coccoc-browser-stable
MEDIUM
maintainer nanoka
3 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from a non-whitelisted host (coccoc.com), which is the official vendor domain; however, the lack of a source URL pointing to upstream-controlled infrastructure like GitHub/GitLab and the use of a personal email in the maintainer field slightly increase risk, though the binary is from the official vendor.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:53
"https://browser-linux.coccoc.com/deb/pool/main/${pkgname}_${pkgver}-${_pkgrel}_amd64.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (coccoc.com), which is the official vendor domain; however, the lack of a source URL pointing to upstream-controlled infrastructure like GitHub/GitLab and the use of a personal email in the maintainer field slightly increase risk, though the binary is from the official vendor.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Nguyen Hoang Ky <nhktmdzhg at gmail dot com>
2
pkgname=coccoc-browser-stable
3
_pkgname=coccoc-browser
4
pkgver=154.0.8037.106
5
pkgrel=1
6
_pkgrel=1
7
pkgdesc="The web browser from Coc Coc. Coc Coc is a browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier."
8
arch=('x86_64')
9
url="https://coccoc.com"
10
license=('LicenseRef-coccoc')
11
depends=(
12
'alsa-lib'
13
'at-spi2-core'
14
'bash'
15
'cairo'
16
'dbus'
17
'expat'
18
'glib2'
19
'glibc'
20
'hicolor-icon-theme'
21
'libcups'
22
'libgcc'
23
'libstdc++'
24
'libx11'
25
'libxcb'
26
'libxcomposite'
27
'libxdamage'
28
'libxext'
29
'libxfixes'
30
'libxkbcommon'
31
'libxrandr'
32
'mesa'
33
'nspr'
34
'nss'
35
'pango'
36
'qt5-base'
37
'systemd-libs'
38
'ttf-liberation'
39
'xdg-utils'
40
)
41
optdepends=(
42
'qt6-base: for Qt6 UI shim support'
43
'pipewire: WebRTC desktop sharing under Wayland'
44
'gnome-keyring: for storing passwords in GNOME keyring'
45
'kwallet: for storing passwords in KWallet'
46
)
47
provides=('coccoc-browser' 'coccoc')
48
conflicts=('coccoc-browser' 'coccoc')
49
options=('!strip' '!emptydirs')
50
install=${pkgname}.install
51
52
source=(
53
"https://browser-linux.coccoc.com/deb/pool/main/${pkgname}_${pkgver}-${_pkgrel}_amd64.deb"
54
"coccoc-browser-stable"
55
"LICENSE.html"
56
)
57
sha256sums=(
58
'32fdd2ec492fb2fa009161753851ea4ab539ae76f8b0ce440105b40142953cff'
59
'fae326b92e97b28dafc9e1ed3958486bb0455cb5cebe3cad3484f92bde30b804'
60
'22bf4605260a7432eee169b0afbfae6782b9812c2bc776fdc1a887f6e2b10ec6'
61
)
62
63
package() {
64
bsdtar -xf data.tar.xz -C "$pkgdir/"
65
66
# Launcher
67
install -m755 coccoc-browser-stable "$pkgdir/usr/bin/coccoc-browser-stable"
68
69
local icon_sizes=(16 24 32 48 64 128 256)
70
for size in "${icon_sizes[@]}"; do
71
install -Dm644 "$pkgdir/opt/coccoc/browser/product_logo_${size}.png" \
72
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/coccoc-browser.png"
73
rm "$pkgdir/opt/coccoc/browser/product_logo_${size}.png"
74
done
75
76
install -Dm644 LICENSE.html "$pkgdir/usr/share/licenses/${_pkgname}/LICENSE.html"
77
chmod -R go-w "$pkgdir"
78
rm -r "$pkgdir/etc/cron.daily/" "$pkgdir/opt/coccoc/browser/cron/"
79
chmod 4755 "$pkgdir/opt/coccoc/browser/chrome-sandbox"
80
}
81
Changes since previous scan
--- PKGBUILD @ 2026-10-25 00:20+++ PKGBUILD @ 2026-11-01 00:21@@ -1,7 +1,7 @@ # Maintainer: Nguyen Hoang Ky <nhktmdzhg at gmail dot com> pkgname=coccoc-browser-stable _pkgname=coccoc-browser-pkgver=152.0.7977.124+pkgver=154.0.8037.106 pkgrel=1 _pkgrel=1 pkgdesc="The web browser from Coc Coc. Coc Coc is a browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier."@@ -55,24 +55,24 @@ "LICENSE.html" ) sha256sums=(- 'fbe7bc55f76ec1a44fd65e2335b0387f6c224b3765b7fa9686fd737e1026112f'+ '32fdd2ec492fb2fa009161753851ea4ab539ae76f8b0ce440105b40142953cff' 'fae326b92e97b28dafc9e1ed3958486bb0455cb5cebe3cad3484f92bde30b804' '22bf4605260a7432eee169b0afbfae6782b9812c2bc776fdc1a887f6e2b10ec6' ) package() { bsdtar -xf data.tar.xz -C "$pkgdir/"- + # Launcher install -m755 coccoc-browser-stable "$pkgdir/usr/bin/coccoc-browser-stable"- + local icon_sizes=(16 24 32 48 64 128 256) for size in "${icon_sizes[@]}"; do install -Dm644 "$pkgdir/opt/coccoc/browser/product_logo_${size}.png" \ "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/coccoc-browser.png" rm "$pkgdir/opt/coccoc/browser/product_logo_${size}.png" done- + install -Dm644 LICENSE.html "$pkgdir/usr/share/licenses/${_pkgname}/LICENSE.html" chmod -R go-w "$pkgdir" rm -r "$pkgdir/etc/cron.daily/" "$pkgdir/opt/coccoc/browser/cron/"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 15:42:54 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |