chromium-snapshot-bin
MEDIUM
maintainer mrxx
494 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt binaries from an untrusted host (commondatastorage.googleapis.com) without verifiable checksums (sha1sums='SKIP'), creating a supply-chain risk if the source were compromised.
Triggered rules
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:20
_build=$(curl -s "https://commondatastorage.googleapis.com/chromium-browser-snapshots/Linux_x64/LAST_CHANGE")
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source=("chrome-linux-r$_build.zip::https://commondatastorage.googleapis.com/chromium-browser-snapshots/Linux_x64/$_build/chrome-linux.zip"
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads prebuilt binaries from an untrusted host (commondatastorage.googleapis.com) without verifiable checksums (sha1sums='SKIP'), creating a supply-chain risk if the source were compromised.
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: mrxx <mrxx at cyberhome dot at>
2
# Contributors: Det, Ner0, alexwizard, thotypous, jdhore, xduugu, randypenguin, bdheeman, AlK, zrhoffman
3
4
pkgname=chromium-snapshot-bin
5
_pkgname=${pkgname/chromium/chromedriver}
6
pkgver=156.0.8061.0.r1698379
7
pkgrel=1
8
pkgdesc="The open-source project behind Google Chrome (Latest Snapshot)"
9
arch=('x86_64')
10
url="https://build.chromium.org"
11
license=('BSD')
12
depends=('alsa-lib' 'gtk3' 'libcups' 'libxss' 'libxtst' 'nss')
13
optdepends=('kdialog: needed for file dialogs in KDE'
14
'gnome-keyring: for storing passwords in GNOME keyring'
15
'kwallet: for storing passwords in KWallet'
16
'flashplugin: support for Flash content'
17
'ttf-liberation: fix fonts for some PDFs [RBug #369991]')
18
provides=('chromium-snapshot')
19
install=$pkgname.install
20
_build=$(curl -s "https://commondatastorage.googleapis.com/chromium-browser-snapshots/Linux_x64/LAST_CHANGE")
21
source=("chrome-linux-r$_build.zip::https://commondatastorage.googleapis.com/chromium-browser-snapshots/Linux_x64/$_build/chrome-linux.zip"
22
"chromedriver_linux64-r$_build.zip::https://commondatastorage.googleapis.com/chromium-browser-snapshots/Linux_x64/$_build/chromedriver_linux64.zip"
23
"$pkgname.sh"
24
"$pkgname.desktop"
25
"$pkgname"_{16,22,24,32,48,64,128,256}.png
26
'LICENSE')
27
sha1sums=('SKIP'
28
'SKIP'
29
'12c3b365d3765ab8d049b517c3f598563ef0c45b'
30
'e64637c07b921f197fc1d7fd031c8a73ea3a55f8'
31
'1cbdde48d193a648723f948370eff9b7b2fbf3f9'
32
'97b440a273fd58543f62db639bdebc4d7a8029a5'
33
'4b66bbab5e153d8a3b37990956cf89b1a560c7a2'
34
'00ac07b06f29359b6c32dcf38731944afc5ec42d'
35
'7931235b59c485a412f8ef035285b54d7aa2a802'
36
'a3e3c729cb986fe9aecf6a892d947d728c6e616e'
37
'9f627ab21bb398c36f9231da15a53774deb05818'
38
'e39429069036a9e7c3a0003523a8c1c7565a3174'
39
'35b9154bfb51e35216877dbc9215a2d0ffde4571')
40
41
pkgver() {
42
echo $(chrome-linux/chrome --version | cut -d " " -f2).r$_build
43
}
44
45
package() {
46
msg2 "Creating directory structure..."
47
install -d "$pkgdir"/opt/
48
install -d "$pkgdir"/usr/bin/
49
install -d "$pkgdir"/usr/share/applications/
50
install -d "$pkgdir"/usr/share/licenses/${pkgname/-bin}/
51
install -d "$pkgdir"/usr/share/man/man1/
52
53
msg2 "Making it nice..."
54
sed 's/chrome/chromedriver/g' $pkgname.sh > ${_pkgname}.sh
55
# Permissions
56
find -type d -exec chmod 755 {} ';'
57
find -type f -exec chmod +r {} ';'
58
cd chrome-linux
59
chmod 755 chrome chrome-wrapper
60
chmod 4755 chrome_sandbox
61
mv ../chromedriver_linux64/chromedriver .
62
cd ..
63
64
msg2 "Moving contents..."
65
# Main script
66
install -m755 $pkgname.sh "$pkgdir"/usr/bin/$pkgname
67
install -m755 ${_pkgname}.sh "$pkgdir"/usr/bin/${_pkgname}
68
69
# Rename chrome-sandbox
70
mv chrome-linux/chrome{_,-}sandbox
71
72
# Desktop
73
install -m644 $pkgname.desktop "$pkgdir"/usr/share/applications/
74
75
# Icons
76
rm chrome-linux/product_logo_48.png
77
for i in 16 22 24 32 48 64 128 256; do
78
install -Dm644 ${pkgname}_${i}.png "$pkgdir"/usr/share/icons/hicolor/${i}x${i}/apps/$pkgname.png
79
done
80
81
# Man page
82
if [[ -f chrome-linux/chrome.1 ]]; then
83
gzip -9 chrome-linux/chrome.1
84
mv chrome-linux/chrome.1.gz "$pkgdir"/usr/share/man/man1/$pkgname.1.gz
85
fi
86
87
# License
88
install -m644 LICENSE "$pkgdir"/usr/share/licenses/${pkgname/-bin}/
89
90
msg2 "Installing main directory..."
91
mv chrome-linux/ "$pkgdir"/opt/${pkgname/-bin}
92
}
93
Changes since previous scan
--- PKGBUILD @ 2026-09-16 00:03+++ PKGBUILD @ 2026-09-17 00:27@@ -3,7 +3,7 @@ pkgname=chromium-snapshot-bin _pkgname=${pkgname/chromium/chromedriver}-pkgver=155.0.8038.0.r1690146+pkgver=156.0.8061.0.r1698379 pkgrel=1 pkgdesc="The open-source project behind Google Chrome (Latest Snapshot)" arch=('x86_64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 3 |
| 2026-09-16 21:23:45 | Medium | 3 |
| 2026-09-16 00:03:17 | Medium | 3 |
| 2026-09-15 00:25:31 | Medium | 3 |
| 2026-09-14 00:27:57 | Medium | 3 |
| 2026-09-13 00:19:54 | Medium | 3 |
| 2026-09-12 00:25:17 | Medium | 3 |
| 2026-09-11 00:19:22 | Medium | 3 |
| 2026-09-10 00:22:44 | Medium | 3 |
| 2026-09-09 00:04:09 | Medium | 3 |
| 2026-09-08 00:18:08 | Medium | 3 |
| 2026-09-07 00:30:15 | Medium | 3 |
| 2026-09-06 00:17:06 | Medium | 3 |
| 2026-09-05 00:16:27 | Medium | 3 |
| 2026-09-04 00:03:13 | Medium | 3 |
| 2026-09-03 00:15:47 | Medium | 3 |
| 2026-09-02 13:50:58 | Medium | 3 |
| 2026-09-02 00:02:31 | Medium | 3 |
| 2026-09-01 00:11:19 | Medium | 3 |
| 2026-08-31 00:19:57 | Medium | 3 |