chromium-no-extras
LOW
maintainer graysky
5 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a Chromium tarball from Google's official storage domain, which is a legitimate and expected source for Chromium builds; despite the static analyzer flagging the host as non-standard, this is a normal and trustworthy source for this package.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Chromium tarball from Google's official storage domain, which is a legitimate and expected source for Chromium builds; despite the static analyzer flagging the host as non-standard, this is a normal and trustworthy source for this package.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:69
source=(https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$pkgver-lite.tar.xz
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: graysky <therealgraysky AT protonmail DOT com>
2
# Contributor: Evangelos Foutras <evangelos@foutrelis.com>
3
# Contributor: Pierre Schmitz <pierre@archlinux.de>
4
# Contributor: Jan "heftig" Steffens <jan.steffens@gmail.com>
5
# Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
6
7
pkgname=chromium-no-extras
8
pkgver=147.0.7727.101
9
pkgrel=1
10
# optionally modify to fit your specific hardware
11
# hacky way to determine subarch
12
_cpu=$(gcc -c -Q -march=native --help=target | grep ' -march=' | awk '{ print $2}')
13
14
# or just define it here
15
# _cpu="x86-64-v3"
16
17
export CFLAGS+=" -march=$_cpu -O3"
18
export CXXFLAGS+=" -march=$_cpu -O3"
19
PKGEXT='.pkg.tar'
20
21
_pkgname=chromium
22
_launcher_ver=8
23
_manual_clone=1
24
_system_clang=1
25
pkgdesc="Chromium without hangout services, widevine, or chromedriver"
26
arch=('x86_64')
27
url="https://www.chromium.org/Home"
28
license=('BSD-3-Clause')
29
depends=(
30
'alsa-lib'
31
'dbus'
32
'desktop-file-utils'
33
'gtk3'
34
'hicolor-icon-theme'
35
'libcups'
36
'libffi'
37
'libgcrypt'
38
'libpulse'
39
'libva'
40
'libxss'
41
'nss'
42
'pciutils'
43
'systemd'
44
'ttf-liberation'
45
'xdg-utils'
46
)
47
makedepends=(
48
'clang'
49
'compiler-rt'
50
'git'
51
'gn'
52
'gperf'
53
'java-runtime-headless'
54
'lld'
55
'ninja'
56
'nodejs'
57
'pipewire'
58
'python'
59
'qt6-base'
60
'rust-bindgen'
61
'rust'
62
)
63
optdepends=('pipewire: WebRTC desktop sharing under Wayland'
64
'kdialog: support for native dialogs in Plasma'
65
'gtk4: for --gtk-version=4 (GTK4 IME might work better on Wayland)'
66
'org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce'
67
'upower: Battery Status API support')
68
options=('!lto') # Chromium adds its own flags for ThinLTO
69
source=(https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$pkgver-lite.tar.xz
70
https://github.com/foutrelis/chromium-launcher/archive/v$_launcher_ver/chromium-launcher-$_launcher_ver.tar.gz
71
chromium-138-nodejs-version-check.patch
72
chromium-145-fix-SYS_SECCOMP.patch
73
chromium-146-drop-unknown-clang-flag.patch
74
chromium-146-build-with-wasm-rollup.patch
75
chromium-147-revert-clang-no-lifetime-dse-flag.patch
76
compiler-rt-adjust-paths.patch
77
increase-fortify-level.patch
78
use-oauth2-client-switches-as-default.patch
79
glibc-2.42-baud-rate-fix.patch)
80
sha256sums=('2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819'
81
'213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
82
'11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
83
'4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'
84
'24535c314c7e70c52bcf409aaf604728bfc5b5c97e60087e630e1f7233b9e12d'
85
'45fa20cc27ef0aa00d654d0bac84bfaa8d8090b5f8aec49cc2e8d7249d3cd7ba'
86
'c382830318c5b37826ecf44f3ba9def6be8affdad1bce819ecb83f3222ff4b3a'
87
'ec8e49b7114e2fa2d359155c9ef722ff1ba5fe2c518fa48e30863d71d3b82863'
88
'd634d2ce1fc63da7ac41f432b1e84c59b7cceabf19d510848a7cff40c8025342'
89
'9343afa1a4308a7cfb3317229f5aff7778688debcc03c4a74a85908aa1d0cc3a'
90
'1c1898f263eaacbc069a8e1a3e732852350350d1dad4cb1a6bba430e3b796cd0')
91
92
if (( _manual_clone )); then
93
source[0]=fetch-chromium-release
94
sha256sums[0]='2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819'
95
makedepends+=('python-httplib2' 'python-pyparsing' 'python-six' 'npm' 'rsync')
96
fi
97
98
# Possible replacements are listed in build/linux/unbundle/replace_gn_files.py
99
# Keys are the names in the above script; values are the dependencies in Arch
100
declare -gA _system_libs=(
101
[brotli]=brotli
102
#[dav1d]=dav1d
103
#[ffmpeg]=ffmpeg # YouTube playback stopped working in Chromium 120
104
[flac]=flac
105
[fontconfig]=fontconfig
106
[freetype]=freetype2
107
[harfbuzz-ng]=harfbuzz
108
#[icu]=icu
109
#[jsoncpp]=jsoncpp # needs libstdc++
110
#[libaom]=aom
111
#[libavif]=libavif # needs -DAVIF_ENABLE_EXPERIMENTAL_GAIN_MAP=ON
112
[libjpeg]=libjpeg-turbo
113
# [libpng]=libpng
114
#[libvpx]=libvpx
115
[libwebp]=libwebp
116
[libxml]=libxml2
117
[libxslt]=libxslt
118
[opus]=opus
119
#[re2]=re2 # needs libstdc++
120
#[snappy]=snappy # needs libstdc++
121
#[woff2]=woff2 # needs libstdc++
122
[zlib]=minizip
123
)
124
_unwanted_bundled_libs=(
125
$(printf "%s\n" ${!_system_libs[@]} | sed 's/^libjpeg$/&_turbo/')
126
)
127
depends+=(${_system_libs[@]})
128
129
# Google API keys (see https://www.chromium.org/developers/how-tos/api-keys)
130
# Note: These are for Arch Linux use ONLY. For your own distribution, please
131
# get your own set of keys.
132
#
133
# Starting with Chromium 89 (2021-03-02) the OAuth2 credentials have been left
134
# out: https://archlinux.org/news/chromium-losing-sync-support-in-early-march/
135
_google_api_key=AIzaSyDwr302FpOSkGRpLlUpPThNTDPbXcIn_FM
136
137
prepare() {
138
# rustup install nightly
139
140
if (( _manual_clone )); then
141
./fetch-chromium-release $pkgver
142
fi
143
cd "$_pkgname-$pkgver"
144
145
# Allow building against system libraries in official builds
146
sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' \
147
tools/generate_shim_headers/generate_shim_headers.py
148
149
# https://crbug.com/893950
150
sed -i -e 's/\<xmlMalloc\>/malloc/' -e 's/\<xmlFree\>/free/' \
151
-e '1i #include <cstdlib>' \
152
third_party/blink/renderer/core/xml/*.cc \
153
third_party/blink/renderer/core/xml/parser/xml_document_parser.cc \
154
third_party/libxml/chromium/*.cc
155
156
# Use the --oauth2-client-id= and --oauth2-client-secret= switches for
157
# setting GOOGLE_DEFAULT_CLIENT_ID and GOOGLE_DEFAULT_CLIENT_SECRET at
158
# runtime -- this allows signing into Chromium without baked-in values
159
patch -Np1 -i ../use-oauth2-client-switches-as-default.patch
160
161
# Upstream fixes
162
163
# Fixes from Gentoo
164
patch -Np1 -i ../chromium-138-nodejs-version-check.patch
165
166
# Allow libclang_rt.builtins from compiler-rt >= 16 to be used
167
patch -Np1 -i ../compiler-rt-adjust-paths.patch
168
169
# Increase _FORTIFY_SOURCE level to match Arch's default flags
170
patch -Np1 -i ../increase-fortify-level.patch
171
172
# Fix issue about missing compiler flag, can be dropped when arch has LLVM 23
173
# clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=array-bounds'
174
patch -Np1 -i ../chromium-146-drop-unknown-clang-flag.patch
175
176
# Causes a build failure with our clang version
177
patch -Np1 -i ../chromium-147-revert-clang-no-lifetime-dse-flag.patch
178
179
# https://crbug.com/456218403
180
patch -Np1 -i ../chromium-145-fix-SYS_SECCOMP.patch
181
182
patch -Np1 -i ../chromium-146-build-with-wasm-rollup.patch
183
184
# https://crbug.com/456677057
185
patch -Np1 -i ../glibc-2.42-baud-rate-fix.patch
186
187
# Link to system tools required by the build
188
mkdir -p third_party/node/linux/node-linux-x64/bin third_party/jdk/current/bin
189
ln -s /usr/bin/node third_party/node/linux/node-linux-x64/bin/
190
ln -s /usr/bin/java third_party/jdk/current/bin/
191
192
if (( !_system_clang )); then
193
# Use prebuilt rust as system rust cannot be used due to the error:
194
# error: the option `Z` is only accepted on the nightly compiler
195
./tools/rust/update_rust.py
196
197
# To link to rust libraries we need to compile with prebuilt clang
198
./tools/clang/scripts/update.py
199
fi
200
201
# Remove bundled libraries for which we will use the system copies; this
202
# *should* do what the remove_bundled_libraries.py script does, with the
203
# added benefit of not having to list all the remaining libraries
204
local _lib
205
for _lib in ${_unwanted_bundled_libs[@]}; do
206
find "third_party/$_lib" -type f \
207
\! -path "third_party/$_lib/chromium/*" \
208
\! -path "third_party/$_lib/google/*" \
209
\! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
210
\! -regex '.*\.\(gn\|gni\|isolate\)' \
211
-delete
212
done
213
214
./build/linux/unbundle/replace_gn_files.py \
215
--system-libraries "${!_system_libs[@]}"
216
217
# Generate missing header
218
python3 build/util/lastchange.py -m DAWN_COMMIT_HASH \
219
-s third_party/dawn --revision gpu/webgpu/DAWN_VERSION \
220
--header gpu/webgpu/dawn_commit_hash.h
221
}
222
223
build() {
224
make -C chromium-launcher-$_launcher_ver
225
226
cd "$_pkgname-$pkgver"
227
228
if (( _system_clang )); then
229
export CC=clang
230
export CXX=clang++
231
export AR=ar
232
export NM=nm
233
else
234
local _clang_path="$PWD/third_party/llvm-build/Release+Asserts/bin"
235
export CC=$_clang_path/clang
236
export CXX=$_clang_path/clang++
237
export AR=$_clang_path/llvm-ar
238
export NM=$_clang_path/llvm-nm
239
fi
240
241
local _flags=(
242
'custom_toolchain="//build/toolchain/linux/unbundle:default"'
243
'host_toolchain="//build/toolchain/linux/unbundle:default"'
244
'is_official_build=true' # implies is_cfi=true on x86_64
245
'symbol_level=0' # sufficient for backtraces on x86(_64)
246
'treat_warnings_as_errors=false'
247
'fatal_linker_warnings=false'
248
'disable_fieldtrial_testing_config=true'
249
'blink_enable_generated_code_formatting=false'
250
'ffmpeg_branding="Chrome"'
251
'proprietary_codecs=true'
252
'rtc_use_pipewire=true'
253
'link_pulseaudio=true'
254
'use_custom_libcxx=true' # https://github.com/llvm/llvm-project/issues/61705
255
'use_sysroot=false'
256
'use_system_libffi=true'
257
'enable_hangout_services_extension=false'
258
'enable_widevine=false'
259
'enable_nacl=false'
260
'use_qt5=false'
261
'use_qt6=true'
262
'moc_qt6_path="/usr/lib/qt6"'
263
"google_api_key=\"$_google_api_key\""
264
'use_clang_modules=false'
265
# from ArchARM to build with distcc, uncomment if you build with distcc
266
#'is_cfi=false'
267
#'use_gold=false'
268
#'clang_use_default_sample_profile=false'
269
#'chrome_pgo_phase=0'
270
)
271
272
if [[ -n ${_system_libs[icu]+set} ]]; then
273
_flags+=('icu_use_data_file=false')
274
fi
275
276
if (( _system_clang )); then
277
local _clang_version=$(
278
clang --version | grep -m1 version | sed 's/.* \([0-9]\+\).*/\1/')
279
280
_flags+=(
281
'clang_base_path="/usr"'
282
'clang_use_chrome_plugins=false'
283
"clang_version=\"$_clang_version\""
284
'chrome_pgo_phase=0' # needs newer clang to read the bundled PGO profile
285
)
286
287
# Allow the use of nightly features with stable Rust compiler
288
# https://github.com/ungoogled-software/ungoogled-chromium/pull/2696#issuecomment-1918173198
289
export RUSTC_BOOTSTRAP=1
290
291
_flags+=(
292
'rust_sysroot_absolute="/usr"'
293
'rust_bindgen_root="/usr"'
294
"rustc_version=\"$(rustc --version | awk '{ print $2 ;}')\""
295
)
296
fi
297
298
# Facilitate deterministic builds (taken from build/config/compiler/BUILD.gn)
299
CFLAGS+=' -Wno-builtin-macro-redefined'
300
CXXFLAGS+=' -Wno-builtin-macro-redefined'
301
CPPFLAGS+=' -D__DATE__= -D__TIME__= -D__TIMESTAMP__='
302
303
# Do not warn about unknown warning options
304
CFLAGS+=' -Wno-unknown-warning-option'
305
CXXFLAGS+=' -Wno-unknown-warning-option'
306
307
# Let Chromium set its own symbol level
308
CFLAGS=${CFLAGS/-g }
309
CXXFLAGS=${CXXFLAGS/-g }
310
311
# https://github.com/ungoogled-software/ungoogled-chromium-archlinux/issues/123
312
CFLAGS=${CFLAGS/-fexceptions}
313
CFLAGS=${CFLAGS/-fcf-protection}
314
CXXFLAGS=${CXXFLAGS/-fexceptions}
315
CXXFLAGS=${CXXFLAGS/-fcf-protection}
316
317
# This appears to cause random segfaults when combined with ThinLTO
318
# https://bugs.archlinux.org/task/73518
319
CFLAGS=${CFLAGS/-fstack-clash-protection}
320
CXXFLAGS=${CXXFLAGS/-fstack-clash-protection}
321
322
# https://crbug.com/957519#c122
323
CXXFLAGS=${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS}
324
325
if [[ $CARCH == aarch64 ]] || [[ $CARCH == riscv64 ]]; then
326
# On aarch64 and riscv64, certain files (e.g. in libvpx and libyuv) needs to
327
# be compiled with additional arch features (e.g. dotprod, sve, sme, rvv)
328
# Having an arch setting in the C(XX)FLAGS overrides those
329
# and causes compilation failure
330
CFLAGS="${CFLAGS/-march=*([^ ]) }"
331
CXXFLAGS="${CXXFLAGS/-march=*([^ ]) }"
332
fi
333
334
gn gen out/Release --args="${_flags[*]}"
335
ninja -C out/Release chrome chrome_sandbox chromedriver.unstripped
336
}
337
338
package() {
339
cd chromium-launcher-$_launcher_ver
340
make PREFIX=/usr DESTDIR="$pkgdir" install
341
install -Dvm644 LICENSE \
342
"$pkgdir/usr/share/licenses/chromium/LICENSE.launcher"
343
344
cd ../chromium-$pkgver
345
346
install -Dv out/Release/chrome "$pkgdir/usr/lib/chromium/chromium"
347
install -Dv out/Release/chromedriver.unstripped "$pkgdir/usr/bin/chromedriver"
348
install -Dvm4755 out/Release/chrome_sandbox "$pkgdir/usr/lib/chromium/chrome-sandbox"
349
350
install -Dvm644 chrome/installer/linux/common/desktop.template \
351
"$pkgdir/usr/share/applications/chromium.desktop"
352
install -Dvm644 chrome/app/resources/manpage.1.in \
353
"$pkgdir/usr/share/man/man1/chromium.1"
354
sed -i \
355
-e 's/@@MENUNAME/Chromium/g' \
356
-e 's/@@PACKAGE/chromium/g' \
357
-e 's/@@usr_bin_symlink_name/chromium/g' \
358
-e 's|@@uri_scheme|x-scheme-handler/chromium;|g' \
359
-e 's/@@extra_desktop_entries//g' \
360
"$pkgdir/usr/share/applications/chromium.desktop" \
361
"$pkgdir/usr/share/man/man1/chromium.1"
362
363
# Fill in common Chrome/Chromium AppData template with Chromium info
364
(
365
tmpl_file=chrome/installer/linux/common/appdata.xml.template
366
info_file=chrome/installer/linux/common/chromium-browser.info
367
. $info_file; PACKAGE=chromium
368
export $(grep -o '^[A-Z_]*' $info_file)
369
sed -E -e 's/@@([A-Z_]*)@@/\${\1}/g' -e '/<update_contact>/d' $tmpl_file | envsubst
370
) \
371
| install -Dvm644 /dev/stdin "$pkgdir/usr/share/metainfo/chromium.appdata.xml"
372
373
local toplevel_files=(
374
chrome_100_percent.pak
375
chrome_200_percent.pak
376
chrome_crashpad_handler
377
libqt6_shim.so
378
resources.pak
379
v8_context_snapshot.bin
380
381
# ANGLE
382
libEGL.so
383
libGLESv2.so
384
385
# SwiftShader ICD
386
libvk_swiftshader.so
387
libvulkan.so.1
388
vk_swiftshader_icd.json
389
)
390
391
if [[ -z ${_system_libs[icu]+set} ]]; then
392
toplevel_files+=(icudtl.dat)
393
fi
394
395
cp "${toplevel_files[@]/#/out/Release/}" "$pkgdir/usr/lib/chromium/"
396
install -Dvm644 -t "$pkgdir/usr/lib/chromium/locales" out/Release/locales/*.pak
397
398
for size in 24 48 64 128 256; do
399
install -Dvm644 "chrome/app/theme/chromium/product_logo_$size.png" \
400
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/chromium.png"
401
done
402
403
for size in 16 32; do
404
install -Dvm644 "chrome/app/theme/default_100_percent/chromium/product_logo_$size.png" \
405
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/chromium.png"
406
done
407
408
install -Dvm644 LICENSE "$pkgdir/usr/share/licenses/chromium/LICENSE"
409
}
410
411
# vim:set ts=2 sw=2 et:
412
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |