electron15

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host is used to download a patchset tarball for Chromium, which is checksum-verified and part of a transparent build process; the source is not executed directly and the package builds from auditable upstream sources.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is used to download a patchset tarball for Chromium, which is checksum-verified and part of a transparent build process; the source is not executed directly and the package builds from auditable upstream sources.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:50 'git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#branch=main'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Luke Arms <luke@arms.to>
    
      2# Contributor: Nicola Squartini <tensor5@gmail.com>
    
      3
    
      4_use_suffix=1
    
      5pkgver=15.5.7
    
      6_commit=0b804177fae2655884018187f226154c7566512b
    
      7_chromiumver=94.0.4606.81
    
      8_gcc_patchset=3
    
      9# shellcheck disable=SC2034
    
      10pkgrel=1
    
      11
    
      12_major_ver=${pkgver%%.*}
    
      13if [[ ${_use_suffix} != 0 ]]; then
    
pkgname="electron${_major_ver}"
    
      15else
    
pkgname=electron
    
      17fi
    
      18# shellcheck disable=SC2034
    
      19pkgdesc='Build cross platform desktop apps with web technologies'
    
      20# shellcheck disable=SC2034
    
      21arch=('x86_64')
    
      22# shellcheck disable=SC2034
    
      23url='https://electronjs.org/'
    
      24# shellcheck disable=SC2034
    
      25license=('MIT' 'custom')
    
      26# shellcheck disable=SC2034
    
      27depends=('c-ares' 'ffmpeg' 'gtk3' 'libevent' 'libxslt' 'minizip' 'nss' 're2'
    
       'snappy')
    
      29# shellcheck disable=SC2034
    
      30makedepends=('clang' 'git' 'gn' 'gperf' 'harfbuzz-icu' 'http-parser'
    
           'java-runtime-headless' 'jsoncpp' 'libnotify' 'lld' 'llvm' 'ninja'
    
           'npm' 'pciutils' 'pipewire' 'python' 'python-httplib2'
    
           'python-pyparsing' 'python-six' 'wget' 'yarn')
    
      34# shellcheck disable=SC2034
    
      35optdepends=('kde-cli-tools: file deletion support (kioclient5)'
    
          'libappindicator-gtk3: StatusNotifierItem support'
    
          'pipewire: WebRTC desktop sharing under Wayland'
    
          'trash-cli: file deletion support (trash-put)'
    
          "xdg-utils: open URLs with desktop's default (xdg-email, xdg-open)")
    
      40if [[ ${_use_suffix} == 0 ]]; then
    
# shellcheck disable=SC2034
    
conflicts=("electron${_major_ver}")
    
# shellcheck disable=SC2034
    
provides=("electron${_major_ver}")
    
      45fi
    
      46# shellcheck disable=SC2034
    
      47options=('!lto') # Electron adds its own flags for ThinLTO
    
      48# shellcheck disable=SC2034
    
      49source=('git+https://github.com/electron/electron.git'
    
      'git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#branch=main'
    
      "https://github.com/stha09/chromium-patches/releases/download/chromium-${_chromiumver%%.*}-patchset-${_gcc_patchset}/chromium-${_chromiumver%%.*}-patchset-${_gcc_patchset}.tar.xz"
    
      "electron-launcher.sh"
    
      "electron.desktop"
    
      'default_app-icon.patch'
    
      'jinja-python-3.10.patch'
    
      'use-system-libraries-in-node.patch'
    
      'replace-blacklist-with-ignorelist.patch'
    
      'sql-make-VirtualCursor-standard-layout-type.patch'
    
      'unbundle-fix-visibility-of-build-config-freetype.patch'
    
      'gn-visibility-gmock.patch'
    
      'gn-visibility-mojo.patch'
    
      'gn-visibility-webrtc.patch'
    
      'add-a-TODO-about-a-missing-pnacl-flag.patch'
    
      'unexpire-accelerated-video-decode-flag.patch'
    
      'use-ffile-compilation-dir.patch'
    
      'sandbox-build-if-glibc-2.34-dynamic-stack-size-is-en.patch'
    
      'breakpad-fix-for-non-constant-SIGSTKSZ.patch'
    
     )
    
      69# shellcheck disable=SC2034
    
      70sha256sums=('SKIP'
    
          'SKIP'
    
          '22692bddaf2761c6ddf9ff0bc4722972bca4d4c5b2fd3e5dbdac7eb60d914320'
    
          '3953f532a3ea5fce19ee33600c6ead89dcd066df6a01d3c3ab4c24f96e46fca2'
    
          '4484200d90b76830b69eea3a471c103999a3ce86bb2c29e6c14c945bf4102bae'
    
          '75bac9c4ad32ff9329399b8587f9772e208c009fd822cdfce61b2bd1ee9ac828'
    
          '09de0ebb4002be7fb4ede63d3977e4f1235637750169c9e71bfdbd75bf750f7a'
    
          '7cb11fb44aaf4d15f36caca3c0d1b082a723c30d43cd44db147248db5683a2a9'
    
          'd3344ba39b8c6ed202334ba7f441c70d81ddf8cdb15af1aa8c16e9a3a75fbb35'
    
          'dd317f85e5abfdcfc89c6f23f4c8edbcdebdd5e083dcec770e5da49ee647d150'
    
          'd0b17162211dd49e3a58c16d1697e7d8c322dcfd3b7890f0c2f920b711f52293'
    
          'b9934e01d8f39beafc8b63784fb86e6befe25ca83e9c43224c8374e5a025d8ef'
    
          'cca2d224cf2e9d7cfb4f5729ca76b5b8a7100b1ca39892b41fb296adaced1bf7'
    
          '574785a21168c3e9b7aa82630713ceb6ced12f699133db66b10fc84b7bb2c631'
    
          'd53da216538f2e741a6e048ed103964a91a98e9a3c10c27fdfa34d4692fdc455'
    
          '2a97b26c3d6821b15ef4ef1369905c6fa3e9c8da4877eb9af4361452a425290b'
    
          '921010cd8fab5f30be76c68b68c9b39fac9e21f4c4133bb709879592bbdf606e'
    
          'f910be9370c880de6e1d61cc30383c069e421d7acf406166e4fbfad324fc7d61'
    
          'b4d28867c1fabde6c50a2cfa3f784730446c4d86e5191e0f0000fbf7b0f91ecf')
    
      89
    
      90_system_libs=('ffmpeg'
    
            'flac'
    
            'fontconfig'
    
            'freetype'
    
            'harfbuzz-ng'
    
            'icu'
    
            'libdrm'
    
            'libevent'
    
            'libjpeg'
    
            'libpng'
    
      100#              'libvpx'
    
            'libwebp'
    
            'libxml'
    
            'libxslt'
    
      104#              'openh264'
    
            'opus'
    
            're2'
    
            'snappy'
    
            'zlib'
    
           )
    
      110
    
      111prepare() {
    
sed -i "s|@ELECTRON@|${pkgname}|" electron-launcher.sh
    
sed -i "s|@ELECTRON@|${pkgname}|" electron.desktop
    
if [[ ${_use_suffix} != 0 ]]; then
    
  sed -i "s|@ELECTRON_NAME@|Electron ${_major_ver}|" electron.desktop
    
else
    
  sed -i "s|@ELECTRON_NAME@|Electron|" electron.desktop
    
fi
    
      119
    
export PATH="${PATH}:${srcdir:?}/depot_tools"
    
      121
    
echo "Fetching chromium..."
    
git clone --branch=${_chromiumver} --depth=1 \
    
    https://chromium.googlesource.com/chromium/src.git
    
      125
    
echo "solutions = [
    
{
    
  \"name\": \"src/electron\",
    
  \"url\": \"file://${srcdir}/electron@${_commit}\",
    
  \"deps_file\": \"DEPS\",
    
  \"managed\": False,
    
  \"custom_deps\": {
    
    \"src\": None,
    
  },
    
  \"custom_vars\": {},
    
},
    
      137]" > .gclient
    
      138
    
python "${srcdir}/depot_tools/gclient.py" sync \
    
    --with_branch_heads \
    
    --with_tags \
    
    --nohooks
    
      143
    
echo "Running hooks..."
    
# python "${srcdir}/depot_tools/gclient.py" runhooks
    
src/build/landmines.py
    
src/build/util/lastchange.py -o src/build/util/LASTCHANGE
    
src/build/util/lastchange.py -m GPU_LISTS_VERSION \
    
  --revision-id-only --header src/gpu/config/gpu_lists_version.h
    
src/build/util/lastchange.py -m SKIA_COMMIT_HASH \
    
  -s src/third_party/skia --header src/skia/ext/skia_commit_hash.h
    
# Create sysmlink to system clang-format
    
ln -s /usr/bin/clang-format src/buildtools/linux64
    
# Create sysmlink to system Node.js
    
mkdir -p src/third_party/node/linux/node-linux-x64/bin
    
ln -sf /usr/bin/node src/third_party/node/linux/node-linux-x64/bin
    
src/third_party/depot_tools/download_from_google_storage.py \
    
  --no_resume --extract --no_auth --bucket chromium-nodejs \
    
  -s src/third_party/node/node_modules.tar.gz.sha1
    
vpython src/tools/download_optimization_profile.py \
    
  --newest_state=src/chrome/android/profiles/newest.txt \
    
  --local_state=src/chrome/android/profiles/local.txt \
    
  --output_name=src/chrome/android/profiles/afdo.prof \
    
  --gs_url_base=chromeos-prebuilt/afdo-job/llvm
    
#vpython src/tools/update_pgo_profiles.py \
    
#  --target=linux \
    
#  update \
    
#  --gs-url-base=chromium-optimization-profiles/pgo_profiles
    
src/electron/script/apply_all_patches.py \
    
    src/electron/patches/config.json
    
cd src/electron || exit
    
yarn install --frozen-lockfile
    
cd ..
    
      174
    
echo "Applying local patches..."
    
# Fixes for building with libstdc++ instead of libc++
    
patch -Np1 -i ../patches/chromium-90-ruy-include.patch
    
patch -Np1 -i ../patches/chromium-94-CustomSpaces-include.patch
    
      179
    
patch -Np1 -i ../unbundle-fix-visibility-of-build-config-freetype.patch
    
patch -Np1 -i ../gn-visibility-gmock.patch
    
patch -Np1 -i ../gn-visibility-mojo.patch
    
patch -Np1 -i ../gn-visibility-webrtc.patch
    
patch -Rp1 -i ../add-a-TODO-about-a-missing-pnacl-flag.patch
    
patch -d third_party/jinja2 -Np1 -i ../../../jinja-python-3.10.patch
    
patch -Rp1 -i ../replace-blacklist-with-ignorelist.patch
    
patch -Np1 -i ../sql-make-VirtualCursor-standard-layout-type.patch
    
patch -Np0 -i ../unexpire-accelerated-video-decode-flag.patch
    
patch -Rp1 -i ../use-ffile-compilation-dir.patch
    
patch -d third_party/electron_node/tools/inspector_protocol/jinja2 \
    
    -Np1 -i ../../../../../../jinja-python-3.10.patch
    
patch -Np1 -i ../use-system-libraries-in-node.patch
    
patch -Np1 -i ../default_app-icon.patch  # Icon from .desktop file
    
      194
    
patch -Np1 -i ../sandbox-build-if-glibc-2.34-dynamic-stack-size-is-en.patch
    
patch -Np1 -d third_party/breakpad/breakpad <../breakpad-fix-for-non-constant-SIGSTKSZ.patch
    
      197
    
echo "Patching Chromium for using system libraries..."
    
sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' \
    
    tools/generate_shim_headers/generate_shim_headers.py
    
for lib in $(printf "%s\n" "${_system_libs[@]}" | sed 's/^libjpeg$/&_turbo/'); do
    
    third_party_dir="third_party/${lib}"
    
    if [ ! -d "${third_party_dir}" ]; then
    
      third_party_dir="base/${third_party_dir}"
    
    fi
    
    find "${third_party_dir}" -type f \
    
        \! -path "${third_party_dir}/chromium/*" \
    
        \! -path "${third_party_dir}/google/*" \
    
        \! -path 'third_party/harfbuzz-ng/utils/hb_scoped.h' \
    
        \! -regex '.*\.\(gn\|gni\|isolate\)' \
    
        -delete
    
done
    
build/linux/unbundle/replace_gn_files.py \
    
    --system-libraries \
    
    "${_system_libs[@]}"
    
      216}
    
      217
    
      218build() {
    
export CC=clang
    
export CXX=clang++
    
export AR=ar
    
export NM=nm
    
      223
    
CFLAGS="${CFLAGS/-fexceptions/}"
    
CXXFLAGS="${CXXFLAGS/-fexceptions/}"
    
      226
    
# This appears to cause random segfaults when combined with ThinLTO
    
# https://bugs.archlinux.org/task/73518
    
CFLAGS=${CFLAGS/-fstack-clash-protection}
    
CXXFLAGS=${CXXFLAGS/-fstack-clash-protection}
    
      231
    
# Do not warn about unknown warning options
    
CFLAGS+='   -Wno-unknown-warning-option'
    
CXXFLAGS+=' -Wno-unknown-warning-option'
    
      235
    
cd src || exit
    
export CHROMIUM_BUILDTOOLS_PATH="${PWD}/buildtools"
    
GN_EXTRA_ARGS='
    
  blink_symbol_level = 0
    
  chrome_pgo_phase = 0
    
  clang_use_chrome_plugins = false
    
  custom_toolchain = "//build/toolchain/linux/unbundle:default"
    
  host_toolchain = "//build/toolchain/linux/unbundle:default"
    
  icu_use_data_file = false
    
  is_component_ffmpeg = false
    
  link_pulseaudio = true
    
  rtc_use_pipewire = true
    
  treat_warnings_as_errors = false
    
  use_custom_libcxx = false
    
  use_gnome_keyring = false
    
  use_sysroot = false
    
'
    
gn gen out/Release \
    
    --args="import(\"//electron/build/args/release.gn\") ${GN_EXTRA_ARGS}"
    
ninja -C out/Release electron
    
# Strip before zip to avoid
    
# zipfile.LargeZipFile: Filesize would require ZIP64 extensions
    
strip -s out/Release/electron
    
ninja -C out/Release electron_dist_zip
    
# ninja -C out/Release third_party/electron_node:headers
    
      261}
    
      262
    
      263package() {
    
install -dm755 "${pkgdir:?}/usr/lib/${pkgname}"
    
bsdtar -xf src/out/Release/dist.zip -C "${pkgdir}/usr/lib/${pkgname}"
    
      266
    
chmod u+s "${pkgdir}/usr/lib/${pkgname}/chrome-sandbox"
    
      268
    
install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
for l in "${pkgdir}/usr/lib/${pkgname}"/{LICENSE,LICENSES.chromium.html}; do
    
  ln -s  \
    
    "$(realpath --relative-to="${pkgdir}/usr/share/licenses/${pkgname}" "${l}")" \
    
    "${pkgdir}/usr/share/licenses/${pkgname}"
    
done
    
      275
    
install -Dm755 "${srcdir}/electron-launcher.sh" \
    
  "${pkgdir}/usr/bin/${pkgname}"
    
if [[ "${_use_suffix}" == 0 ]]; then
    
  ln "${pkgdir}/usr/bin/${pkgname}" \
    
    "${pkgdir}/usr/bin/${pkgname}${_major_ver}"
    
fi
    
      282
    
# Install .desktop and icon file (see default_app-icon.patch)
    
install -Dm644 electron.desktop \
    
  "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
install -Dm644 src/electron/default_app/icon.png \
    
        "${pkgdir}/usr/share/pixmaps/${pkgname}.png"  # hicolor has no 1024x1024
    
      288}
    
      289

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2