chromium-widevine

MEDIUM

maintainer xAsh 429 votes scanned 2026-10-31 09:58:05.730906

View on AUR

Why flagged

The package downloads a prebuilt Chrome component (.crx3) from a Google domain, which is not on the standard AUR trust whitelist; while the source is from an official vendor (Google), the lack of a verifiable upstream URL and the use of a non-standard subdomain pattern raises supply-chain risk concerns, warranting medium severity until proven otherwise.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://www.google.com/dl/release2/chrome_component/${_release_id}_${pkgver}/oimompecagnajdejgnnjijobebaeigek_${pkgver}_linux64_${_file_id}.crx3")

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt Chrome component (.crx3) from a Google domain, which is not on the standard AUR trust whitelist; while the source is from an official vendor (Google), the lack of a verifiable upstream URL and the use of a non-standard subdomain pattern raises supply-chain risk concerns, warranting medium severity until proven otherwise.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ash <xash at riseup d0t net>
    
      2# Contributor: envolution
    
      3# Contributor: Doug Newgard <scimmia at archlinux dot org>
    
      4# shellcheck shell=bash disable=SC2034,SC2154
    
      5# ci|prebuild=_sourcefix.sh| https://github.com/envolution/aur/blob/main/maintain/build/chromium-widevine/_sourcefix.sh
    
      6
    
      7pkgname=chromium-widevine
    
      8pkgdesc='A browser plugin designed for the viewing of premium video content'
    
      9pkgver=4.10.3112.0
    
      10_release_id=acqexsh26ysyu3zxeotqtsp63idq
    
      11_file_id=ad7kyx4q7wx7xknykmkbonbbmnwq
    
      12pkgrel=1
    
      13epoch=1
    
      14arch=('x86_64')
    
      15url='https://www.widevine.com/'
    
      16license=('custom')
    
      17options=('!strip')
    
      18source=("https://www.google.com/dl/release2/chrome_component/${_release_id}_${pkgver}/oimompecagnajdejgnnjijobebaeigek_${pkgver}_linux64_${_file_id}.crx3")
    
      19sha256sums=('1bf1f200dcccd461b2d029d000d0fcf800f0571c932db31467b9d5d301e0a98f')
    
      20
    
      21package() {
    
      22  depends=('gcc-libs' 'glib2' 'glibc' 'nspr' 'nss')
    
      23
    
      24  install -Dm755 "${srcdir}/_platform_specific/linux_x64/libwidevinecdm.so" \
    
      25    "${pkgdir}/usr/lib/chromium/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so"
    
      26  install -Dm644 "${srcdir}/manifest.json" \
    
      27    "${pkgdir}/usr/lib/chromium/WidevineCdm/manifest.json"
    
      28  install -Dm644 "${srcdir}/LICENSE" \
    
      29    "${pkgdir}/usr/lib/chromium/WidevineCdm/LICENSE"
    
      30  install -Dm644 "${srcdir}/LICENSE" \
    
      31    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      32
    
      33  # backward compatibility
    
      34  ln -s WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so "$pkgdir/usr/lib/chromium/libwidevinecdm.so"
    
      35}
    
      36# vim:set ts=2 sw=2 et:
    
      37

Changes since previous scan

--- PKGBUILD @ 2026-09-07 00:30
+++ PKGBUILD @ 2026-10-31 09:58
@@ -1,19 +1,22 @@
-# Maintainer: envolution
+# Maintainer: Ash <xash at riseup d0t net>
+# Contributor: envolution
 # Contributor: Doug Newgard <scimmia at archlinux dot org>
 # shellcheck shell=bash disable=SC2034,SC2154
 # ci|prebuild=_sourcefix.sh| https://github.com/envolution/aur/blob/main/maintain/build/chromium-widevine/_sourcefix.sh
 
 pkgname=chromium-widevine
 pkgdesc='A browser plugin designed for the viewing of premium video content'
-pkgver=4.10.2934.0
+pkgver=4.10.3112.0
+_release_id=acqexsh26ysyu3zxeotqtsp63idq
+_file_id=ad7kyx4q7wx7xknykmkbonbbmnwq
 pkgrel=1
 epoch=1
 arch=('x86_64')
 url='https://www.widevine.com/'
 license=('custom')
 options=('!strip')
-source=(https://www.google.com/dl/release2/chrome_component/accssjtqfpf5qicscrptql4jyyxa_4.10.2934.0/oimompecagnajdejgnnjijobebaeigek_4.10.2934.0_linux_ph722a3wl2goebkpserszm6bde.crx3)
-sha256sums=('d36111684f13d2f76f181eb0117a873e12e4ee6f0f9a3027a9d022b787d74eb2')
+source=("https://www.google.com/dl/release2/chrome_component/${_release_id}_${pkgver}/oimompecagnajdejgnnjijobebaeigek_${pkgver}_linux64_${_file_id}.crx3")
+sha256sums=('1bf1f200dcccd461b2d029d000d0fcf800f0571c932db31467b9d5d301e0a98f')
 
 package() {
   depends=('gcc-libs' 'glib2' 'glibc' 'nspr' 'nss')

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-31 09:58:05	Medium	2
2026-09-07 00:30:15	Clean	3
2026-09-06 17:12:21	Medium	2
2026-06-20 16:02:46	Clean	2
2026-06-20 00:50:07	Medium	2
2026-06-20 00:18:46	Low	1
2026-06-19 23:51:18	Medium	2
2026-06-19 19:07:35	Low	2
2026-06-18 16:11:54	Low	1