cmux-browser-nightly-bin

MEDIUM

maintainer orphaned 0 votes scanned 2026-08-26 17:33:25.105383

View on AUR

Why flagged

A prebuilt binary .deb is downloaded from cmux.com (the project's own domain), which is plausible but unverifiable as an official release infrastructure; the checksum is provided so integrity is at least asserted, but the source is a rolling 'nightly' endpoint that could silently serve different binaries, and the package is new with few votes, making supply-chain substitution a realistic concern for an executable that runs with user privileges.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:52 source_x86_64=("cmux-linux-x64-${pkgver}.deb::https://cmux.com/api/download/browser-nightly/linux-x64/deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): A prebuilt binary .deb is downloaded from cmux.com (the project's own domain), which is plausible but unverifiable as an official release infrastructure; the checksum is provided so integrity is at least asserted, but the source is a rolling 'nightly' endpoint that could silently serve different binaries, and the package is new with few votes, making supply-chain substitution a realistic concern for an executable that runs with user privileges.

PKGBUILD

1 offending line(s) highlighted

      1# SPDX-License-Identifier: 0BSD
    
      2# Maintainer: Joel Tony <github@jaytau.com>
    
      3
    
      4pkgname=cmux-browser-nightly-bin
    
      5pkgver=151.0.7922.64
    
      6pkgrel=2
    
      7pkgdesc='Chromium browser and agent workspace with integrated terminal surfaces (nightly binary)'
    
      8arch=('x86_64')
    
      9url='https://cmux.com/linux'
    
      10license=('GPL-3.0-only')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'at-spi2-core'
    
      14  'ca-certificates'
    
      15  'cairo'
    
      16  'libcups'
    
      17  'dbus'
    
      18  'desktop-file-utils'
    
      19  'expat'
    
      20  'glib2'
    
      21  'glibc'
    
      22  'gtk3'
    
      23  'hicolor-icon-theme'
    
      24  'libgcc'
    
      25  'libglvnd'
    
      26  'libstdc++'
    
      27  'libx11'
    
      28  'libxcb'
    
      29  'libxcomposite'
    
      30  'libxdamage'
    
      31  'libxext'
    
      32  'libxfixes'
    
      33  'libxkbcommon'
    
      34  'libxrandr'
    
      35  'libxtst'
    
      36  'mesa'
    
      37  'nspr'
    
      38  'nss'
    
      39  'pango'
    
      40  'systemd-libs'
    
      41  'ttf-liberation'
    
      42  'vulkan-icd-loader'
    
      43  'xdg-utils'
    
      44)
    
      45optdepends=(
    
      46  'qt5-base: native integration on Qt 5 desktops'
    
      47  'qt6-base: native integration on Qt 6 desktops'
    
      48)
    
      49provides=("cmux-browser=${pkgver}" "cmux-browser-stable=${pkgver}")
    
      50conflicts=('cmux-browser' 'cmux-browser-stable')
    
      51options=('!strip')
    
      52source_x86_64=("cmux-linux-x64-${pkgver}.deb::https://cmux.com/api/download/browser-nightly/linux-x64/deb")
    
      53sha256sums_x86_64=('cf0371eedaa7fd0a4b452164724eacd7a215e8063585c6a052e7bc384cac2e0a')
    
      54
    
      55package() {
    
      56  bsdtar -xOf "$srcdir/cmux-linux-x64-${pkgver}.deb" data.tar.zst |
    
      57    bsdtar --no-same-owner -xf - -C "$pkgdir"
    
      58
    
      59  rm -rf "$pkgdir/etc" \
    
      60    "$pkgdir/opt/cmux/browser/apparmor.d" \
    
      61    "$pkgdir/opt/cmux/browser/cron"
    
      62  rm "$pkgdir/opt/cmux/browser/cmux-update-feed-url"
    
      63
    
      64  # Work around https://github.com/manaflow-ai/cmux-v2/issues/11 for this nightly.
    
      65  sed -i 's|"$HERE/chrome" "$@"|"$HERE/chrome" --enable-features=PartitionAllocDanglingPtr:type/cross_task "$@"|' \
    
      66    "$pkgdir/opt/cmux/browser/cmux-browser"
    
      67  grep -qF -- '--enable-features=PartitionAllocDanglingPtr:type/cross_task' \
    
      68    "$pkgdir/opt/cmux/browser/cmux-browser"
    
      69
    
      70  ln -s cmux-browser-stable "$pkgdir/usr/bin/cmux-browser"
    
      71
    
      72  local size
    
      73  for size in 16 24 32 48 64 128 256; do
    
      74    install -Dm644 "$pkgdir/opt/cmux/browser/product_logo_${size}.png" \
    
      75      "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/cmux-browser.png"
    
      76  done
    
      77}
    
      78

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 17:33:25	Medium	3
2026-08-26 17:30:31	Medium	3