coccoc-browser-stable

maintainer nanoka · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb binary from a non-whitelisted, project-specific host (browser-linux.coccoc.com), which presents a supply-chain risk if the host were compromised or the download redirected, though the checksum is verified.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:53 "https://browser-linux.coccoc.com/deb/pool/main/${pkgname}_${pkgver}-${_pkgrel}_amd64.deb"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted, project-specific host (browser-linux.coccoc.com), which presents a supply-chain risk if the host were compromised or the download redirected, though the checksum is verified.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nguyen Hoang Ky <nhktmdzhg at gmail dot com>
    
      2pkgname=coccoc-browser-stable
    
      3_pkgname=coccoc-browser
    
      4pkgver=149.0.7827.208
    
      5pkgrel=1
    
      6_pkgrel=1
    
      7pkgdesc="The web browser from Coc Coc. Coc Coc is a browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier."
    
      8arch=('x86_64')
    
      9url="https://coccoc.com"
    
      10license=('LicenseRef-coccoc')
    
      11depends=(
    
      12    'alsa-lib'
    
      13    'at-spi2-core'
    
      14    'bash'
    
      15    'cairo'
    
      16    'dbus'
    
      17    'expat'
    
      18    'glib2'
    
      19    'glibc'
    
      20    'hicolor-icon-theme'
    
      21    'libcups'
    
      22    'libgcc'
    
      23    'libstdc++'
    
      24    'libx11'
    
      25    'libxcb'
    
      26    'libxcomposite'
    
      27    'libxdamage'
    
      28    'libxext'
    
      29    'libxfixes'
    
      30    'libxkbcommon'
    
      31    'libxrandr'
    
      32    'mesa'
    
      33    'nspr'
    
      34    'nss'
    
      35    'pango'
    
      36    'qt5-base'
    
      37    'systemd-libs'
    
      38    'ttf-liberation'
    
      39    'xdg-utils'
    
      40)
    
      41optdepends=(
    
      42    'qt6-base: for Qt6 UI shim support'
    
      43    'pipewire: WebRTC desktop sharing under Wayland'
    
      44    'gnome-keyring: for storing passwords in GNOME keyring'
    
      45    'kwallet: for storing passwords in KWallet'
    
      46)
    
      47provides=('coccoc-browser' 'coccoc')
    
      48conflicts=('coccoc-browser' 'coccoc')
    
      49options=('!strip' '!emptydirs')
    
      50install=${pkgname}.install
    
      51
    
      52source=(
    
      53    "https://browser-linux.coccoc.com/deb/pool/main/${pkgname}_${pkgver}-${_pkgrel}_amd64.deb"
    
      54    "coccoc-browser-stable"
    
      55    "LICENSE.html"
    
      56)
    
      57sha256sums=(
    
      58    '96e2fb71af9fa83f3bd5207dedeff9f9933618190469d8e59bf4ce3596d49556'
    
      59    'fae326b92e97b28dafc9e1ed3958486bb0455cb5cebe3cad3484f92bde30b804'
    
      60    '22bf4605260a7432eee169b0afbfae6782b9812c2bc776fdc1a887f6e2b10ec6'
    
      61)
    
      62
    
      63package() {
    
      64    bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      65    
    
      66    # Launcher
    
      67    install -m755 coccoc-browser-stable "$pkgdir/usr/bin/coccoc-browser-stable"
    
      68    
    
      69    local icon_sizes=(16 24 32 48 64 128 256)
    
      70    for size in "${icon_sizes[@]}"; do
    
      71        install -Dm644 "$pkgdir/opt/coccoc/browser/product_logo_${size}.png" \
    
      72        "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/coccoc-browser.png"
    
      73        rm "$pkgdir/opt/coccoc/browser/product_logo_${size}.png"
    
      74    done
    
      75    
    
      76    install -Dm644 LICENSE.html "$pkgdir/usr/share/licenses/${_pkgname}/LICENSE.html"
    
      77    chmod -R go-w "$pkgdir"
    
      78    rm -r "$pkgdir/etc/cron.daily/" "$pkgdir/opt/coccoc/browser/cron/"
    
      79    chmod 4755 "$pkgdir/opt/coccoc/browser/chrome-sandbox"
    
      80}
    
      81

Changes since previous scan

--- PKGBUILD @ 2026-07-23 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Nguyen Hoang Ky <nhktmdzhg at gmail dot com>
 pkgname=coccoc-browser-stable
 _pkgname=coccoc-browser
-pkgver=147.0.7727.150
+pkgver=149.0.7827.208
 pkgrel=1
 _pkgrel=1
 pkgdesc="The web browser from Coc Coc. Coc Coc is a browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier."
@@ -55,7 +55,7 @@
     "LICENSE.html"
 )
 sha256sums=(
-    '33041142210774cc936391372f1840edafbf4ff78010606809ff0d8621719181'
+    '96e2fb71af9fa83f3bd5207dedeff9f9933618190469d8e59bf4ce3596d49556'
     'fae326b92e97b28dafc9e1ed3958486bb0455cb5cebe3cad3484f92bde30b804'
     '22bf4605260a7432eee169b0afbfae6782b9812c2bc776fdc1a887f6e2b10ec6'
 )

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 19:25:44	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2