cef-vaapi

MEDIUM
maintainer bnema 0 votes scanned 2026-11-01 07:59:34.641363
View on AUR
Why flagged
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
PKGBUILD:76 source=("chromium-$_chromium_ver-lite.tar.xz::https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$_chromium_ver-lite.tar.xz"
PKGBUILD

1 offending line(s) highlighted
      1# Maintainer: Christian Heusel <gromit@archlinux.org>
    
      2# Maintainer: Jonathan Grotelüschen <tippfehlr@archlinux.org>
    
      3# Contributor: Sven-Hendrik Haase <svenstaro@archlinux.org>
    
      4
    
      5# Note: This PKGBUILD and the chromium PKGBUILD are loosely kept in sync to ease maintenance.
    
      6# As such care should be taken to minimize the differences between these PKGBUILDs.
    
      7pkgname=cef-vaapi
    
      8# pkgver is updated automatically.
    
      9# To update this package, update the _cef_commit and _chromium_ver variables.
    
      10# For the CEF versioning scheme, see
    
      11# https://chromiumembedded.github.io/cef/branches_and_building#version-number-format
    
      12pkgver=154.0.34
    
      13# See https://github.com/chromiumembedded/cef/tree/<release branch>
    
      14# Also see https://chromiumembedded.github.io/cef/branches_and_building
    
      15_cef_commit=14c5a089e8452874cb1a556dc3fde26ed2d87723
    
      16# the chromium version must match CHROMIUM_BUILD_COMPATIBILITY.txt in the CEF repo
    
      17_chromium_ver=154.0.8037.154
    
      18_system_clang=1
    
      19pkgrel=2
    
      20pkgdesc="Chromium Embedded Framework (CEF), simple framework for embedding Chromium-based browsers in other applications (VAAPI-enabled variant)"
    
      21provides=("cef=$pkgver")  # provides="cef=$pkgver"
    
      22conflicts=('cef')  # conflicts='cef'
    
      23arch=('x86_64')
    
      24url="https://chromiumembedded.github.io/cef"
    
      25license=('BSD-3-Clause')
    
      26depends=(
    
'alsa-lib'
    
'at-spi2-core'
    
'dbus'
    
'libdrm'
    
'libffi'
    
'libpulse'
    
'libxcomposite'
    
'libxdamage'
    
'libxkbcommon'
    
'libxrandr'
    
'mesa'
    
'nss'
    
'pango'
    
'systemd-libs'
    
'libva'
    
      42)
    
      43optdepends=(
    
'libva-mesa-driver: VAAPI driver for AMD GPUs'
    
'intel-media-driver: VAAPI driver for modern Intel GPUs'
    
'libva-utils: VAAPI diagnostics such as vainfo'
    
      47)
    
      48
    
      49makedepends=(
    
'clang'
    
'compiler-rt'
    
'esbuild'
    
'git'
    
'gn'
    
'go'
    
'gperf'
    
'java-runtime-headless'
    
'lld'
    
'ninja'
    
'nodejs'
    
'npm'
    
'opus'
    
'pipewire'
    
'python'
    
'python-httplib2'
    
'python-pyparsing'
    
'python-six'
    
'rsync'
    
'rust'
    
'rust-bindgen'
    
'typescript'
    
'vulkan-headers'
    
'libxtst'
    
      74)
    
      75options=('!lto') # Chromium adds its own flags for ThinLTO
    
      76source=("chromium-$_chromium_ver-lite.tar.xz::https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$_chromium_ver-lite.tar.xz"
    
"cef::git+https://github.com/chromiumembedded/cef.git#commit=${_cef_commit}"
    
chromium-138-nodejs-version-check.patch
    
chromium-145-fix-SYS_SECCOMP.patch
    
chromium-147-revert-clang-no-lifetime-dse-flag.patch
    
chromium-147-rust-1.95-bytemuck.patch
    
chromium-149-drop-unknown-clang-flag.patch
    
chromium-149-use-of-undeclared-identifier-ERROR.patch
    
chromium-150-revert-avx-flag-change.patch
    
chromium-152-unbundle-minizip-undo-unicode.patch
    
chromium-152-unbundle-opus-devtools.patch
    
chromium-153-hermetic-python.patch
    
chromium-153-iamf-tools-unbundled-opus.patch
    
chromium-154-use-system-esbuild.patch
    
chromium-154-fix-gn-no-public_inputs.patch
    
chromium-154-typescript.patch
    
chromium-154-crubit.patch
    
chromium-154-remove-private_verification_tokens.patch
    
chromium-154-build-with-wasm-rollup.patch
    
compiler-rt-adjust-paths.patch
    
increase-fortify-level.patch
    
glibc-2.42-baud-rate-fix.patch
    
cef-no-sysroot.patch
    
cef-no-libxml-visibility-patch.patch
    
chromium-disable-font-tests.patch
    
FindCEF.cmake
    
      102)
    
      103sha256sums=('07b64494ed68d975aa61d36ff27fd2217ad01fced4a6de8ae22f51ebb6083201'
    
          '2cad9ae59579d0e01d95d9504be304a92dd1760645270151b98ec39054375922'
    
          '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
    
          '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'
    
          'c382830318c5b37826ecf44f3ba9def6be8affdad1bce819ecb83f3222ff4b3a'
    
          'b9e6339221efe03540ffb360c161d93604a1fc93a5a1c53e5e9849066f987d05'
    
          '1b5190fa030850cf30a97dc90e35b31f3097243c88743fbfaedbd64ea80f1327'
    
          '951514535be65f0e2f84e82305d96292be1da353c1427ba1048ea24be70003c4'
    
          '5f6ccb7b945c8a13c690493723bad816b36f2f25792d47e677b56f8200907e60'
    
          '890e5d98088ef1c7c075a551442f03385d1db266cad8a65576704a22720683f9'
    
          '3276453f2ce655b6286476f48d4df837be952d9447afa46583f79ec71f2288c3'
    
          'ebf74154266d0b6d6cc957c413f845052c5fcfce7745befb8821595cdf3f7d49'
    
          '2ab9fbe653829ce692f83ee780aad07e8c83a6686e51ab9459ad736cfa2850ee'
    
          '017e32d7c92a2c3d672e0535d52a27be1b805aa4dfe7d29cb1c1552460ccad64'
    
          '7f39267af6bd60cc19244ca43684e18a0bb441b197fa1627ca4c4d97fbc759ca'
    
          'd061cf4aeba21b1d2edabc28afd38106246b99aa5ec699e1b9ee5ca8b76d8a23'
    
          'a82147f07982d49b0744c53c5fc038d4de1ef7d9a828b6280abbb49462b623eb'
    
          '0cc5f7c7ccf0927c0bbfdb9e797dc5b1f4c9f021e8a01d943121d3ee4e6416bf'
    
          'cfef4a4eeed2272b3101131af6c1bb63c7932a715c36634a1e027f770634e013'
    
          'ec8e49b7114e2fa2d359155c9ef722ff1ba5fe2c518fa48e30863d71d3b82863'
    
          'd634d2ce1fc63da7ac41f432b1e84c59b7cceabf19d510848a7cff40c8025342'
    
          '1c1898f263eaacbc069a8e1a3e732852350350d1dad4cb1a6bba430e3b796cd0'
    
          'cdc046c3da5a57dae8fba0de49cadbe65d4f8fbfffb172f7a768222232595faa'
    
          '6695d7bcac489f74b8290a05dac540c2b5c5fed997ee119ae05419d36509445d'
    
          '44dcc0da55a8c6c6af875addcfb9c552c722b56a31479eb7d99f16d0a27f4ebb'
    
          'e576250c4d0f3dd307bd22c6d4f9f7aba54fdf4d5899520c0bd1c3527aec65ed')
    
      129
    
      130# Possible replacements are listed in build/linux/unbundle/replace_gn_files.py
    
      131# Keys are the names in the above script; values are the dependencies in Arch
    
      132declare -gA _system_libs=(
    
[brotli]=brotli
    
[dav1d]=dav1d
    
#[ffmpeg]=ffmpeg    # YouTube playback stopped working in Chromium 120
    
[flac]=flac
    
[fontconfig]=fontconfig
    
[freetype]=freetype2
    
[harfbuzz]=harfbuzz
    
[highway]=highway
    
#[icu]=icu
    
#[jsoncpp]=jsoncpp  # needs libstdc++
    
#[libaom]=aom
    
#[libavif]=libavif  # needs -DAVIF_ENABLE_EXPERIMENTAL_GAIN_MAP=ON
    
[libdrm]=libdrm
    
[libjpeg]=libjpeg-turbo
    
# [libpng]=libpng
    
#[libvpx]=libvpx
    
[libwebp]=libwebp
    
[libxml]=libxml2
    
[libxslt]=libxslt
    
[openh264]=openh264
    
[opus]=opus
    
#[re2]=re2          # needs libstdc++
    
#[snappy]=snappy    # needs libstdc++
    
#[woff2]=woff2      # needs libstdc++
    
[zlib]=minizip
    
[zstd]=zstd
    
      159)
    
      160_unwanted_bundled_libs=(
    
$(printf "%s\n" ${!_system_libs[@]} | sed 's/^libjpeg$/&_turbo/')
    
      162)
    
      163depends+=(${_system_libs[@]})
    
      164
    
      165_validate_cef_vaapi_invariants() {
    
local _pkgbuild="${BASH_SOURCE[0]}"
    
local _required_flags=(
    
  'ffmpeg_branding="Chrome"'
    
  'proprietary_codecs=true'
    
  'rtc_use_pipewire=true'
    
  'link_pulseaudio=true'
    
  'use_vaapi=true'
    
)
    
local _flag _actual _flag_ok
    
for _flag in "${_required_flags[@]}"; do
    
  _flag_ok=0
    
  for _actual in "${_flags[@]}"; do
    
    if [[ "$_actual" == "$_flag" ]]; then
    
      _flag_ok=1
    
      break
    
    fi
    
  done
    
  if (( ! _flag_ok )); then
    
    echo "ERROR: required GN flag missing or changed: ${_flag}" >&2
    
    exit 1
    
  fi
    
done
    
      188
    
if grep -Eq '^[[:space:]]*\[ffmpeg\]=' "$_pkgbuild"; then
    
  echo "ERROR: _system_libs[ffmpeg] must stay commented or absent" >&2
    
  exit 1
    
fi
    
      193
    
local _source_ok=0 _s
    
for _s in "${source[@]}"; do
    
  if [[ "$_s" == cef::git+https://github.com/chromiumembedded/cef.git* ]]; then
    
    _source_ok=1
    
    break
    
  fi
    
done
    
if (( ! _source_ok )); then
    
  echo "ERROR: source must use cef::git+https://github.com/chromiumembedded/cef.git" >&2
    
  exit 1
    
fi
    
      205
    
local _provides_ok=0 _p
    
for _p in "${provides[@]}"; do
    
  if [[ "$_p" == cef=* ]]; then
    
    _provides_ok=1
    
    break
    
  fi
    
done
    
if (( ! _provides_ok )); then
    
  echo "ERROR: provides must include cef=\$pkgver" >&2
    
  exit 1
    
fi
    
      217
    
local _conflicts_ok=0 _c
    
for _c in "${conflicts[@]}"; do
    
  if [[ "$_c" == cef ]]; then
    
    _conflicts_ok=1
    
    break
    
  fi
    
done
    
if (( ! _conflicts_ok )); then
    
  echo "ERROR: conflicts must include cef" >&2
    
  exit 1
    
fi
    
      229
    
if declare -p replaces >/dev/null 2>&1 && (( ${#replaces[@]} > 0 )); then
    
  echo "ERROR: replaces must not be set" >&2
    
  exit 1
    
fi
    
      234
    
local _libva_ok=0 _d
    
for _d in "${depends[@]}"; do
    
  if [[ "$_d" == libva ]]; then
    
    _libva_ok=1
    
    break
    
  fi
    
done
    
if (( ! _libva_ok )); then
    
  echo "ERROR: depends must include libva" >&2
    
  exit 1
    
fi
    
      246}
    
      247
    
      248prepare() {
    
cd chromium-$_chromium_ver
    
      250
    
# Move CEF into the chromium source tree
    
mv "$srcdir/cef" cef
    
      253
    
# Allow building against system libraries in official builds
    
sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' \
    
  tools/generate_shim_headers/generate_shim_headers.py
    
      257
    
# https://crbug.com/893950
    
sed -i -e 's/\<xmlMalloc\>/malloc/' -e 's/\<xmlFree\>/free/' \
    
  -e '1i #include <cstdlib>' \
    
  third_party/blink/renderer/core/xml/*.cc \
    
  third_party/blink/renderer/core/xml/parser/xml_document_parser.cc \
    
  third_party/libxml/chromium/*.cc
    
      264
    
# Fixes from Gentoo
    
patch -Np1 -i ../chromium-138-nodejs-version-check.patch
    
      267
    
# Allow libclang_rt.builtins from compiler-rt >= 16 to be used
    
patch -Np1 -i ../compiler-rt-adjust-paths.patch
    
      270
    
# Increase _FORTIFY_SOURCE level to match Arch's default flags
    
patch -Np1 -i ../increase-fortify-level.patch
    
      273
    
# clang 22 lacks -fsanitize-ignore-for-ubsan-feature, which is needed to use
    
# -fsanitize=array-bounds without triggering UBSan feature detection. Without
    
# feature detection suppression, V8 compiles in __sanitizer_set_death_callback
    
# calls that require the UBSan runtime, which is not linked in a trap-mode
    
# build. Drop the entire sanitize_c_array_bounds cflags block.
    
# Can be dropped when arch has LLVM 23.
    
patch -Np1 -i ../chromium-149-drop-unknown-clang-flag.patch
    
      281
    
# Causes a build failure with our clang version
    
patch -Np1 -i ../chromium-147-revert-clang-no-lifetime-dse-flag.patch
    
      284
    
# https://crbug.com/456218403
    
patch -Np1 -i ../chromium-145-fix-SYS_SECCOMP.patch
    
      287
    
patch -Np1 -i ../chromium-147-rust-1.95-bytemuck.patch
    
      289
    
patch -Np1 -i ../chromium-disable-font-tests.patch
    
      291
    
# https://crbug.com/456677057
    
patch -Np1 -i ../glibc-2.42-baud-rate-fix.patch
    
      294
    
patch -Np1 -i ../chromium-149-use-of-undeclared-identifier-ERROR.patch
    
      296
    
# Fix issue about missing AVX functions
    
# Credit: https://github.com/ungoogled-software/ungoogled-chromium/pull/3837
    
patch -Np1 -i ../chromium-150-revert-avx-flag-change.patch
    
      300
    
patch -Np1 -i ../chromium-152-unbundle-minizip-undo-unicode.patch
    
      302
    
patch -Np1 -i ../chromium-152-unbundle-opus-devtools.patch
    
      304
    
# Use system python3 instead of the hermetic cpython3 interpreter
    
# https://github.com/ungoogled-software/ungoogled-chromium/pull/3946
    
patch -Np1 -i ../chromium-153-hermetic-python.patch
    
      308
    
# third_party/iamf_tools includes vendored Opus via relative "include/opus.h"
    
# paths that only resolve against a real bundled Opus checkout; fix them up
    
# for the unbundled system Opus build
    
patch -Np1 -i ../chromium-153-iamf-tools-unbundled-opus.patch
    
      313
    
patch -Np1 -i ../chromium-154-use-system-esbuild.patch
    
      315
    
patch -Np1 -i ../chromium-154-fix-gn-no-public_inputs.patch
    
      317
    
# Work around TypeScript becoming a build dependency: disable tsgo for the
    
# WebUI and point devtools at the system tsc binary
    
# https://github.com/ungoogled-software/ungoogled-chromium/pull/3966
    
patch -Np1 -i ../chromium-154-typescript.patch
    
      322
    
patch -Np1 -i ../chromium-154-crubit.patch
    
      324
    
patch -Np1 -i ../chromium-154-remove-private_verification_tokens.patch
    
      326
    
patch -Np1 -i ../chromium-154-build-with-wasm-rollup.patch
    
      328
    
# CEF: Remove sysroot requirement for non-x64 builds
    
patch -Np1 -i ../cef-no-sysroot.patch
    
      331
    
# CEF: Remove libxml_visibility patch (fails with system libxml2)
    
patch -Np1 -i ../cef-no-libxml-visibility-patch.patch
    
      334
    
# CEF: Override clang_exe to use system clang
    
echo 'clang_exe = "clang"' >>cef/tools/clang_util.py
    
      337
    
# Link to system tools required by the build
    
mkdir -p \
    
  third_party/node/linux/node-linux-x64/bin \
    
  third_party/node/linux/node-linux-arm64/bin \
    
  third_party/jdk/current/bin \
    
  third_party/rust-toolchain/bin \
    
  third_party/dawn/tools/golang/linux-amd64/bin \
    
  third_party/dawn/tools/golang/linux-arm64/bin
    
      346
    
ln -s /usr/bin/node third_party/node/linux/node-linux-x64/bin/
    
ln -s /usr/bin/node third_party/node/linux/node-linux-arm64/bin/
    
ln -s /usr/bin/java third_party/jdk/current/bin/
    
ln -s /usr/bin/rustc third_party/rust-toolchain/bin/
    
ln -s /usr/bin/go third_party/dawn/tools/golang/linux-amd64/bin/
    
ln -s /usr/bin/go third_party/dawn/tools/golang/linux-arm64/bin/
    
      353
    
# remove x86_64 binary and use our own
    
rm -f third_party/gperf/cipd/bin/gperf
    
ln -s /usr/bin/gperf third_party/gperf/cipd/bin/
    
      357
    
rm -rf third_party/devtools-frontend/src/node_modules/esbuild/
    
mkdir -p third_party/devtools-frontend/src/node_modules
    
ln -s /usr/lib/node_modules/esbuild/ third_party/devtools-frontend/src/node_modules/esbuild
    
      361
    
if ((!_system_clang)); then
    
  # Use prebuilt rust as system rust cannot be used due to the error:
    
  #   error: the option `Z` is only accepted on the nightly compiler
    
  ./tools/rust/update_rust.py
    
      366
    
  # To link to rust libraries we need to compile with prebuilt clang
    
  ./tools/clang/scripts/update.py
    
fi
    
      370
    
# Remove bundled libraries for which we will use the system copies; this
    
# *should* do what the remove_bundled_libraries.py script does, with the
    
# added benefit of not having to list all the remaining libraries
    
local _lib
    
for _lib in ${_unwanted_bundled_libs[@]}; do
    
  find "third_party/$_lib" -type f \
    
    \! -path "third_party/$_lib/chromium/*" \
    
    \! -path "third_party/$_lib/google/*" \
    
    \! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
    
    \! -regex '.*\.\(gn\|gni\|isolate\)' \
    
    -delete
    
done
    
      383
    
./build/linux/unbundle/replace_gn_files.py \
    
  --system-libraries "${!_system_libs[@]}"
    
      386
    
# check if the right chromium version is available.
    
local _expected_chromium_ver=$(grep -oP "refs/tags/\K[0-9.]+" cef/CHROMIUM_BUILD_COMPATIBILITY.txt)
    
if [[ "$_expected_chromium_ver" != "$_chromium_ver" ]]; then
    
  echo "Error: CEF expects chromium $_expected_chromium_ver, but $_chromium_ver was set in PKGBUILD" >&2
    
  # exit 1
    
fi
    
      393}
    
      394
    
      395pkgver() {
    
cd chromium-$_chromium_ver
    
      397
    
# python tool to get the full CEF version. For the full output, look at
    
# /usr/include/cef/include/cef_version.h in the built package.
    
python cef/tools/make_version_header.py cef_version_header
    
grep -oP 'CEF_VERSION "\K[^"]+' cef_version_header | sed -E 's/\+.*//'
    
      402}
    
      403
    
      404build() {
    
cd chromium-$_chromium_ver
    
      406
    
if ((_system_clang)); then
    
  export CC=clang
    
  export CXX=clang++
    
  export AR=ar
    
  export NM=nm
    
else
    
  local _clang_path="$PWD/third_party/llvm-build/Release+Asserts/bin"
    
  export CC=$_clang_path/clang
    
  export CXX=$_clang_path/clang++
    
  export AR=$_clang_path/llvm-ar
    
  export NM=$_clang_path/llvm-nm
    
fi
    
      419
    
# Add depot_tools to PATH (needed by CEF's gclient_hook.py)
    
export PATH="$PATH:$PWD/third_party/depot_tools"
    
      422
    
# Use system ninja, remove the wrapper which only supports x86_64
    
rm -f third_party/depot_tools/ninja
    
      425
    
# GN defines passed to CEF's gclient_hook.py via GN_DEFINES env var
    
local _flags=(
    
  'custom_toolchain="//build/toolchain/linux/unbundle:default"'
    
  'host_toolchain="//build/toolchain/linux/unbundle:default"'
    
  'is_official_build=true' # implies is_cfi=true on x86_64
    
  'symbol_level=0'         # sufficient for backtraces on x86(_64)
    
  'treat_warnings_as_errors=false'
    
  'fatal_linker_warnings=false'
    
  'disable_fieldtrial_testing_config=true'
    
  'blink_enable_generated_code_formatting=false'
    
  'ffmpeg_branding="Chrome"'
    
  'proprietary_codecs=true'
    
  'rtc_use_pipewire=true'
    
  'link_pulseaudio=true'
    
  'use_custom_libcxx=true' # https://github.com/llvm/llvm-project/issues/61705
    
  'use_sysroot=false'
    
  'use_system_libffi=true'
    
  'use_qt5=false'
    
  'use_qt6=false'
    
  'use_gtk=false'
    
  'use_cups=false'
    
  'use_gio=false'
    
  'use_kerberos=false'
    
  'use_libpci=false'
    
  'use_udev=true'
    
  'cef_use_gtk=false'
    
  'enable_remoting=false'
    
  'use_vaapi=true'
    
  'use_clang_modules=false'
    
  'devtools_bundle=false'
    
)
    
      457
    
if [[ -n ${_system_libs[icu]+set} ]]; then
    
  _flags+=('icu_use_data_file=false')
    
fi
    
      461
    
if ((_system_clang)); then
    
  local _clang_version=$(
    
    clang --version | grep -m1 version | sed 's/.* \([0-9]\+\).*/\1/'
    
  )
    
      466
    
  _flags+=(
    
    'clang_base_path="/usr"'
    
    'clang_use_chrome_plugins=false'
    
    "clang_version=\"$_clang_version\""
    
    'chrome_pgo_phase=0' # needs newer clang to read the bundled PGO profile
    
  )
    
      473
    
  # Allow the use of nightly features with stable Rust compiler
    
  # https://github.com/ungoogled-software/ungoogled-chromium/pull/2696#issuecomment-1918173198
    
  export RUSTC_BOOTSTRAP=1
    
      477
    
  _flags+=(
    
    'rust_sysroot_absolute="/usr"'
    
    'rust_bindgen_root="/usr"'
    
    "rustc_version=\"$(rustc --version | awk '{ print $2 ;}')\""
    
  )
    
fi
    
      484
    
# Optional C/C++ compiler cache. Fail rather than silently bypass an opt-in.
    
# Chromium invokes rustc directly via its own wrapper, not Cargo/RUSTC_WRAPPER.
    
if [[ ${CEF_VAAPI_SCCACHE:-0} == 1 ]]; then
    
  command -v sccache >/dev/null || {
    
    echo 'ERROR: CEF_VAAPI_SCCACHE=1 requires sccache in PATH' >&2
    
    return 1
    
  }
    
  _flags+=(
    
    'cc_wrapper="sccache"'
    
    'use_remoteexec=false' # reclient and cc_wrapper are mutually exclusive
    
    'strip_absolute_paths_from_debug_symbols=true'
    
  )
    
fi
    
      498
    
# Optional cap on concurrent Python/Node build actions (GN defaults to the
    
# host CPU count, which ignores container CPU and memory limits).
    
if [[ -n ${CEF_VAAPI_ACTION_POOL_DEPTH:-} ]]; then
    
  _flags+=("action_pool_depth=${CEF_VAAPI_ACTION_POOL_DEPTH}")
    
fi
    
      504
    
_validate_cef_vaapi_invariants
    
      506
    
export GN_DEFINES="${_flags[*]}"
    
# Only build Release config
    
if [[ $CARCH == "aarch64" ]]; then
    
  export GN_DEFINES+=' target_cpu="arm64"'
    
  export GN_OUT_CONFIGS="Release_GN_arm64"
    
else
    
  export GN_OUT_CONFIGS="Release_GN_x64"
    
fi
    
      515
    
# Facilitate deterministic builds (taken from build/config/compiler/BUILD.gn)
    
CFLAGS+='   -Wno-builtin-macro-redefined'
    
CXXFLAGS+=' -Wno-builtin-macro-redefined'
    
CPPFLAGS+=' -D__DATE__=  -D__TIME__=  -D__TIMESTAMP__='
    
      520
    
# Do not warn about unknown warning options
    
CFLAGS+='   -Wno-unknown-warning-option'
    
CXXFLAGS+=' -Wno-unknown-warning-option'
    
      524
    
# Let Chromium set its own symbol level
    
CFLAGS=${CFLAGS/-g /}
    
CXXFLAGS=${CXXFLAGS/-g /}
    
      528
    
# https://github.com/ungoogled-software/ungoogled-chromium-archlinux/issues/123
    
CFLAGS=${CFLAGS/-fexceptions/}
    
CFLAGS=${CFLAGS/-fcf-protection/}
    
CXXFLAGS=${CXXFLAGS/-fexceptions/}
    
CXXFLAGS=${CXXFLAGS/-fcf-protection/}
    
      534
    
# This appears to cause random segfaults when combined with ThinLTO
    
# https://bugs.archlinux.org/task/73518
    
CFLAGS=${CFLAGS/-fstack-clash-protection/}
    
CXXFLAGS=${CXXFLAGS/-fstack-clash-protection/}
    
      539
    
# https://crbug.com/957519#c122
    
CXXFLAGS=${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}
    
      542
    
# aarch64: strip -march= as chromium sub-targets need their own arch flags
    
if [[ $CARCH == "aarch64" ]]; then
    
  CFLAGS="${CFLAGS/-march=*([^ ]) }"
    
  CXXFLAGS="${CXXFLAGS/-march=*([^ ]) }"
    
fi
    
      548
    
python3 cef/tools/gclient_hook.py
    
sed -i '/__sanitizer_set_death_callback/d' v8/src/sandbox/testing.cc
    
      551
    
if [[ $CARCH == "aarch64" ]]; then
    
  ninja -C out/Release_GN_arm64 libcef chrome_sandbox
    
else
    
  ninja -C out/Release_GN_x64 libcef chrome_sandbox
    
fi
    
      557
    
# Build the CEF binary distribution
    
if [[ $CARCH == "aarch64" ]]; then
    
  local _distrib_arch_flag="--arm64-build"
    
else
    
  local _distrib_arch_flag="--x64-build"
    
fi
    
      564
    
python3 cef/tools/make_distrib.py \
    
  --distrib-subdir=distrib \
    
  --output-dir=.. \
    
  --ninja-build \
    
  $_distrib_arch_flag \
    
  --minimal \
    
  --no-docs \
    
  --no-archive
    
      573}
    
      574
    
      575package() {
    
cd distrib_minimal
    
      577
    
install -d "$pkgdir/usr/lib/cef/"
    
cp -r Release/* "$pkgdir/usr/lib/cef/"
    
install -Dvm4755 Release/chrome-sandbox "$pkgdir/usr/lib/cef/chrome-sandbox"
    
cp -r Resources/* "$pkgdir/usr/lib/cef/"
    
      582
    
# Headers
    
install -d "$pkgdir/usr/include/cef"
    
cp -a "include" "$pkgdir/usr/include/cef/"
    
      586
    
# libcef_dll wrapper source
    
install -d "$pkgdir/usr/src/cef"
    
cp -a "libcef_dll" "$pkgdir/usr/src/cef/"
    
      590
    
# Remove include file targets, since includes are in a different path
    
sed -i -e '/\.\.\/include/d' "$pkgdir/usr/src/cef/libcef_dll/CMakeLists.txt"
    
      593
    
# The FindCEF.cmake from CEF expects one unified directory.
    
# We provide a custom FindCEF.cmake that looks in the right places.
    
# Copied from https://src.fedoraproject.org/rpms/cef/blob/rawhide/f/FindCEF.cmake (thanks Fedora!)
    
install -Dm644 "$srcdir/FindCEF.cmake" -t "$pkgdir/usr/share/cmake/Modules/"
    
      598
    
install -Dm644 LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE-CEF"
    
install -Dm644 ../chromium-$_chromium_ver/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE-CHROMIUM"
    
      601}
    
      602
    
      603# vim:set ts=2 sw=2 et:
    
      604
Changes since previous scan

--- PKGBUILD @ 2026-11-01 05:59
+++ PKGBUILD @ 2026-11-01 07:59
@@ -16,7 +16,7 @@
 # the chromium version must match CHROMIUM_BUILD_COMPATIBILITY.txt in the CEF repo
 _chromium_ver=154.0.8037.154
 _system_clang=1
-pkgrel=4
+pkgrel=2
 pkgdesc="Chromium Embedded Framework (CEF), simple framework for embedding Chromium-based browsers in other applications (VAAPI-enabled variant)"
 provides=("cef=$pkgver")  # provides="cef=$pkgver"
 conflicts=('cef')  # conflicts='cef'
@@ -39,7 +39,6 @@
   'pango'
   'systemd-libs'
   'libva'
-  'vulkan-icd-loader'
 )
 optdepends=(
   'libva-mesa-driver: VAAPI driver for AMD GPUs'
@@ -581,12 +580,6 @@
   install -Dvm4755 Release/chrome-sandbox "$pkgdir/usr/lib/cef/chrome-sandbox"
   cp -r Resources/* "$pkgdir/usr/lib/cef/"
 
-  # Point CEF at the system Vulkan loader. ANGLE only searches libcef.so's
-  # directory for libvulkan, so the file must exist there. A second bundled
-  # loader breaks Dawn's WebGPU device when the host already loaded the
-  # system one (e.g. GTK4), leaving only the SwiftShader software adapter.
-  ln -sf /usr/lib/libvulkan.so.1 "$pkgdir/usr/lib/cef/libvulkan.so.1"
-
   # Headers
   install -d "$pkgdir/usr/include/cef"
   cp -a "include" "$pkgdir/usr/include/cef/"
Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 07:59:34	Medium	1
2026-11-01 05:59:34	Medium	1
2026-11-01 00:21:48	Low	2
2026-10-31 19:58:49	Medium	1
2026-10-31 15:58:34	Medium	1
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 11:52:15	Medium	1
2026-10-29 07:52:02	Medium	1
2026-10-29 00:13:55	Low	2
2026-10-28 21:50:44	Medium	1
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 07:39:45	Medium	1
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2