chromedriver

maintainer Raymo111 · 52 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The source downloads a prebuilt ChromeDriver binary from Google's official chrome-for-testing-public bucket, which is a legitimate and expected source for this software; despite the non-whitelisted host, it is not a supply-chain risk as this is the official distribution point.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source downloads a prebuilt ChromeDriver binary from Google's official chrome-for-testing-public bucket, which is a legitimate and expected source for this software; despite the non-whitelisted host, it is not a supply-chain risk as this is the official distribution point.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:18 source=("${pkgname}_${pkgver}_linux64.zip::https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/${pkgname}-linux64.zip")

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Raymo111 <aur@raymond.li>
2# Contributor: Robert Walaski <robert@walaski.cz>
3# Contributor: JunYoung Gwak <aur@jgwak.com>
4# Contributor: relrel <relrelbachar@gmail.com>
5# Contributor: grimsock <lord.grimsock at gmail dot com>
6# Contributor: James An <james@jamesan.ca>
7# Contributor: lybin
8pkgname=chromedriver
9pkgver=151.0.7922.71
10pkgrel=1
11pkgdesc="Standalone server that implements the W3C WebDriver standard (for google-chrome)"
12arch=('x86_64')
13url="https://chromedriver.chromium.org/"
14license=('BSD')
15depends=(alsa-lib gtk3 libcups libxss libxtst nss xdg-utils)
16optdepends=(google-chrome)
17conflicts=(chromium)
18source=("${pkgname}_${pkgver}_linux64.zip::https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/${pkgname}-linux64.zip")
19sha512sums=('148912748eedf302b30c6833b03d3658b60af7e3503cfc199eae06cc8fdb55bd06605bad615ed99a5138e561b82e32a05dcb70efcb9b19d9fadf4639f4ad8ec2')
20package() {
21 install -Dm755 -t "$pkgdir/usr/bin/" "$srcdir/$pkgname-linux64/$pkgname"
22}
23

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -6,7 +6,7 @@
# Contributor: James An <james@jamesan.ca>
# Contributor: lybin
pkgname=chromedriver
-pkgver=151.0.7922.47
+pkgver=151.0.7922.71
pkgrel=1
pkgdesc="Standalone server that implements the W3C WebDriver standard (for google-chrome)"
arch=('x86_64')
@@ -16,7 +16,7 @@
optdepends=(google-chrome)
conflicts=(chromium)
source=("${pkgname}_${pkgver}_linux64.zip::https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/${pkgname}-linux64.zip")
-sha512sums=('6cf79c07333bf82dec1f6ab2eecdc33fc434ed36f0a450677d2120d6c8a9443977b16aa2bdcf5ec79f2886effc13e512f7194130ef39ad73cff5ad238bd31b14')
+sha512sums=('148912748eedf302b30c6833b03d3658b60af7e3503cfc199eae06cc8fdb55bd06605bad615ed99a5138e561b82e32a05dcb70efcb9b19d9fadf4639f4ad8ec2')
package() {
install -Dm755 -t "$pkgdir/usr/bin/" "$srcdir/$pkgname-linux64/$pkgname"
}

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 07:14:03 MEDIUM 1
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 07:22:42 MEDIUM 1
2026-07-16 00:05:41 CLEAN 2
2026-07-15 23:49:53 MEDIUM 1
2026-07-15 03:47:03 MEDIUM 1
2026-07-15 00:09:25 LOW 2
2026-07-14 00:09:48 LOW 2
2026-07-13 00:19:36 LOW 2
2026-07-12 00:27:26 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion