chrome-for-testing-bin

LOW

maintainer JasonLandbridge 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Downloads a prebuilt Chrome binary from storage.googleapis.com, which is Google's official GCS bucket used for Chrome for Testing releases; the checksum is provided and matches the official distribution infrastructure, so this is a legitimate prebuilt from the project's own vendor domain rather than an unrelated swappable host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt Chrome binary from storage.googleapis.com, which is Google's official GCS bucket used for Chrome for Testing releases; the checksum is provided and matches the official distribution infrastructure, so this is a legitimate prebuilt from the project's own vendor domain rather than an unrelated swappable host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 "chrome-for-testing-${pkgver}-linux64.zip::https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/chrome-linux64.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jason Landbridge <JasonLandbridge at aur dot archlinux dot org>
    
      2# Packaging repository: https://github.com/JasonLandbridge/Arch-Linux-AUR-Packages-Updater/tree/main/chrome-for-testing-bin
    
      3
    
      4pkgname=chrome-for-testing-bin
    
      5pkgver=155.0.8059.79 # renovate: datasource=custom.chrome-for-testing depName=chrome-for-testing versioning=semver-coerced
    
      6pkgrel=2
    
      7pkgdesc="Official Google Chrome for Testing browser"
    
      8arch=('x86_64')
    
      9url="https://googlechromelabs.github.io/chrome-for-testing/"
    
      10license=('LicenseRef-Google-Chrome')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'at-spi2-core'
    
      14  'cairo'
    
      15  'dbus'
    
      16  'expat'
    
      17  'glib2'
    
      18  'glibc'
    
      19  'gtk3'
    
      20  'libcups'
    
      21  'libx11'
    
      22  'libxcb'
    
      23  'libxcomposite'
    
      24  'libxdamage'
    
      25  'libxext'
    
      26  'libxfixes'
    
      27  'libxkbcommon'
    
      28  'libxrandr'
    
      29  'libxss'
    
      30  'libxtst'
    
      31  'mesa'
    
      32  'nspr'
    
      33  'nss'
    
      34  'pango'
    
      35  'systemd-libs'
    
      36  'ttf-liberation'
    
      37  'xdg-utils'
    
      38)
    
      39options=('!emptydirs' '!strip')
    
      40source=(
    
      41  "chrome-for-testing-${pkgver}-linux64.zip::https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/chrome-linux64.zip"
    
      42)
    
      43sha256sums=('bcd9a79130d7e44d70f93be87042e9bcee7fe0f0b3898e06b8c9bed5fb619dcd')
    
      44
    
      45package() {
    
      46  local _install_dir="$pkgdir/opt/chrome-for-testing"
    
      47
    
      48  install -dm755 "$_install_dir"
    
      49  cp -a "$srcdir/chrome-linux64/." "$_install_dir/"
    
      50  chmod 0755 "$_install_dir/chrome_sandbox"
    
      51  chmod 0644 "$_install_dir/deb.deps" "$_install_dir/rpm.deps"
    
      52
    
      53  install -Dm755 /dev/stdin "$pkgdir/usr/bin/chrome-for-testing" <<'EOF'
    
      54#!/usr/bin/env bash
    
      55exec /opt/chrome-for-testing/chrome "$@"
    
      56EOF
    
      57
    
      58  install -Dm644 "$srcdir/chrome-linux64/ABOUT" \
    
      59    "$pkgdir/usr/share/licenses/$pkgname/ABOUT"
    
      60  install -Dm644 "$srcdir/chrome-linux64/WidevineCdm/LICENSE" \
    
      61    "$pkgdir/usr/share/licenses/$pkgname/WidevineCdm-LICENSE"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 13:22:29	Low	3
2026-10-14 13:20:15	Medium	2