coccoc-browser-stable

MEDIUM

maintainer nanoka 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb binary from a non-whitelisted, project-specific host (browser-linux.coccoc.com), which presents a supply-chain risk if the host were compromised or the download redirected, though the checksum is verified.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:53 "https://browser-linux.coccoc.com/deb/pool/main/${pkgname}_${pkgver}-${_pkgrel}_amd64.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted, project-specific host (browser-linux.coccoc.com), which presents a supply-chain risk if the host were compromised or the download redirected, though the checksum is verified.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nguyen Hoang Ky <nhktmdzhg at gmail dot com>
    
      2pkgname=coccoc-browser-stable
    
      3_pkgname=coccoc-browser
    
      4pkgver=149.0.7827.208
    
      5pkgrel=1
    
      6_pkgrel=1
    
      7pkgdesc="The web browser from Coc Coc. Coc Coc is a browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier."
    
      8arch=('x86_64')
    
      9url="https://coccoc.com"
    
      10license=('LicenseRef-coccoc')
    
      11depends=(
    
      12    'alsa-lib'
    
      13    'at-spi2-core'
    
      14    'bash'
    
      15    'cairo'
    
      16    'dbus'
    
      17    'expat'
    
      18    'glib2'
    
      19    'glibc'
    
      20    'hicolor-icon-theme'
    
      21    'libcups'
    
      22    'libgcc'
    
      23    'libstdc++'
    
      24    'libx11'
    
      25    'libxcb'
    
      26    'libxcomposite'
    
      27    'libxdamage'
    
      28    'libxext'
    
      29    'libxfixes'
    
      30    'libxkbcommon'
    
      31    'libxrandr'
    
      32    'mesa'
    
      33    'nspr'
    
      34    'nss'
    
      35    'pango'
    
      36    'qt5-base'
    
      37    'systemd-libs'
    
      38    'ttf-liberation'
    
      39    'xdg-utils'
    
      40)
    
      41optdepends=(
    
      42    'qt6-base: for Qt6 UI shim support'
    
      43    'pipewire: WebRTC desktop sharing under Wayland'
    
      44    'gnome-keyring: for storing passwords in GNOME keyring'
    
      45    'kwallet: for storing passwords in KWallet'
    
      46)
    
      47provides=('coccoc-browser' 'coccoc')
    
      48conflicts=('coccoc-browser' 'coccoc')
    
      49options=('!strip' '!emptydirs')
    
      50install=${pkgname}.install
    
      51
    
      52source=(
    
      53    "https://browser-linux.coccoc.com/deb/pool/main/${pkgname}_${pkgver}-${_pkgrel}_amd64.deb"
    
      54    "coccoc-browser-stable"
    
      55    "LICENSE.html"
    
      56)
    
      57sha256sums=(
    
      58    '96e2fb71af9fa83f3bd5207dedeff9f9933618190469d8e59bf4ce3596d49556'
    
      59    'fae326b92e97b28dafc9e1ed3958486bb0455cb5cebe3cad3484f92bde30b804'
    
      60    '22bf4605260a7432eee169b0afbfae6782b9812c2bc776fdc1a887f6e2b10ec6'
    
      61)
    
      62
    
      63package() {
    
      64    bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      65    
    
      66    # Launcher
    
      67    install -m755 coccoc-browser-stable "$pkgdir/usr/bin/coccoc-browser-stable"
    
      68    
    
      69    local icon_sizes=(16 24 32 48 64 128 256)
    
      70    for size in "${icon_sizes[@]}"; do
    
      71        install -Dm644 "$pkgdir/opt/coccoc/browser/product_logo_${size}.png" \
    
      72        "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/coccoc-browser.png"
    
      73        rm "$pkgdir/opt/coccoc/browser/product_logo_${size}.png"
    
      74    done
    
      75    
    
      76    install -Dm644 LICENSE.html "$pkgdir/usr/share/licenses/${_pkgname}/LICENSE.html"
    
      77    chmod -R go-w "$pkgdir"
    
      78    rm -r "$pkgdir/etc/cron.daily/" "$pkgdir/opt/coccoc/browser/cron/"
    
      79    chmod 4755 "$pkgdir/opt/coccoc/browser/chrome-sandbox"
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2