cronet

maintainer the-k · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from a Google-hosted storage URL, which is non-standard but plausibly official for Chromium; the source is used to build the project's own code, a normal practice in AUR packages, and the checksum is provided, reducing risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a source tarball from a Google-hosted storage URL, which is non-standard but plausibly official for Chromium; the source is used to build the project's own code, a normal practice in AUR packages, and the checksum is provided, reducing risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 source=("https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$pkgver-lite.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1#!/bin/bash -e
    
      2#
    
      3# Based on https://github.com/lubo/archlinux-chromium.
    
      4# Maintainer: Ľubomír 'the-k' Kučera <lubomir.kucera.jr at gmail.com>
    
      5
    
      6pkgname=cronet
    
      7pkgver=144.0.7559.258
    
      8pkgrel=1
    
      9epoch=1
    
      10_manual_clone=1
    
      11# The following error occures on Abseil 20250512.0:
    
      12# Protoc has returned non-zero status: -4
    
      13_system_abseil=0
    
      14_system_clang=1
    
      15# ../../net/cookies/cookie_util.cc:819:31: error: no viable conversion from 'const_iterator' (aka 'const char *') to 'std::string::const_iterator' (aka '__normal_iterator<const char *, std::basic_string<char, std::char_traits<char>, std::allocator<char>>>')
    
      16_system_stdlib=
    
      17pkgdesc="The networking stack of Chromium put into a library"
    
      18arch=('x86_64')
    
      19url="https://chromium.googlesource.com/chromium/src/+/refs/heads/main/components/cronet"
    
      20license=('BSD-3-Clause')
    
      21depends=(
    
glibc
    
nspr
    
nss
    
      25)
    
      26makedepends=(
    
at-spi2-core
    
clang
    
compiler-rt
    
gn
    
gtk3
    
libcups
    
libffi
    
libva
    
libxkbcommon
    
lld
    
ninja
    
pango
    
python
    
rust
    
rust-bindgen
    
      42)
    
      43options=('!lto') # Chromium adds its own flags for ThinLTO
    
      44source=("https://commondatastorage.googleapis.com/chromium-browser-official/chromium-$pkgver-lite.tar.xz"
    
      compiler-rt-adjust-paths.patch
    
      increase-fortify-level.patch
    
      abseil-fix-missing-algorithm.patch
    
      abseil-remove-unused-targets.patch
    
      disable-logging.patch
    
      fix-no-matching-strcat.patch
    
      fix-trust-store-segfault.patch
    
      fix-undeclared-identifiers.patch
    
      53)
    
      54sha256sums=('653ac5ddbbb09d22fafe133c81eab28b89570c934d9f01bada892a135cdad2f7'
    
          'ec8e49b7114e2fa2d359155c9ef722ff1ba5fe2c518fa48e30863d71d3b82863'
    
          'd634d2ce1fc63da7ac41f432b1e84c59b7cceabf19d510848a7cff40c8025342'
    
          'f7888650e5bea3dd5aad6f6b57453e5b38db5dccb9d8f870b208bd94be625495'
    
          'ec6b7a8c7ed4eeb30195e9b83b65cf8d17c7289f02eeb5149bb674cb7561495b'
    
          'b11ff1f8364c51c7d18fbb65fc76e25ca8a2095cece50c32452c0f25f03e270e'
    
          '2c5ecc12109ce41f9799dcac5c270684a433f8806816971b41cbae8b55adc586'
    
          'c88d778c462503b9cdd903668d977d1e9bbddd691d8207c98211882f57ab435d'
    
          '062919e45df0154b9f198f3686fd58c4598b229549f7ad1bc20d3f53798749f1')
    
      63
    
      64if (( _manual_clone )); then
    
source[0]=fetch-chromium-release
    
sha256sums[0]=SKIP
    
makedepends+=('git' 'python-httplib2' 'python-pyparsing' 'python-six')
    
      68fi
    
      69
    
      70declare -gA _depends=(
    
[glib2]="libgio-2.0.so libglib-2.0.so libgobject-2.0.so"
    
[libgcc]="libgcc_s.so"
    
      73)
    
      74
    
      75_ABSEIL_PKG="abseil-cpp>=20240722.0"
    
      76declare -gA _MAKE_TO_RUNTIME_DEPENDS=(
    
["${_ABSEIL_PKG}"]="${_ABSEIL_PKG}"
    
[brotli]="libbrotlidec.so"
    
[double-conversion]="double-conversion"
    
[icu]="libicui18n.so libicuuc.so"
    
[re2]="libre2.so"
    
[zlib]="libz.so"
    
[zstd]="libzstd.so"
    
      84)
    
      85
    
      86# Possible replacements are listed in build/linux/unbundle/replace_gn_files.py
    
      87# Keys are the names in the above script; values are the dependencies in Arch
    
      88declare -gA _system_libs=(
    
[brotli]=brotli
    
[double-conversion]=double-conversion
    
[icu]=icu
    
[zlib]=zlib
    
[zstd]=zstd
    
      94)
    
      95declare -gA _system_make_libs=(
    
[jsoncpp]=jsoncpp
    
      97)
    
      98_unwanted_bundled_libs=(
    
third_party/brotli
    
third_party/crc32c
    
third_party/dav1d
    
base/third_party/double_conversion
    
third_party/ffmpeg
    
third_party/flac
    
third_party/flatbuffers
    
third_party/fontconfig
    
build/config/freetype
    
third_party/harfbuzz-ng
    
third_party/highway
    
third_party/icu
    
third_party/jsoncpp
    
third_party/libaom
    
third_party/libdrm
    
third_party/libjpeg_turbo
    
third_party/libpng
    
third_party/libsecret
    
third_party/libusb
    
third_party/libvpx
    
third_party/libwebp
    
third_party/libxml
    
third_party/angle/src/third_party/libXNVCtrl
    
third_party/libxslt
    
third_party/libyuv
    
third_party/openh264
    
third_party/opus
    
third_party/snappy
    
third_party/swiftshader/third_party/SPIRV-Headers
    
third_party/swiftshader/third_party/SPIRV-Tools
    
third_party/spirv-headers/src
    
third_party/spirv-tools/src
    
third_party/vulkan_memory_allocator
    
third_party/woff2
    
third_party/zlib
    
third_party/zstd
    
      135
    
third_party/node
    
third_party/jdk
    
      138)
    
      139
    
      140# System Abseil needs libstdc++.
    
      141# https://stackoverflow.com/q/12542971
    
      142if [[ "${_system_stdlib}" != libstdc++ ]]; then
    
_system_abseil=0
    
      144fi
    
      145if (( _system_abseil )); then
    
# shellcheck disable=SC2192
    
_system_libs+=(
    
  [absl_algorithm]=
    
  [absl_base]="${_ABSEIL_PKG}"
    
  [absl_cleanup]=
    
  [absl_container]=
    
  [absl_crc]=
    
  [absl_debugging]=
    
  [absl_flags]=
    
  [absl_functional]=
    
  [absl_hash]=
    
  [absl_log]=
    
  [absl_log_internal]=
    
  [absl_memory]=
    
  [absl_meta]=
    
  [absl_numeric]=
    
  [absl_random]=
    
  [absl_status]=
    
  [absl_strings]=
    
  [absl_synchronization]=
    
  [absl_time]=
    
  [absl_types]=
    
  [absl_utility]=
    
)
    
_unwanted_bundled_libs+=(
    
  third_party/abseil-cpp/absl/algorithm
    
  third_party/abseil-cpp/absl/base
    
  third_party/abseil-cpp/absl/cleanup
    
  third_party/abseil-cpp/absl/container
    
  third_party/abseil-cpp/absl/crc
    
  third_party/abseil-cpp/absl/debugging
    
  third_party/abseil-cpp/absl/flags
    
  third_party/abseil-cpp/absl/functional
    
  third_party/abseil-cpp/absl/hash
    
  third_party/abseil-cpp/absl/log
    
  third_party/abseil-cpp/absl/log/internal
    
  third_party/abseil-cpp/absl/memory
    
  third_party/abseil-cpp/absl/meta
    
  third_party/abseil-cpp/absl/numeric
    
  third_party/abseil-cpp/absl/random
    
  third_party/abseil-cpp/absl/status
    
  third_party/abseil-cpp/absl/strings
    
  third_party/abseil-cpp/absl/synchronization
    
  third_party/abseil-cpp/absl/time
    
  third_party/abseil-cpp/absl/types
    
  third_party/abseil-cpp/absl/utility
    
)
    
      193fi
    
      194
    
      195case "${_system_stdlib}" in
    
      196"")
    
;;
    
      198*)
    
_unwanted_bundled_libs+=(
    
  third_party/libc++
    
  third_party/libc++abi
    
)
    
;;&
    
      204libc++)
    
depends+=(
    
  libc++
    
)
    
;;
    
      209libstdc++)
    
_depends+=(
    
  [libstdc++]="libstdc++.so"
    
)
    
_system_libs+=(
    
  [re2]=re2
    
)
    
_unwanted_bundled_libs+=(
    
  third_party/re2
    
)
    
;;
    
      220esac
    
      221
    
      222# shellcheck disable=SC2068
    
      223for _make_pkg in ${_system_libs[@]}; do
    
_runtime_pkg="${_MAKE_TO_RUNTIME_DEPENDS["${_make_pkg}"]}"
    
      225
    
if [[ "${_make_pkg}" = "${_runtime_pkg}" ]]; then
    
  depends+=("${_runtime_pkg}")
    
else
    
  _depends["${_make_pkg}"]="${_runtime_pkg}"
    
fi
    
      231done
    
      232
    
      233makedepends+=(
    
"${!_depends[@]}"
    
"${_system_make_libs[@]}"
    
      236)
    
      237
    
      238prepare() {
    
if (( _manual_clone )); then
    
  ./fetch-chromium-release $pkgver
    
fi
    
cd chromium-$pkgver
    
      243
    
# Allow building against system libraries in official builds
    
sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' \
    
  tools/generate_shim_headers/generate_shim_headers.py
    
      247
    
# Upstream fixes
    
      249
    
if (( _system_clang )); then
    
  # Allow libclang_rt.builtins from compiler-rt >= 16 to be used
    
  patch -Np1 -i ../compiler-rt-adjust-paths.patch
    
fi
    
      254
    
# Increase _FORTIFY_SOURCE level to match Arch's default flags
    
patch -Np1 -i ../increase-fortify-level.patch
    
      257
    
# Fixes the build crashing with the following errors:
    
# ../../base/debug/proc_maps_linux.cc:202:18: error: use of undeclared identifier 'strlen'
    
# ../../components/cronet/native/engine.cc:155:8: error: use of undeclared identifier 'isnan'
    
# implicit instantiation of undefined template 'std::numeric_limits<unsigned long>'
    
# ../../net/third_party/quiche/src/quiche/common/quiche_buffer_allocator.h:94:5: error: use of undeclared identifier 'memcpy'
    
patch -p0 -i ../fix-undeclared-identifiers.patch
    
      264
    
# Disables logging as it's unconfigurable, which is undesired in a library
    
patch -p0 -i ../disable-logging.patch
    
      267
    
if (( _system_abseil )); then
    
  # Fixes building with system Abseil
    
  patch -p0 -i ../abseil-fix-missing-algorithm.patch
    
  patch -p0 -i ../abseil-remove-unused-targets.patch
    
fi
    
      273
    
# Fixes the following error:
    
# ../../net/third_party/quiche/src/quiche/web_transport/encapsulated/encapsulated_web_transport.cc:351:16: error: no matching function for call to 'StrCat'
    
patch -p0 -i ../fix-no-matching-strcat.patch
    
      277
    
# Fixes segfault caused by `command_line` being null
    
patch -p0 -i ../fix-trust-store-segfault.patch
    
      280
    
if (( !_system_clang )); then
    
  # Use prebuilt rust as system rust cannot be used due to the error:
    
  #   error: the option `Z` is only accepted on the nightly compiler
    
  ./tools/rust/update_rust.py
    
      285
    
  # To link to rust libraries we need to compile with prebuilt clang
    
  ./tools/clang/scripts/update.py
    
else
    
  # To use correct libadler2 lib
    
  # See also: https://github.com/ungoogled-software/ungoogled-chromium/pull/3598
    
  sed -i 's/rustc_nightly_capability = use_chromium_rust_toolchain/rustc_nightly_capability = true/' \
    
    build/config/rust.gni
    
fi
    
      294
    
# Remove bundled libraries for which we will use the system copies; this
    
# *should* do what the remove_bundled_libraries.py script does, with the
    
# added benefit of not having to list all the remaining libraries
    
local _lib
    
for _lib in "${_unwanted_bundled_libs[@]}"; do
    
  find "$_lib" -type f \
    
    \! -path "$_lib/chromium/*" \
    
    \! -path "$_lib/google/*" \
    
    \! -path "third_party/abseil-cpp/absl/base/internal/raw_logging.h" \
    
    \! -regex '.*\.\(gn\|gni\|isolate\)' \
    
    -delete
    
done
    
      307
    
./build/linux/unbundle/replace_gn_files.py \
    
  --system-libraries "${!_system_libs[@]}" "${!_system_make_libs[@]}"
    
      310}
    
      311
    
      312build() {
    
cd chromium-$pkgver
    
      314
    
if (( _system_clang )); then
    
  export CC=clang
    
  export CXX=clang++
    
  export AR=ar
    
  export NM=nm
    
else
    
  local _clang_path="$PWD/third_party/llvm-build/Release+Asserts/bin"
    
  export CC=$_clang_path/clang
    
  export CXX=$_clang_path/clang++
    
  export AR=$_clang_path/llvm-ar
    
  export NM=$_clang_path/llvm-nm
    
fi
    
      327
    
local _flags=(
    
  'custom_toolchain="//build/toolchain/linux/unbundle:default"'
    
  'host_toolchain="//build/toolchain/linux/unbundle:default"'
    
  'is_official_build=true' # implies is_cfi=true on x86_64
    
  'symbol_level=0' # sufficient for backtraces on x86(_64)
    
  'treat_warnings_as_errors=false'
    
  'fatal_linker_warnings=false'
    
  'disable_fieldtrial_testing_config=true'
    
  'use_sysroot=false'
    
  'use_system_libffi=true'
    
  'use_clang_modules=false'
    
)
    
      340
    
if [[ -n ${_system_libs[icu]+set} ]]; then
    
  _flags+=('icu_use_data_file=false')
    
fi
    
      344
    
if (( _system_clang )); then
    
  local _clang_version
    
  _clang_version=$(
    
     clang --version | grep -m1 version | sed 's/.* \([0-9]\+\).*/\1/')
    
      349
    
  _flags+=(
    
    'clang_base_path="/usr"'
    
    'clang_use_chrome_plugins=false'
    
    "clang_version=\"$_clang_version\""
    
    'chrome_pgo_phase=0' # needs newer clang to read the bundled PGO profile
    
  )
    
      356
    
  # Allow the use of nightly features with stable Rust compiler
    
  # https://github.com/ungoogled-software/ungoogled-chromium/pull/2696#issuecomment-1918173198
    
  export RUSTC_BOOTSTRAP=1
    
      360
    
  _flags+=(
    
    'rust_sysroot_absolute="/usr"'
    
    'rust_bindgen_root="/usr"'
    
    "rustc_version=\"$(rustc --version)\""
    
  )
    
fi
    
      367
    
case "${_system_stdlib}" in
    
libc++)
    
  CXXFLAGS+=' -stdlib=libc++'
    
  LDFLAGS+=' -stdlib=libc++'
    
  ;&
    
libstdc++)
    
  _flags+=(
    
    'use_custom_libcxx=false'
    
  )
    
  ;;
    
esac
    
      379
    
if (( _system_abseil )); then
    
  # Fixes https://github.com/abseil/abseil-cpp/issues/1747
    
  # ld.lld: error: undefined symbol: absl::lts_20250127::log_internal::LogMessage& absl::lts_20250127::log_internal::LogMessage::operator<<<unsigned long, 0>(unsigned long const&)
    
  CXXFLAGS+=' -fclang-abi-compat=17'
    
fi
    
      385
    
# Facilitate deterministic builds (taken from build/config/compiler/BUILD.gn)
    
CFLAGS+='   -Wno-builtin-macro-redefined'
    
CXXFLAGS+=' -Wno-builtin-macro-redefined'
    
CPPFLAGS+=' -D__DATE__=  -D__TIME__=  -D__TIMESTAMP__='
    
      390
    
# Do not warn about unknown warning options
    
CFLAGS+='   -Wno-unknown-warning-option'
    
CXXFLAGS+=' -Wno-unknown-warning-option'
    
      394
    
# Let Chromium set its own symbol level
    
CFLAGS=${CFLAGS/-g }
    
CXXFLAGS=${CXXFLAGS/-g }
    
      398
    
# https://github.com/ungoogled-software/ungoogled-chromium-archlinux/issues/123
    
CFLAGS=${CFLAGS/-fexceptions}
    
CFLAGS=${CFLAGS/-fcf-protection}
    
CXXFLAGS=${CXXFLAGS/-fexceptions}
    
CXXFLAGS=${CXXFLAGS/-fcf-protection}
    
      404
    
# This appears to cause random segfaults when combined with ThinLTO
    
# https://bugs.archlinux.org/task/73518
    
CFLAGS=${CFLAGS/-fstack-clash-protection}
    
CXXFLAGS=${CXXFLAGS/-fstack-clash-protection}
    
      409
    
# https://crbug.com/957519#c122
    
CXXFLAGS=${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS}
    
      412
    
if [[ $CARCH == aarch64 ]] || [[ $CARCH == riscv64 ]]; then
    
  # On aarch64 and riscv64, certain files (e.g. in libvpx and libyuv) needs to
    
  # be compiled with additional arch features (e.g. dotprod, sve, sme, rvv)
    
  # Having an arch setting in the C(XX)FLAGS overrides those
    
  # and causes compilation failure
    
  CFLAGS="${CFLAGS/-march=*([^ ]) }"
    
  CXXFLAGS="${CXXFLAGS/-march=*([^ ]) }"
    
fi
    
      421
    
gn gen out/Release --args="${_flags[*]}"
    
ninja -C out/Release cronet_package
    
      424}
    
      425
    
      426check() {
    
cd "chromium-${pkgver}"
    
      428
    
# cronet_tests isn't linked against the shared object.
    
ninja -C out/Release cronet_sample
    
      431
    
./out/Release/cronet_sample
    
      433}
    
      434
    
      435package() {
    
# shellcheck disable=SC2206
    
depends+=(
    
  ${_depends[@]}
    
)
    
      440
    
: "${pkgdir:?}"
    
      442
    
cd chromium-$pkgver/out/Release/cronet
    
      444
    
install -D "libcronet.${pkgver}.so" "${pkgdir}/usr/lib/libcronet.${pkgver}.so"
    
ln -s "libcronet.${pkgver}.so" "${pkgdir}/usr/lib/libcronet.so"
    
      447
    
cp -r include "${pkgdir}/usr"
    
      449
    
install -Dvm644 LICENSE "${pkgdir}/usr/share/licenses/cronet/LICENSE"
    
      451}
    
      452
    
"${arch[@]}"
    
"${depends[@]}"
    
"${epoch}"
    
"${license[@]}"
    
"${options[@]}"
    
"${sha256sums[@]}"
    
"${source[@]}"
    
"${pkgdesc}"
    
"${pkgname}"
    
"${pkgrel}"
    
"${url}"
    
      464
    
      465# vim:set ts=2 sw=2 et:
    
      466

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,7 +4,7 @@
 # Maintainer: Ľubomír 'the-k' Kučera <lubomir.kucera.jr at gmail.com>
 
 pkgname=cronet
-pkgver=144.0.7559.257
+pkgver=144.0.7559.258
 pkgrel=1
 epoch=1
 _manual_clone=1

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 15:12:02	MEDIUM	1
2026-07-29 13:11:48	MEDIUM	1
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2