-unknown-warning-option'
    
CXXFLAGS+=' -Wno-unknown-warning-option'
    
      472
    
# Let Chromium set its own symbol level
    
CFLAGS=${CFLAGS/-g /}
    
CXXFLAGS=${CXXFLAGS/-g /}
    
      476
    
# https://github.com/ungoogled-software/ungoogled-chromium-archlinux/issues/123
    
CFLAGS=${CFLAGS/-fexceptions/}
    
CFLAGS=${CFLAGS/-fcf-protection/}
    
CXXFLAGS=${CXXFLAGS/-fexceptions/}
    
CXXFLAGS=${CXXFLAGS/-fcf-protection/}
    
      482
    
# This appears to cause random segfaults when combined with ThinLTO
    
# https://bugs.archlinux.org/task/73518
    
CFLAGS=${CFLAGS/-fstack-clash-protection/}
    
CXXFLAGS=${CXXFLAGS/-fstack-clash-protection/}
    
      487
    
# https://crbug.com/957519#c122
    
CXXFLAGS=${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}
    
      490
    
# aarch64: strip -march= as chromium sub-targets need their own arch flags
    
if [[ $CARCH == "aarch64" ]]; then
    
  CFLAGS="${CFLAGS/-march=*([^ ]) }"
    
  CXXFLAGS="${CXXFLAGS/-march=*([^ ]) }"
    
fi
    
      496
    
python3 cef/tools/gclient_hook.py
    
sed -i '/__sanitizer_set_death_callback/d' v8/src/sandbox/testing.cc
    
      499
    
if [[ $CARCH == "aarch64" ]]; then
    
  ninja -C out/Release_GN_arm64 libcef chrome_sandbox
    
else
    
  ninja -C out/Release_GN_x64 libcef chrome_sandbox
    
fi
    
      505
    
# Build the CEF binary distribution
    
if [[ $CARCH == "aarch64" ]]; then
    
  local _distrib_arch_flag="--arm64-build"
    
else
    
  local _distrib_arch_flag="--x64-build"
    
fi
    
      512
    
python3 cef/tools/make_distrib.py \
    
  --distrib-subdir=distrib \
    
  --output-dir=.. \
    
  --ninja-build \
    
  $_distrib_arch_flag \
    
  --minimal \
    
  --no-docs \
    
  --no-archive
    
      521}
    
      522
    
      523package() {
    
cd distrib_minimal
    
      525
    
install -d "$pkgdir/usr/lib/cef/"
    
cp -r Release/* "$pkgdir/usr/lib/cef/"
    
install -Dvm4755 Release/chrome-sandbox "$pkgdir/usr/lib/cef/chrome-sandbox"
    
cp -r Resources/* "$pkgdir/usr/lib/cef/"
    
      530
    
# Headers
    
install -d "$pkgdir/usr/include/cef"
    
cp -a "include" "$pkgdir/usr/include/cef/"
    
      534
    
# libcef_dll wrapper source
    
install -d "$pkgdir/usr/src/cef"
    
cp -a "libcef_dll" "$pkgdir/usr/src/cef/"
    
      538
    
# Remove include file targets, since includes are in a different path
    
sed -i -e '/\.\.\/include/d' "$pkgdir/usr/src/cef/libcef_dll/CMakeLists.txt"
    
      541
    
# The FindCEF.cmake from CEF expects one unified directory.
    
# We provide a custom FindCEF.cmake that looks in the right places.
    
# Copied from https://src.fedoraproject.org/rpms/cef/blob/rawhide/f/FindCEF.cmake (thanks Fedora!)
    
install -Dm644 "$srcdir/FindCEF.cmake" -t "$pkgdir/usr/share/cmake/Modules/"
    
      546
    
install -Dm644 LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE-CEF"
    
install -Dm644 ../chromium-$_chromium_ver/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE-CHROMIUM"
    
      549}
    
      550
    
      551# vim:set ts=2 sw=2 et:
    
      552

Changes since previous scan

--- PKGBUILD @ 2026-09-11 00:19
+++ PKGBUILD @ 2026-09-17 00:27
@@ -9,12 +9,12 @@
 # To update this package, update the _cef_commit and _chromium_ver variables.
 # For the CEF versioning scheme, see
 # https://chromiumembedded.github.io/cef/branches_and_building#version-number-format
-pkgver=151.3.24
+pkgver=152.0.6
 # See https://github.com/chromiumembedded/cef/tree/<release branch>
 # Also see https://chromiumembedded.github.io/cef/branches_and_building
-_cef_commit=2384915b7b1f0fe5ad1107e48d80c34e86b698d7
+_cef_commit=708dc140cbc3286826a8abef89dc23a44ff9ea72
 # the chromium version must match CHROMIUM_BUILD_COMPATIBILITY.txt in the CEF repo
-_chromium_ver=151.0.7922.174
+_chromium_ver=152.0.7977.83
 _system_clang=1
 pkgrel=1
 pkgdesc="Chromium Embedded Framework (CEF), simple framework for embedding Chromium-based browsers in other applications (VAAPI-enabled variant)"
@@ -76,11 +76,14 @@
   chromium-147-revert-clang-no-lifetime-dse-flag.patch
   chromium-147-rust-1.95-bytemuck.patch
   chromium-149-drop-unknown-clang-flag.patch
-  chromium-149-unbundle-minizip-undo-unicode.patch
   chromium-149-use-of-undeclared-identifier-ERROR.patch
   chromium-149-build-with-wasm-rollup.patch
   chromium-150-revert-avx-flag-change.patch
-  chromium-151-dont-depends-on-histograms.xml-if-it-is-not-git-checkout.patch
+  chromium-152-crubit.patch
+  chromium-152-dawn-llvm-22.patch
+  chromium-152-fix-gn-no-public_inputs.patch
+  chromium-152-unbundle-minizip-undo-unicode.patch
+  chromium-152-unbundle-opus-devtools.patch
   compiler-rt-adjust-paths.patch
   increase-fortify-level.patch
   glibc-2.42-baud-rate-fix.patch
@@ -89,18 +92,21 @@
   chromium-disable-font-tests.patch
   FindCEF.cmake
 )
-sha256sums=('054ebe79d7235dfaaca063fc6ea32dbaa74b8cd3b915f1edbe622d740908f5fe'
-            '2129393a400da2b56aa566a178ec6931d3ff2540812f8a4f07586498d2f995fb'
+sha256sums=('ba910f09b487b076f79fa8badfa0cefd130cc50fcae88d61a7d92ee2d9665ad2'
+            'a9470d579bb7be8fcee09bbbbf989c3c4c273a5e034c7f599f868d140db7d1be'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'
             'c382830318c5b37826ecf44f3ba9def6be8affdad1bce819ecb83f3222ff4b3a'
             'b9e6339221efe03540ffb360c161d93604a1fc93a5a1c53e5e9849066f987d05'
             'e25cf8fb60f5958127053c515b8decc2b45acceebf9a57654066d093df11f8e9'
-            'c22338d13f12772cdbcb5cfc1ace94438b9f9c72353cdb165a3ff3ef3d677c78'
             '951514535be65f0e2f84e82305d96292be1da353c1427ba1048ea24be70003c4'
             'c4df27d25d298ac95d85e6f06b558b73bb67de5110a19a0228cb7f8519291ea5'
             '5f6ccb7b945c8a13c690493723bad816b36f2f25792d47e677b56f8200907e60'
-            '552ddcef0cf139927f54c9c728c68b0e385600107e5166449b29de75e5dfcd7f'
+            '6cf0b76bc5d9c9bb82ecde1fa87ed1f4380b4bbd29ea485261e5f2aada5d71ea'
+            '5e465d199c1a28d58078af08bcab151561d6423f43c6dba57d4db3f5de534140'
+            '5c4640a211d02ba8249299842ea2999ccc239d85bfd59a0f7c302483683adc07'
+            '890e5d98088ef1c7c075a551442f03385d1db266cad8a65576704a22720683f9'
+            '3276453f2ce655b6286476f48d4df837be952d9447afa46583f79ec71f2288c3'
             'ec8e49b7114e2fa2d359155c9ef722ff1ba5fe2c518fa48e30863d71d3b82863'
             'd634d2ce1fc63da7ac41f432b1e84c59b7cceabf19d510848a7cff40c8025342'
             '1c1898f263eaacbc069a8e1a3e732852350350d1dad4cb1a6bba430e3b796cd0'
@@ -275,17 +281,22 @@
   # https://crbug.com/456677057
   patch -Np1 -i ../glibc-2.42-baud-rate-fix.patch
 
-  # Chromium bundles a patched minizip with extra features
-  patch -Np1 -i ../chromium-149-unbundle-minizip-undo-unicode.patch
-
   patch -Np1 -i ../chromium-149-use-of-undeclared-identifier-ERROR.patch
 
   # Fix issue about missing AVX functions
   # Credit: https://github.com/ungoogled-software/ungoogled-chromium/pull/3837
   patch -Np1 -i ../chromium-150-revert-avx-flag-change.patch
 
-  # Credit: https://github.com/ungoogled-software/ungoogled-chromium/pull/3883
-  patch -Np1 -i ../chromium-151-dont-depends-on-histograms.xml-if-it-is-not-git-checkout.patch
+  patch -Np1 -i ../chromium-152-crubit.patch
+
+  patch -Np1 -i ../chromium-152-dawn-llvm-22.patch
+
+  # Just the reverted commit 8dab8b761385b7946588232e4e2a8c116f9293c3
+  patch -Np1 -i "$srcdir/chromium-152-fix-gn-no-public_inputs.patch" -d third_party/devtools-frontend/src
+
+  patch -Np1 -i ../chromium-152-unbundle-minizip-undo-unicode.patch
+
+  patch -Np1 -i ../chromium-152-unbundle-opus-devtools.patch
 
   # CEF: Remove sysroot requirement for non-x64 builds
   patch -Np1 -i ../cef-no-sysroot.patch

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 07:22:16	Medium	1
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2