electron19

MEDIUM

maintainer Drew 8 votes scanned 2026-10-29 15:52:51.405531

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:61 "git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=${_depot_tools_commit}"
PKGBUILD:62 "https://storage.googleapis.com/chromium-optimization-profiles/pgo_profiles/${_pgo_profile}"
PKGBUILD:64 "https://commondatastorage.googleapis.com/chromium-browser-clang/Linux_x64/clang-${_clang_revision}.tgz"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Drew Nutter <dnut@users.noreply.github.com>
    
      2# Contributor: Bruno Pagani <archange@archlinux.org>
    
      3# Contributor: Caleb Maclennan <caleb@alerque.com>
    
      4
    
      5_use_suffix=1
    
      6pkgver=19.1.9
    
      7_chromiumver=102.0.5005.167
    
      8# depot_tools has no releases. pin a known-good commit for reproducibility
    
      9_depot_tools_commit=7083aadfb53f3de2e20b72058c7f510da8f8218a
    
      10# Google Storage objects normally fetched by gclient hooks, see
    
      11# chrome/build/linux.pgo.txt and third_party/node/node_modules.tar.gz.sha1
    
      12_pgo_profile=chrome-linux-5005-1653490340-736db1732ea5f3959ee14f875a1211fdb84a54af.profdata
    
      13_node_modules_sha1=df473d4b1ab26ce6b669007521f2ffb8ff99f9d7
    
      14# Build with the toolchain chromium 102 was developed against instead of
    
      15# patching it for current clang and python releases. the clang revision is
    
      16# from tools/clang/scripts/update.py
    
      17_clang_revision=llvmorg-15-init-7570-gba4537b2-1
    
      18_python=3.10.19+20251014  # python-build-standalone version+release
    
      19# shellcheck disable=SC2034
    
      20pkgrel=6
    
      21
    
      22_major_ver=${pkgver%%.*}
    
      23if [[ ${_use_suffix} != 0 ]]; then
    
      24  pkgname="electron${_major_ver}"
    
      25else
    
      26  pkgname=electron
    
      27fi
    
      28# shellcheck disable=SC2034
    
      29pkgdesc='Build cross platform desktop apps with web technologies'
    
      30# shellcheck disable=SC2034
    
      31arch=('x86_64')
    
      32# shellcheck disable=SC2034
    
      33url='https://electronjs.org/'
    
      34# shellcheck disable=SC2034
    
      35license=('MIT' 'BSD-3-Clause')
    
      36# shellcheck disable=SC2034
    
      37depends=('c-ares' 'gtk3' 'libnghttp2' 'libpulse' 'nss')
    
      38# shellcheck disable=SC2034
    
      39# clang is only needed for clang-format, which the blink bindings generator uses
    
      40makedepends=('clang' 'git' 'gn' 'gperf' 'java-runtime-headless' 'libnotify'
    
      41             'libva' 'ninja' 'npm' 'pciutils' 'pipewire' 'python' 'wget'
    
      42             'yarn')
    
      43# shellcheck disable=SC2034
    
      44optdepends=('kde-cli-tools: file deletion support (kioclient5)'
    
      45            'pipewire: WebRTC desktop sharing under Wayland'
    
      46            'trash-cli: file deletion support (trash-put)'
    
      47            'xdg-utils: open URLs with desktop’s default (xdg-email, xdg-open)')
    
      48if [[ ${_use_suffix} == 0 ]]; then
    
      49  # shellcheck disable=SC2034
    
      50  conflicts=("electron${_major_ver}")
    
      51  # shellcheck disable=SC2034
    
      52  provides=("electron${_major_ver}")
    
      53fi
    
      54# shellcheck disable=SC2034
    
      55options=('!lto') # Electron adds its own flags for ThinLTO
    
      56# shellcheck disable=SC2034
    
      57noextract=("chromium-node_modules-${_node_modules_sha1}.tar.gz"
    
      58           "clang-${_clang_revision}.tgz")
    
      59# shellcheck disable=SC2034
    
      60source=("git+https://github.com/electron/electron.git#tag=v${pkgver}"
    
      61        "git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=${_depot_tools_commit}"
    
      62        "https://storage.googleapis.com/chromium-optimization-profiles/pgo_profiles/${_pgo_profile}"
    
      63        "chromium-node_modules-${_node_modules_sha1}.tar.gz::https://storage.googleapis.com/chromium-nodejs/${_node_modules_sha1}"
    
      64        "https://commondatastorage.googleapis.com/chromium-browser-clang/Linux_x64/clang-${_clang_revision}.tgz"
    
      65        "https://github.com/astral-sh/python-build-standalone/releases/download/${_python#*+}/cpython-${_python}-x86_64-unknown-linux-gnu-install_only.tar.gz"
    
      66        "electron-launcher.sh"
    
      67        "electron.desktop"
    
      68        'default_app-icon.patch'
    
      69        'jinja-python-3.10.patch'
    
      70        'use-system-libraries-in-node.patch'
    
      71        'std-vector-non-const.patch'
    
      72        'skia-freetype-2.13.patch'
    
      73        'sql-make-VirtualCursor-standard-layout-type.patch'
    
      74        'chromium-fix-SYS_SECCOMP-redefinition.patch'
    
      75        'blink-gperf-3.2-fallthrough.patch'
    
      76       )
    
      77# shellcheck disable=SC2034
    
      78sha256sums=('706ebc368149b727ffd317885b2e26d5e1bb30060e6ebe6f2273aa55c8becb2e'
    
      79            '2d8434e23010fd9ddd0299f098857f42bb786550de96d7cd66137ce96b382af5'
    
      80            'e01e7575b8947d9e0b42b755c28a292a1d27244a9e873d53840be83c7519e0ce'
    
      81            '38fa60c59a8398ae33f8d12c1234735a74dc3c8d0c6d4bc7a9c212c2b4b7fef8'
    
      82            '40090455226011c896ecae5770c55a06deb39849f8b6a3c167e7ced843154073'
    
      83            '85c96114de83d783db18137f3858bcd3b5a9c4cbe9053f0072d7b5f52154a8c9'
    
      84            'b406bc9adb7fadcfbd26f204f3e0ef8c31a41fa09181edb28626167ac58fe038'
    
      85            '4484200d90b76830b69eea3a471c103999a3ce86bb2c29e6c14c945bf4102bae'
    
      86            '8725ef370aa37f5752d6f23bca77709bf3c80f425b348d3a244c9556c5d41f53'
    
      87            '55dbe71dbc1f3ab60bf1fa79f7aea7ef1fe76436b1d7df48728a1f8227d2134e'
    
      88            '34454d59d2bc137e63b666141551466a042af1188fe84ef1f5eca1ed991d099a'
    
      89            '76b969e1534e8c355b8b524a686cbf3b24136eaa6bd40b0c09fdd9866049f159'
    
      90            '3a2876e54755df12aacd0575d9d2ff345fabaca6a0dddc72208787dbb2f34fcb'
    
      91            'b94b2e88f63cfb7087486508b8139599c89f96d7a4181c61fec4b4e250ca327a'
    
      92            'a8841a6c46cb3ff13477a94fd862e9dd22f0de0ca5e00c63a0519e888e02c39e'
    
      93            '8dfb5012081d4d2c4645a1d551dfe20cf8dabe1db74d0765d30a7b22664d33fb')
    
      94
    
      95# Possible replacements are listed in build/linux/unbundle/replace_gn_files.py
    
      96# Keys are the names in the above script; values are the dependencies in Arch
    
      97# - C++ libraries (icu, re2, snappy) are kept bundled as they are ABI
    
      98#   incompatible with the bundled libc++ (use_custom_libcxx=true)
    
      99# - ffmpeg is kept bundled as chromium 102 predates the FFmpeg 5+ APIs
    
      100# - libxml and libxslt are kept bundled as chromium 102 predates the
    
      101#   libxml2 2.12+ APIs
    
      102declare -gA _system_libs=(
    
      103  [flac]=flac
    
      104  [fontconfig]=fontconfig
    
      105  [freetype]=freetype2
    
      106  [harfbuzz-ng]=harfbuzz
    
      107  [libdrm]=
    
      108  [libjpeg]=libjpeg-turbo
    
      109  [libpng]=libpng
    
      110  #[libvpx]=libvpx
    
      111  [libwebp]=libwebp
    
      112  [opus]=opus
    
      113  [zlib]=minizip
    
      114)
    
      115_unwanted_bundled_libs=(
    
      116  $(printf "%s\n" ${!_system_libs[@]} | sed 's/^libjpeg$/&_turbo/')
    
      117)
    
      118depends+=(${_system_libs[@]})
    
      119
    
      120prepare() {
    
      121  sed -i "s|@ELECTRON@|${pkgname}|" electron-launcher.sh
    
      122  sed -i "s|@ELECTRON@|${pkgname}|" electron.desktop
    
      123  sed -i "s|@ELECTRON@|${pkgname}|" default_app-icon.patch
    
      124  if [[ ${_use_suffix} != 0 ]]; then
    
      125    sed -i "s|@ELECTRON_NAME@|Electron ${_major_ver}|" electron.desktop
    
      126  else
    
      127    sed -i "s|@ELECTRON_NAME@|Electron|" electron.desktop
    
      128  fi
    
      129
    
      130cat >.gclient <<EOF
    
      131solutions = [
    
      132  {
    
      133    "name": "src/electron",
    
      134    "url": "file://${srcdir}/electron@refs/tags/v${pkgver}",
    
      135    "deps_file": "DEPS",
    
      136    "managed": False,
    
      137    "custom_deps": {
    
      138      # Fetch chromium from the github mirror: shallow fetches of chromium/src
    
      139      # from googlesource are extremely slow and often rate limited (HTTP 429)
    
      140      "src": "https://github.com/chromium/chromium.git@refs/tags/${_chromiumver}",
    
      141    },
    
      142    "custom_vars": {},
    
      143  },
    
      144]
    
      145EOF
    
      146
    
      147  export PATH+=":$PWD/depot_tools" DEPOT_TOOLS_UPDATE=0
    
      148  export VPYTHON_BYPASS='manually managed python not supported by chrome operations'
    
      149
    
      150  echo "Fetching chromium..."
    
      151  # History, branch heads and tags are not needed and make the checkout
    
      152  # several times larger and slower
    
      153  depot_tools/gclient.py sync -D \
    
      154      --nohooks \
    
      155      --no-history \
    
      156      --shallow
    
      157
    
      158  # depot_tools above needs the system python. chromium 102 needs an older one
    
      159  export PATH="${srcdir}/python/bin:${PATH}"
    
      160
    
      161  # electron/BUILD.gn lists .git/packed-refs as an input, which is missing in
    
      162  # a fresh shallow clone and would leave build.ninja permanently dirty
    
      163  git -C src/electron pack-refs --all
    
      164
    
      165  (
    
      166    cd src/electron || exit
    
      167    patch -Np1 -i ../../std-vector-non-const.patch
    
      168  )
    
      169
    
      170  echo "Running hooks..."
    
      171  # python "${srcdir}/depot_tools/gclient.py" runhooks
    
      172  src/build/landmines.py
    
      173  # The shallow checkout only contains the release commit which has no
    
      174  # Change-Id, so do not filter on it
    
      175  src/build/util/lastchange.py --filter='^' -o src/build/util/LASTCHANGE
    
      176  src/build/util/lastchange.py --filter='^' -m GPU_LISTS_VERSION \
    
      177    --revision-id-only --header src/gpu/config/gpu_lists_version.h
    
      178  src/build/util/lastchange.py -m SKIA_COMMIT_HASH \
    
      179    -s src/third_party/skia --header src/skia/ext/skia_commit_hash.h
    
      180  install -Dm644 "${_pgo_profile}" -t src/chrome/build/pgo_profiles
    
      181  bsdtar -xf "chromium-node_modules-${_node_modules_sha1}.tar.gz" \
    
      182    -C src/third_party/node
    
      183  # Where tools/clang/scripts/update.py would install it
    
      184  mkdir -p "src/third_party/llvm-build/Release+Asserts"
    
      185  bsdtar -xf "clang-${_clang_revision}.tgz" \
    
      186    -C "src/third_party/llvm-build/Release+Asserts"
    
      187  # Create sysmlink to system clang-format
    
      188  ln -s /usr/bin/clang-format src/buildtools/linux64
    
      189  # Create sysmlink to system Node.js
    
      190  mkdir -p src/third_party/node/linux/node-linux-x64/bin
    
      191  ln -sf /usr/bin/node src/third_party/node/linux/node-linux-x64/bin
    
      192  src/electron/script/apply_all_patches.py \
    
      193      src/electron/patches/config.json
    
      194  cd src/electron || exit
    
      195  yarn install --frozen-lockfile
    
      196  cd ..
    
      197
    
      198  echo "Applying local patches..."
    
      199  # Upstream fixes
    
      200  patch -Np1 -d third_party/skia <../skia-freetype-2.13.patch
    
      201
    
      202  # Fixes for building with newer system tools
    
      203  # gperf 3.2+ already emits [[fallthrough]]
    
      204  patch -Np1 -i ../blink-gperf-3.2-fallthrough.patch
    
      205  # glibc now defines SYS_SECCOMP in an enum (https://crbug.com/456218403)
    
      206  patch -Np1 -i ../chromium-fix-SYS_SECCOMP-redefinition.patch
    
      207
    
      208  # https://chromium-review.googlesource.com/c/chromium/src/+/2862724
    
      209  patch -Np1 -i ../sql-make-VirtualCursor-standard-layout-type.patch
    
      210
    
      211  # Electron specific fixes
    
      212  patch -d third_party/electron_node/tools/inspector_protocol/jinja2 \
    
      213      -Np1 -i ../../../../../../jinja-python-3.10.patch
    
      214  patch -Np1 -i ../use-system-libraries-in-node.patch
    
      215  patch -Np1 -i ../default_app-icon.patch  # Icon from .desktop file
    
      216
    
      217  # Allow building against system libraries in official builds
    
      218  echo "Patching Chromium for using system libraries..."
    
      219  sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' \
    
      220    tools/generate_shim_headers/generate_shim_headers.py
    
      221  # Remove bundled libraries for which we will use the system copies; this
    
      222  # *should* do what the remove_bundled_libraries.py script does, with the
    
      223  # added benefit of not having to list all the remaining libraries
    
      224  local _lib
    
      225  for _lib in ${_unwanted_bundled_libs[@]}; do
    
      226    third_party_dir="third_party/$_lib"
    
      227    if [ ! -d "${third_party_dir}" ]; then
    
      228      third_party_dir="base/${third_party_dir}"
    
      229    fi
    
      230    find "${third_party_dir}" -type f \
    
      231        \! -path "${third_party_dir}/chromium/*" \
    
      232        \! -path "${third_party_dir}/google/*" \
    
      233        \! -path 'third_party/harfbuzz-ng/utils/hb_scoped.h' \
    
      234        \! -regex '.*\.\(gn\|gni\|isolate\)' \
    
      235        -delete
    
      236  done
    
      237
    
      238  ./build/linux/unbundle/replace_gn_files.py \
    
      239    --system-libraries "${!_system_libs[@]}"
    
      240}
    
      241
    
      242build() {
    
      243  export PATH="${srcdir}/python/bin:${PATH}"
    
      244  local _clang_bin="${srcdir}/src/third_party/llvm-build/Release+Asserts/bin"
    
      245  export CC="${_clang_bin}/clang"
    
      246  export CXX="${_clang_bin}/clang++"
    
      247  export AR="${_clang_bin}/llvm-ar"
    
      248  export NM="${_clang_bin}/llvm-nm"
    
      249
    
      250  # https://github.com/webpack/webpack/issues/14532
    
      251  export NODE_OPTIONS=--openssl-legacy-provider
    
      252
    
      253  # Facilitate deterministic builds (taken from build/config/compiler/BUILD.gn)
    
      254  CFLAGS+='   -Wno-builtin-macro-redefined'
    
      255  CXXFLAGS+=' -Wno-builtin-macro-redefined'
    
      256  CPPFLAGS+=' -D__DATE__=  -D__TIME__=  -D__TIMESTAMP__='
    
      257
    
      258  # Do not warn about unknown warning options
    
      259  CFLAGS+='   -Wno-unknown-warning-option'
    
      260  CXXFLAGS+=' -Wno-unknown-warning-option'
    
      261
    
      262  # Let Chromium set its own symbol level
    
      263  CFLAGS=${CFLAGS/-g }
    
      264  CXXFLAGS=${CXXFLAGS/-g }
    
      265
    
      266  # https://github.com/ungoogled-software/ungoogled-chromium-archlinux/issues/123
    
      267  CFLAGS=${CFLAGS/-fexceptions}
    
      268  CFLAGS=${CFLAGS/-fcf-protection}
    
      269  CXXFLAGS=${CXXFLAGS/-fexceptions}
    
      270  CXXFLAGS=${CXXFLAGS/-fcf-protection}
    
      271
    
      272  # This appears to cause random segfaults when combined with ThinLTO
    
      273  # https://bugs.archlinux.org/task/73518
    
      274  CFLAGS=${CFLAGS/-fstack-clash-protection}
    
      275  CXXFLAGS=${CXXFLAGS/-fstack-clash-protection}
    
      276
    
      277  # https://crbug.com/957519#c122
    
      278  CXXFLAGS=${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS}
    
      279
    
      280  cd src || exit
    
      281  export CHROMIUM_BUILDTOOLS_PATH="${PWD}/buildtools"
    
      282  GN_EXTRA_ARGS='
    
      283    custom_toolchain = "//build/toolchain/linux/unbundle:default"
    
      284    host_toolchain = "//build/toolchain/linux/unbundle:default"
    
      285    clang_use_chrome_plugins = false
    
      286    symbol_level = 0 # sufficient for backtraces on x86(_64)
    
      287    chrome_pgo_phase = 2
    
      288    treat_warnings_as_errors = false
    
      289    rtc_use_pipewire = true
    
      290    link_pulseaudio = true
    
      291    use_gnome_keyring = false
    
      292    use_sysroot = false
    
      293    use_custom_libcxx = true
    
      294  '
    
      295  gn gen out/Release \
    
      296      --args="import(\"//electron/build/args/release.gn\") ${GN_EXTRA_ARGS}"
    
      297  ninja -C out/Release electron
    
      298  ninja -C out/Release electron_dist_zip
    
      299  # ninja -C out/Release third_party/electron_node:headers
    
      300}
    
      301
    
      302package() {
    
      303  install -dm755 "${pkgdir:?}/usr/lib/${pkgname}"
    
      304  bsdtar -xf src/out/Release/dist.zip -C "${pkgdir}/usr/lib/${pkgname}"
    
      305
    
      306  chmod u+s "${pkgdir}/usr/lib/${pkgname}/chrome-sandbox"
    
      307
    
      308  install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      309  for l in "${pkgdir}/usr/lib/${pkgname}"/{LICENSE,LICENSES.chromium.html}; do
    
      310    ln -s  \
    
      311      "$(realpath --relative-to="${pkgdir}/usr/share/licenses/${pkgname}" "${l}")" \
    
      312      "${pkgdir}/usr/share/licenses/${pkgname}"
    
      313  done
    
      314
    
      315  install -Dm755 "${srcdir}/electron-launcher.sh" \
    
      316    "${pkgdir}/usr/bin/${pkgname}"
    
      317  if [[ "${_use_suffix}" == 0 ]]; then
    
      318    ln -s "/usr/bin/${pkgname}" "${pkgdir}/usr/bin/${pkgname}${_major_ver}"
    
      319    ln -s "/usr/lib/${pkgname}" "${pkgdir}/usr/lib/${pkgname}${_major_ver}"
    
      320  fi
    
      321
    
      322  # Install .desktop and icon file (see default_app-icon.patch)
    
      323  install -Dm644 electron.desktop \
    
      324    "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      325  install -Dm644 src/electron/default_app/icon.png \
    
      326          "${pkgdir}/usr/share/pixmaps/${pkgname}.png"  # hicolor has no 1024x1024
    
      327}
    
      328

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-10-29 15:52
@@ -1,13 +1,23 @@
+# Maintainer: Drew Nutter <dnut@users.noreply.github.com>
 # Contributor: Bruno Pagani <archange@archlinux.org>
 # Contributor: Caleb Maclennan <caleb@alerque.com>
 
 _use_suffix=1
 pkgver=19.1.9
-_commit=f887fa45dfaeeddfe20c9835ae7ca3a0823b661b
 _chromiumver=102.0.5005.167
-_gcc_patchset=6
-# shellcheck disable=SC2034
-pkgrel=5
+# depot_tools has no releases. pin a known-good commit for reproducibility
+_depot_tools_commit=7083aadfb53f3de2e20b72058c7f510da8f8218a
+# Google Storage objects normally fetched by gclient hooks, see
+# chrome/build/linux.pgo.txt and third_party/node/node_modules.tar.gz.sha1
+_pgo_profile=chrome-linux-5005-1653490340-736db1732ea5f3959ee14f875a1211fdb84a54af.profdata
+_node_modules_sha1=df473d4b1ab26ce6b669007521f2ffb8ff99f9d7
+# Build with the toolchain chromium 102 was developed against instead of
+# patching it for current clang and python releases. the clang revision is
+# from tools/clang/scripts/update.py
+_clang_revision=llvmorg-15-init-7570-gba4537b2-1
+_python=3.10.19+20251014  # python-build-standalone version+release
+# shellcheck disable=SC2034
+pkgrel=6
 
 _major_ver=${pkgver%%.*}
 if [[ ${_use_suffix} != 0 ]]; then
@@ -22,17 +32,16 @@
 # shellcheck disable=SC2034
 url='https://electronjs.org/'
 # shellcheck disable=SC2034
-license=('MIT' 'custom')
-# shellcheck disable=SC2034
-depends=('c-ares' 'gtk3' 'libevent' 'nss')
-# shellcheck disable=SC2034
-makedepends=('clang' 'git' 'gn' 'gperf' 'harfbuzz-icu' 'http-parser'
-             'java-runtime-headless' 'jsoncpp' 'libnotify' 'lld' 'llvm' 'ninja'
-             'npm' 'pciutils' 'pipewire' 'python' 'python-httplib2'
-             'python-pyparsing' 'python-six' 'wget' 'yarn')
+license=('MIT' 'BSD-3-Clause')
+# shellcheck disable=SC2034
+depends=('c-ares' 'gtk3' 'libnghttp2' 'libpulse' 'nss')
+# shellcheck disable=SC2034
+# clang is only needed for clang-format, which the blink bindings generator uses
+makedepends=('clang' 'git' 'gn' 'gperf' 'java-runtime-headless' 'libnotify'
+             'libva' 'ninja' 'npm' 'pciutils' 'pipewire' 'python' 'wget'
+             'yarn')
 # shellcheck disable=SC2034
 optdepends=('kde-cli-tools: file deletion support (kioclient5)'
-            'libappindicator-gtk3: StatusNotifierItem support'
             'pipewire: WebRTC desktop sharing under Wayland'
             'trash-cli: file deletion support (trash-put)'
             'xdg-utils: open URLs with desktop’s default (xdg-email, xdg-open)')
@@ -45,9 +54,15 @@
 # shellcheck disable=SC2034
 options=('!lto') # Electron adds its own flags for ThinLTO
 # shellcheck disable=SC2034
-source=('git+https://github.com/electron/electron.git'
-        'git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#branch=main'
-        "https://github.com/stha09/chromium-patches/releases/download/chromium-${_chromiumver%%.*}-patchset-${_gcc_patchset}/chromium-${_chromiumver%%.*}-patchset-${_gcc_patchset}.tar.xz"
+noextract=("chromium-node_modules-${_node_modules_sha1}.tar.gz"
+           "clang-${_clang_revision}.tgz")
+# shellcheck disable=SC2034
+source=("git+https://github.com/electron/electron.git#tag=v${pkgver}"
+        "git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=${_depot_tools_commit}"
+        "https://storage.googleapis.com/chromium-optimization-profiles/pgo_profiles/${_pgo_profile}"
+        "chromium-node_modules-${_node_modules_sha1}.tar.gz::https://storage.googleapis.com/chromium-nodejs/${_node_modules_sha1}"
+        "https://commondatastorage.googleapis.com/chromium-browser-clang/Linux_x64/clang-${_clang_revision}.tgz"
+        "https://github.com/astral-sh/python-build-standalone/releases/download/${_python#*+}/cpython-${_python}-x86_64-unknown-linux-gnu-install_only.tar.gz"
         "electron-launcher.sh"
         "electron.desktop"
         'default_app-icon.patch'
@@ -55,46 +70,46 @@
         'use-system-libraries-in-node.patch'
         'std-vector-non-const.patch'
         'skia-freetype-2.13.patch'
-        'roll-src-third_party-ffmpeg.patch'
-        'chromium-libxml-unbundle.patch'
         'sql-make-VirtualCursor-standard-layout-type.patch'
-        'remove-no-opaque-pointers-flag.patch'
+        'chromium-fix-SYS_SECCOMP-redefinition.patch'
+        'blink-gperf-3.2-fallthrough.patch'
        )
 # shellcheck disable=SC2034
-sha256sums=('SKIP'
-            'SKIP'
-            '23f2a772c4a6e31394d6ee7b8dbb5967d3b92bd859093444913377934bede594'
-            '77817939c9833f8dda74a8c75620c15747170551ffa6f14f7c5b4071599e8831'
+sha256sums=('706ebc368149b727ffd317885b2e26d5e1bb30060e6ebe6f2273aa55c8becb2e'
+            '2d8434e23010fd9ddd0299f098857f42bb786550de96d7cd66137ce96b382af5'
+            'e01e7575b8947d9e0b42b755c28a292a1d27244a9e873d53840be83c7519e0ce'
+            '38fa60c59a8398ae33f8d12c1234735a74dc3c8d0c6d4bc7a9c212c2b4b7fef8'
+            '40090455226011c896ecae5770c55a06deb39849f8b6a3c167e7ced843154073'
+            '85c96114de83d783db18137f3858bcd3b5a9c4cbe9053f0072d7b5f52154a8c9'
+            'b406bc9adb7fadcfbd26f204f3e0ef8c31a41fa09181edb28626167ac58fe038'
             '4484200d90b76830b69eea3a471c103999a3ce86bb2c29e6c14c945bf4102bae'
-            'dd2d248831dd4944d385ebf008426e66efe61d6fdf66f8932c963a12167947b4'
+            '8725ef370aa37f5752d6f23bca77709bf3c80f425b348d3a244c9556c5d41f53'
             '55dbe71dbc1f3ab60bf1fa79f7aea7ef1fe76436b1d7df48728a1f8227d2134e'
-            'c70652a8b24c237bcfd27469de32797a2cb46d9f0d63d897bb6418314a25644c'
+            '34454d59d2bc137e63b666141551466a042af1188fe84ef1f5eca1ed991d099a'
             '76b969e1534e8c355b8b524a686cbf3b24136eaa6bd40b0c09fdd9866049f159'
             '3a2876e54755df12aacd0575d9d2ff345fabaca6a0dddc72208787dbb2f34fcb'
-            '30df59a9e2d95dcb720357ec4a83d9be51e59cc5551365da4c0073e68ccdec44'
-            'fd3bf124aacc45f2d0a4f1dd86303fa7f2a3d4f4eeaf33854631d6cb39e12485'
             'b94b2e88f63cfb7087486508b8139599c89f96d7a4181c61fec4b4e250ca327a'
-            'e8ea8528ecb119de3380555c60ac8495ebdef502359fa2114c6c5c98f84698cd')
+            'a8841a6c46cb3ff13477a94fd862e9dd22f0de0ca5e00c63a0519e888e02c39e'
+            '8dfb5012081d4d2c4645a1d551dfe20cf8dabe1db74d0765d30a7b22664d33fb')
 
 # Possible replacements are listed in build/linux/unbundle/replace_gn_files.py
 # Keys are the names in the above script; values are the dependencies in Arch
+# - C++ libraries (icu, re2, snappy) are kept bundled as they are ABI
+#   incompatible with the bundled libc++ (use_custom_libcxx=true)
+# - ffmpeg is kept bundled as chromium 102 predates the FFmpeg 5+ APIs
+# - libxml and libxslt are kept bundled as chromium 102 predates the
+#   libxml2 2.12+ APIs
 declare -gA _system_libs=(
-  [ffmpeg]=ffmpeg
   [flac]=flac
   [fontconfig]=fontconfig
   [freetype]=freetype2
   [harfbuzz-ng]=harfbuzz
-  [icu]=icu
   [libdrm]=
-  [libjpeg]=libjpeg
+  [libjpeg]=libjpeg-turbo
   [libpng]=libpng
   #[libvpx]=libvpx
   [libwebp]=libwebp
-  [libxml]=libxml2
-  [libxslt]=libxslt
   [opus]=opus
-  [re2]=re2
-  [snappy]=snappy
   [zlib]=minizip
 )
 _unwanted_bundled_libs=(
@@ -105,6 +120,7 @@
 prepare() {
   sed -i "s|@ELECTRON@|${pkgname}|" electron-launcher.sh
   sed -i "s|@ELECTRON@|${pkgname}|" electron.desktop
+  sed -i "s|@ELECTRON@|${pkgname}|" default_app-icon.patch
   if [[ ${_use_suffix} != 0 ]]; then
     sed -i "s|@ELECTRON_NAME@|Electron ${_major_ver}|" electron.desktop
   else
@@ -115,11 +131,13 @@
 solutions = [
   {
     "name": "src/electron",
-    "url": "file://${srcdir}/electron@${_commit}",
+    "url": "file://${srcdir}/electron@refs/tags/v${pkgver}",
     "deps_file": "DEPS",
     "managed": False,
     "custom_deps": {
-      "src": None,
+      # Fetch chromium from the github mirror: shallow fetches of chromium/src
+      # from googlesource are extremely slow and often rate limited (HTTP 429)
+      "src": "https://github.com/chromium/chromium.git@refs/tags/${_chromiumver}",
     },
     "custom_vars": {},
   },
@@ -130,12 +148,19 @@
   export VPYTHON_BYPASS='manually managed python not supported by chrome operations'
 
   echo "Fetching chromium..."
-  git clone -b ${_chromiumver} --depth=2 https://chromium.googlesource.com/chromium/src
-
+  # History, branch heads and tags are not needed and make the checkout
+  # several times larger and slower
   depot_tools/gclient.py sync -D \
       --nohooks \
-      --with_branch_heads \
-      --with_tags
+      --no-history \
+      --shallow
+
+  # depot_tools above needs the system python. chromium 102 needs an older one
+  export PATH="${srcdir}/python/bin:${PATH}"
+
+  # electron/BUILD.gn lists .git/packed-refs as an input, which is missing in
+  # a fresh shallow clone and would leave build.ninja permanently dirty
+  git -C src/electron pack-refs --all
 
   (
     cd src/electron || exit
@@ -145,15 +170,20 @@
   echo "Running hooks..."
   # python "${srcdir}/depot_tools/gclient.py" runhooks
   src/build/landmines.py
-  src/build/util/lastchange.py -o src/build/util/LASTCHANGE
-  src/build/util/lastchange.py -m GPU_LISTS_VERSION \
+  # The shallow checkout only contains the release commit which has no
+  # Change-Id, so do not filter on it
+  src/build/util/lastchange.py --filter='^' -o src/build/util/LASTCHANGE
+  src/build/util/lastchange.py --filter='^' -m GPU_LISTS_VERSION \
     --revision-id-only --header src/gpu/config/gpu_lists_version.h
   src/build/util/lastchange.py -m SKIA_COMMIT_HASH \
     -s src/third_party/skia --header src/skia/ext/skia_commit_hash.h
-  src/tools/update_pgo_profiles.py --target=linux update \
-    --gs-url-base=chromium-optimization-profiles/pgo_profiles
-  depot_tools/download_from_google_storage.py --no_resume --extract --no_auth \
-    --bucket chromium-nodejs -s src/third_party/node/node_modules.tar.gz.sha1
+  install -Dm644 "${_pgo_profile}" -t src/chrome/build/pgo_profiles
+  bsdtar -xf "chromium-node_modules-${_node_modules_sha1}.tar.gz" \
+    -C src/third_party/node
+  # Where tools/clang/scripts/update.py would install it
+  mkdir -p "src/third_party/llvm-build/Release+Asserts"
+  bsdtar -xf "clang-${_clang_revision}.tgz" \
+    -C "src/third_party/llvm-build/Release+Asserts"
   # Create sysmlink to system clang-format
   ln -s /usr/bin/clang-format src/buildtools/linux64
   # Create sysmlink to system Node.js
@@ -166,27 +196,17 @@
   cd ..
 
   echo "Applying local patches..."
-  # Remove '-Xclang -no-opaque-pointers' flag not supported by our clang
-  patch -Np1 -i ../remove-no-opaque-pointers-flag.patch
-
   # Upstream fixes
   patch -Np1 -d third_party/skia <../skia-freetype-2.13.patch
 
-  # Revert ffmpeg roll requiring new channel layout API support
-  # https://crbug.com/1325301
-  patch -Rp1 -i ../roll-src-third_party-ffmpeg.patch
-
-  # https://chromium-review.googlesource.com/c/chromium/src/+/3488058
-  patch -Np1 -i ../chromium-libxml-unbundle.patch
+  # Fixes for building with newer system tools
+  # gperf 3.2+ already emits [[fallthrough]]
+  patch -Np1 -i ../blink-gperf-3.2-fallthrough.patch
+  # glibc now defines SYS_SECCOMP in an enum (https://crbug.com/456218403)
+  patch -Np1 -i ../chromium-fix-SYS_SECCOMP-redefinition.patch
 
   # https://chromium-review.googlesource.com/c/chromium/src/+/2862724
   patch -Np1 -i ../sql-make-VirtualCursor-standard-layout-type.patch
-
-  # Fixes for building with libstdc++ instead of libc++
-  patch -Np1 -i ../patches/chromium-102-fenced_frame_utils-include.patch
-  patch -Np1 -i ../patches/chromium-102-regex_pattern-array.patch
-  patch -Np1 -i ../patches/chromium-102-swiftshader-template-instantiation.patch
-  patch -Np1 -i ../patches/chromium-102-symbolize-include.patch
 
   # Electron specific fixes
   patch -d third_party/electron_node/tools/inspector_protocol/jinja2 \
@@ -220,10 +240,12 @@
 }
 
 build() {
-  export CC=clang
-  export CXX=clang++
-  export AR=ar
-  export NM=nm
+  export PATH="${srcdir}/python/bin:${PATH}"
+  local _clang_bin="${srcdir}/src/third_party/llvm-build/Release+Asserts/bin"
+  export CC="${_clang_bin}/clang"
+  export CXX="${_clang_bin}/clang++"
+  export AR="${_clang_bin}/llvm-ar"
+  export NM="${_clang_bin}/llvm-nm"
 
   # https://github.com/webpack/webpack/issues/14532
   export NODE_OPTIONS=--openssl-legacy-provider
@@ -254,10 +276,6 @@
 
   # https://crbug.com/957519#c122
   CXXFLAGS=${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS}
-
-  # Do not warn about unknown warning options
-  CFLAGS+='   -Wno-unknown-warning-option'
-  CXXFLAGS+=' -Wno-unknown-warning-option'
 
   cd src || exit
   export CHROMIUM_BUILDTOOLS_PATH="${PWD}/buildtools"
@@ -272,9 +290,7 @@
     link_pulseaudio = true
     use_gnome_keyring = false
     use_sysroot = false
-    use_custom_libcxx = false
-    icu_use_data_file = false
-    is_component_ffmpeg = false
+    use_custom_libcxx = true
   '
   gn gen out/Release \
       --args="import(\"//electron/build/args/release.gn\") ${GN_EXTRA_ARGS}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 15:52:51	Medium	1
2026-06-20 16:03:41	Clean	2
2026-06-20 00:50:07	Medium	2
2026-06-20 00:18:46	Medium	2
2026-06-19 23:51:18	Medium	2
2026-06-19 19:07:35	Medium	2
2026-06-18 16:11:54	Medium	1