ecosia-browser-bin

maintainer teoulas · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Downloads a prebuilt binary snap from api.snapcraft.io (Canonical's official Snap store API), which is a legitimate distribution channel but not the project's own infrastructure; the snap is a closed-source proprietary browser binary with a pinned revision and a sha256 checksum, so while the source is verifiable at this point, the snap store could serve different content for the same snap_id/revision in theory. The overall risk is moderate for a prebuilt proprietary browser binary, but not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:58 "${pkgname}-${pkgver}-${_snap_revision}.snap::https://api.snapcraft.io/api/v1/snaps/download/${_snap_id}_${_snap_revision}.snap"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads a prebuilt binary snap from api.snapcraft.io (Canonical's official Snap store API), which is a legitimate distribution channel but not the project's own infrastructure; the snap is a closed-source proprietary browser binary with a pinned revision and a sha256 checksum, so while the source is verifiable at this point, the snap store could serve different content for the same snap_id/revision in theory. The overall risk is moderate for a prebuilt proprietary browser binary, but not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Theo <teoulas@duck.com>
    
      2
    
      3pkgname=ecosia-browser-bin
    
      4pkgver=150.1.7871.10
    
      5pkgrel=1
    
      6pkgdesc='Ecosia Browser (prebuilt binary)'
    
      7arch=('x86_64')
    
      8url='https://www.ecosia.org/browser'
    
      9license=('LicenseRef-Proprietary')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'cairo'
    
      14  'dbus'
    
      15  'expat'
    
      16  'glib2'
    
      17  'glibc'
    
      18  'gtk3'
    
      19  'hicolor-icon-theme'
    
      20  'libcups'
    
      21  'libdrm'
    
      22  'libgcc'
    
      23  'libx11'
    
      24  'libxcb'
    
      25  'libxcomposite'
    
      26  'libxdamage'
    
      27  'libxext'
    
      28  'libxfixes'
    
      29  'libxkbcommon'
    
      30  'libxrandr'
    
      31  'libxss'
    
      32  'mesa'
    
      33  'nspr'
    
      34  'nss'
    
      35  'pango'
    
      36  'shared-mime-info'
    
      37  'systemd-libs'
    
      38  'ttf-font'
    
      39  'xdg-utils'
    
      40)
    
      41optdepends=(
    
      42  'gtk4: GTK 4 integration'
    
      43  'kdialog: native file dialogs under Plasma'
    
      44  'org.freedesktop.secrets: secure password storage'
    
      45  'pipewire: WebRTC desktop sharing under Wayland'
    
      46  'qt5-base: Qt 5 integration'
    
      47  'qt6-base: Qt 6 integration'
    
      48  'upower: Battery Status API support'
    
      49)
    
      50makedepends=('squashfs-tools')
    
      51provides=("ecosia-browser=${pkgver}")
    
      52conflicts=('ecosia-browser')
    
      53options=('!strip' '!debug')
    
      54
    
      55_snap_id='2MakkUunZD1vJLykl5QmmVDQAZdE84wY'
    
      56_snap_revision=3
    
      57source_x86_64=(
    
      58  "${pkgname}-${pkgver}-${_snap_revision}.snap::https://api.snapcraft.io/api/v1/snaps/download/${_snap_id}_${_snap_revision}.snap"
    
      59)
    
      60source=('ecosiabrowser.sh')
    
      61noextract=("${pkgname}-${pkgver}-${_snap_revision}.snap")
    
      62sha256sums=('43dd05c17af7504ed0267b8909e44e3aa1a03b1819415ab1559c143fc8a36efb')
    
      63sha256sums_x86_64=('81385d48b89fb869e9ebb0ad8d46a76c6860395a73e60804611cd20b748c4b75')
    
      64
    
      65prepare() {
    
      66  rm -rf snap-root
    
      67  unsquashfs -q -d snap-root \
    
      68    "${pkgname}-${pkgver}-${_snap_revision}.snap" \
    
      69    opt/ecosia \
    
      70    usr/share/applications/org.ecosia.Browser.desktop \
    
      71    app/share/icons/hicolor/scalable/apps/org.ecosia.Browser.svg \
    
      72    app/share/metainfo/org.ecosia.Browser.metainfo.xml
    
      73
    
      74  # The Snap desktop file points at the icon's path inside its confinement.
    
      75  sed -i 's|^Icon=/app/share/icons/hicolor/scalable/apps/org\.ecosia\.Browser\.svg$|Icon=org.ecosia.Browser|' \
    
      76    snap-root/usr/share/applications/org.ecosia.Browser.desktop
    
      77}
    
      78
    
      79package() {
    
      80  install -d "${pkgdir}/opt"
    
      81  cp -a snap-root/opt/ecosia "${pkgdir}/opt/ecosia"
    
      82
    
      83  install -Dm755 ecosiabrowser.sh "${pkgdir}/usr/bin/ecosiabrowser"
    
      84  install -Dm644 snap-root/usr/share/applications/org.ecosia.Browser.desktop \
    
      85    "${pkgdir}/usr/share/applications/org.ecosia.Browser.desktop"
    
      86  install -Dm644 snap-root/app/share/icons/hicolor/scalable/apps/org.ecosia.Browser.svg \
    
      87    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.ecosia.Browser.svg"
    
      88  install -Dm644 snap-root/app/share/metainfo/org.ecosia.Browser.metainfo.xml \
    
      89    "${pkgdir}/usr/share/metainfo/org.ecosia.Browser.metainfo.xml"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 17:31:30	MEDIUM	3
2026-07-24 17:28:09	MEDIUM	2