firedragon

LOW
maintainer dr460nf1r3 25 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The source is built from the project's own GitLab release, which is a plausible official source; the non-whitelisted host is the project's own infrastructure, and the package builds from source rather than running untrusted prebuilt binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is built from the project's own GitLab release, which is a plausible official source; the non-whitelisted host is the project's own infrastructure, and the package builds from source rather than running untrusted prebuilt binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:86 https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo)

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Stefan Wimmer <info@stefanwimmer128.xyz>
2
3_pkgname=firedragon
4__pkgname=$_pkgname
5_rdns=org.garudalinux.$__pkgname
6_pkgver=13.11.0
7_branding=dr460nized
8_gentoo=firefox-159-patches-01.tar.xz
9_gentoo_exclude=(0014-bgo-940031-wasm-support-firefox-155.patch)
10
11pkgname=$__pkgname
12pkgver=${_pkgver//-/_}
13pkgrel=1
14epoch=2
15pkgdesc="FireDragon is a cross-platform, feature-rich and privacy-focused web browser"
16url="https://gitlab.com/garuda-linux/firedragon/firedragon13"
17arch=(x86_64 aarch64)
18license=(MPL-2.0)
19depends=(alsa-lib
20 at-spi2-core
21 bash
22 cairo
23 dbus
24 ffmpeg
25 fontconfig
26 freetype2
27 gdk-pixbuf2
28 glib2
29 glibc
30 gtk3
31 hicolor-icon-theme
32 libgcc
33 libpulse
34 libstdc++
35 libx11
36 libxcb
37 libxcomposite
38 libxdamage
39 libxext
40 libxfixes
41 libxrandr
42 libxss
43 libxt
44 mime-types
45 nspr
46 nss
47 pango
48 ttf-font)
49makedepends=(cbindgen
50 clang
51 corepack
52 diffutils
53 imake
54 jack
55 lld
56 llvm
57 mesa
58 nasm
59 nodejs
60 onnxruntime
61 python
62 rust
63 unzip
64 wasi-compiler-rt
65 wasi-libc
66 wasi-libc++
67 wasi-libc++abi
68 xorg-server-xvfb
69 yasm
70 zip)
71optdepends=('hunspell-en_US: Spell checking, American English'
72 'libnotify: Notification integration'
73 'networkmanager: Location detection via available WiFi networks'
74 'onnxruntime: Local machine learning features such as smart tab groups'
75 'speech-dispatcher: Text-to-Speech'
76 'xdg-desktop-portal: Screensharing with Wayland')
77provides=($_pkgname)
78conflicts=($_pkgname)
79replaces=($__pkgname-next)
80options=(!emptydirs
81 !lto
82 !makeflags)
83install=$_pkgname.install
84noextract=($_gentoo)
85source=($_pkgname-v$_pkgver.source.tar.xz::$url/-/releases/v$_pkgver/downloads/$_pkgname.source.tar.xz
86 https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo)
87sha256sums=('4e921dacd815421319df82f8a5c1e2104199065e1d2ce13526b30c7f3255b9ff'
88 'ffe58cc79c6439aa19cf52b245f2a7d730b27700c652319dc3a5a9d10d162df7')
89
90prepare() {
91 mkdir -p mozbuild
92 cd $_pkgname-v$_pkgver
93
94 for patch in $(tar -tf "$srcdir/$_gentoo" --wildcards '*.patch' $(printf -- '--exclude=%s' "${_gentoo_exclude[@]}")); do
95 tar -Oxf "$srcdir/$_gentoo" "$patch" | patch -Nsp1
96 done
97
98 sed \
99 -e 's/0f2f824025f41ef946ef880c4a1558241eec47a39e4f2f0a776a5c200e99f841/e8fc29cdc934a795fe6afc87f221c6a5b01ec14f12563b4e612a588338b985d1/' \
100 -e 's/19563df9fac942eeb0d4fd240300815f3d8bf8cd6451fd625eff0768b6c448d8/3f8495eddbcfe17db3d5f11738ad990f536cb2eae314551d9c1ababe7bc8fbd5/' \
101 -e 's/2a229e98f65ac2c7ae5e9e866a5f945b0488fd7a61b2a8a1c6cf28b6827b7667/19e920817230f44f9a81558915596cbd93f9166025224002fc5654758e1df2b1/' \
102 -e 's/7b15213f4ca1c0241fddd0483397a68ceeafe33029d3056ac83b58d56833649b/5c1d506a889fe866baa6b65438def12cdb531443b12f53ee923ce41a9a95aacc/' \
103 -i third_party/rust/bindgen/.cargo-checksum.json
104
105 echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/edition/$_pkgname-$_branding.mozconfig\"" > ../mozconfig
106 export FIREDRAGON_EDITION=$_branding
107
108 if [ $CARCH = x86_64 ]; then
109 echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/target/linux-x64.mozconfig\"" >> ../mozconfig
110 export FIREDRAGON_TARGET=linux-x64
111 elif [ $CARCH = aarch64 ]; then
112 echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/target/linux-arm64.mozconfig\"" >> ../mozconfig
113 export FIREDRAGON_TARGET=linux-arm64
114 fi
115
116 export COREPACK_HOME="$srcdir"/.corepack
117 export PNPM_HOME="$srcdir"/.pnpm
118 export PATH="$srcdir"/.bin:"$PATH"
119
120 mkdir -p "$srcdir"/.bin
121 corepack enable --install-directory "$srcdir"/.bin
122
123 pushd browser/$_pkgname > /dev/null
124 corepack pnpm install --frozen-lockfile
125 corepack pnpm all:build
126 popd > /dev/null
127
128 cat >> ../mozconfig << END
129ac_add_options --enable-linker=lld
130ac_add_options --disable-bootstrap
131ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
132
133# System libraries
134ac_add_options --with-system-nspr
135ac_add_options --with-system-nss
136
137# Features
138ac_add_options --enable-jack
139ac_add_options --disable-updater
140END
141}
142
143build() {
144 cd $_pkgname-v$_pkgver
145
146 export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=pip
147 export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
148 export MOZ_BUILD_DATE="$(date -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH} +%Y%m%d%H%M%S)"
149 export MOZ_NOSPAM=1
150
151 # malloc_usable_size is used in various parts of the codebase
152 CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
153 CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
154
155 # Breaks compilation since https://bugzilla.mozilla.org/show_bug.cgi?id=1896066
156 CFLAGS="${CFLAGS/-fexceptions/}"
157 CXXFLAGS="${CXXFLAGS/-fexceptions/}"
158
159 # LTO needs more open files
160 ulimit -n 4096
161
162 if [[ "${_build_pgo:-t}" == "t" ]]; then
163 # Do 3-tier PGO
164 echo "Building instrumented browser..."
165 cat > .mozconfig ../mozconfig - << END
166ac_add_options --enable-profile-generate=cross
167END
168 ./mach build --priority normal
169
170 echo "Profiling instrumented browser..."
171 ./mach package
172 LLVM_PROFDATA=llvm-profdata JARLOG_FILE="$PWD/jarlog" \
173 dbus-run-session \
174 xvfb-run -s "-screen 0 1920x1080x24 -nolisten local" \
175 ./mach python build/pgo/profileserver.py
176
177 stat -c "Profile data found (%s bytes)" merged.profdata
178 test -s merged.profdata
179
180 stat -c "Jar log found (%s bytes)" jarlog
181 test -s jarlog
182
183 echo "Removing instrumented browser..."
184 ./mach clobber objdir
185
186 echo "Building optimized browser..."
187 cat > .mozconfig ../mozconfig - << END
188ac_add_options --enable-lto=cross,full
189ac_add_options --enable-profile-use=cross
190ac_add_options --with-pgo-profile-path=${PWD@Q}/merged.profdata
191ac_add_options --with-pgo-jarlog=${PWD@Q}/jarlog
192END
193 else
194 cat > .mozconfig ../mozconfig
195 fi
196 ./mach build --priority normal
197
198 cat browser/locales/shipped-locales | xargs ./mach package-multi-locale --locales
199}
200
201package() {
202 cd $_pkgname-v$_pkgver
203
204 mkdir -p "$pkgdir/usr/lib"
205 tar -xvf obj/dist/"$(cat obj/dist/package_name.txt)" -C "$pkgdir/usr/lib"
206
207 local appdir="$pkgdir/usr/lib/$_pkgname"
208
209 install -Dvm644 /dev/stdin "$appdir/browser/defaults/preferences/vendor.js" << END
210// Use LANG environment variable to choose locale
211pref("intl.locale.requested", "");
212
213// Use system-provided dictionaries
214pref("spellchecker.dictionary_path", "/usr/share/hunspell");
215
216// Disable default browser checking.
217pref("browser.shell.checkDefaultBrowser", false);
218
219// Don't disable extensions in the application directory
220pref("extensions.autoDisableScopes", 11);
221
222// Enable GNOME Shell search provider
223pref("browser.gnome-search-provider.enabled", true);
224END
225
226 install -Dvm644 /dev/stdin "$appdir/distribution/distribution.ini" << END
227[Global]
228id=${pkgname}
229version=${pkgver}-${pkgrel}
230about=${pkgdesc}
231
232[Preferences]
233app.distributor=garudalinux
234app.distributor.channel=${pkgname}
235app.partner.garudalinux=garudalinux
236END
237
238 # Link up system ONNX runtime
239 ln -srv "$pkgdir/usr/lib/libonnxruntime.so" -t "$appdir"
240
241 # Install desktop icons and metadata
242 local i
243 for i in 16 22 24 32 48 64 128 256; do
244 install -Dvm644 "browser/$_pkgname/branding/$_branding/default$i.png" \
245 "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$_rdns.png"
246 done
247
248 install -Dvm644 browser/$_pkgname/assets/$_rdns.desktop -t "$pkgdir/usr/share/applications"
249 install -Dvm644 browser/$_pkgname/assets/$_rdns.metainfo.xml -t "$pkgdir/usr/share/metainfo"
250
251 # Install a wrapper to avoid confusion about binary path
252 install -Dvm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << END
253#!/bin/sh
254exec /usr/lib/$_pkgname/$_pkgname "\$@"
255END
256
257 # Replace duplicate binary with wrapper
258 # https://bugzilla.mozilla.org/show_bug.cgi?id=658850
259 ln -srfv "$pkgdir/usr/bin/$_pkgname" "$pkgdir/usr/lib/$_pkgname/$_pkgname-bin"
260
261 # Use system certificates
262 if [[ -e $appdir/libnss3.so ]]; then
263 ln -sfv ../libnssckbi.so -t "$appdir"
264 fi
265
266 # Register GNOME search provider
267 install -Dvm644 /dev/stdin "$pkgdir/usr/share/gnome-shell/search-providers/$_pkgname.search-provider.ini" << END
268[Shell Search Provider]
269DesktopId=$_pkgname.desktop
270BusName=org.mozilla.${_pkgname//-/_}.SearchProvider
271ObjectPath=/org/mozilla/${_pkgname//-/_}/SearchProvider
272Version=2
273END
274}
275

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -3,9 +3,9 @@
_pkgname=firedragon
__pkgname=$_pkgname
_rdns=org.garudalinux.$__pkgname
-_pkgver=13.10.0
+_pkgver=13.11.0
_branding=dr460nized
-_gentoo=firefox-158-patches-02.tar.xz
+_gentoo=firefox-159-patches-01.tar.xz
_gentoo_exclude=(0014-bgo-940031-wasm-support-firefox-155.patch)
pkgname=$__pkgname
@@ -48,6 +48,7 @@
ttf-font)
makedepends=(cbindgen
clang
+ corepack
diffutils
imake
jack
@@ -57,7 +58,6 @@
nasm
nodejs
onnxruntime
- pnpm
python
rust
unzip
@@ -84,8 +84,8 @@
noextract=($_gentoo)
source=($_pkgname-v$_pkgver.source.tar.xz::$url/-/releases/v$_pkgver/downloads/$_pkgname.source.tar.xz
https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo)
-sha256sums=('6c1e498c758fa940bb699ea23e40b8d3cdfaa8eb8cf85dcb8c32c302921fbfb1'
- 'a0c58c8abd6b6c0aae19495b596a7a82fc6e0805a89df33a16d640fa6e1b0afb')
+sha256sums=('4e921dacd815421319df82f8a5c1e2104199065e1d2ce13526b30c7f3255b9ff'
+ 'ffe58cc79c6439aa19cf52b245f2a7d730b27700c652319dc3a5a9d10d162df7')
prepare() {
mkdir -p mozbuild
@@ -113,8 +113,17 @@
export FIREDRAGON_TARGET=linux-arm64
fi
- pnpm -C browser/$_pkgname install --frozen-lockfile
- pnpm -C browser/$_pkgname all:build
+ export COREPACK_HOME="$srcdir"/.corepack
+ export PNPM_HOME="$srcdir"/.pnpm
+ export PATH="$srcdir"/.bin:"$PATH"
+
+ mkdir -p "$srcdir"/.bin
+ corepack enable --install-directory "$srcdir"/.bin
+
+ pushd browser/$_pkgname > /dev/null
+ corepack pnpm install --frozen-lockfile
+ corepack pnpm all:build
+ popd > /dev/null
cat >> ../mozconfig << END
ac_add_options --enable-linker=lld

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 07:52:02 Medium 1
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 15:37:50 Medium 1
2026-10-23 00:02:19 Low 2
2026-10-22 19:36:04 Medium 1
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion