firedragon-catppuccin

LOW
maintainer stefanwimmer128 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads source code from the project's own GitLab instance and a Gentoo developer's site to build a browser; both are plausibly official sources, and the build process is transparent with no obfuscated or unverifiable executables.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from the project's own GitLab instance and a Gentoo developer's site to build a browser; both are plausibly official sources, and the build process is transparent with no obfuscated or unverifiable executables.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:86 https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo)

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Stefan Wimmer <info@stefanwimmer128.xyz>
2
3_pkgname=firedragon
4__pkgname=$_pkgname-catppuccin
5_rdns=org.garudalinux.$__pkgname
6_pkgver=13.5.1
7_branding=catppuccin
8_gentoo=firefox-155-patches-05.tar.xz
9_gentoo_exclude=(0015-bgo-940031-wasm-support-firefox-155.patch)
10
11pkgname=$__pkgname
12pkgver=${_pkgver//-/_}
13pkgrel=1
14epoch=2
15pkgdesc="FireDragon is a cross-platform, feature-rich and privacy-focused web browser"
16url="https://gitlab.com/garuda-linux/firedragon/firedragon13"
17arch=(x86_64 aarch64)
18license=(MPL-2.0)
19depends=(alsa-lib
20 at-spi2-core
21 bash
22 cairo
23 dbus
24 ffmpeg
25 fontconfig
26 freetype2
27 gdk-pixbuf2
28 glib2
29 glibc
30 gtk3
31 hicolor-icon-theme
32 libgcc
33 libpulse
34 libstdc++
35 libx11
36 libxcb
37 libxcomposite
38 libxdamage
39 libxext
40 libxfixes
41 libxrandr
42 libxss
43 libxt
44 mime-types
45 nspr
46 nss
47 pango
48 ttf-font)
49makedepends=(cbindgen
50 clang
51 diffutils
52 imake
53 jack
54 lld
55 llvm
56 mesa
57 nasm
58 nodejs
59 onnxruntime
60 pnpm
61 python
62 rust
63 unzip
64 wasi-compiler-rt
65 wasi-libc
66 wasi-libc++
67 wasi-libc++abi
68 xorg-server-xvfb
69 yasm
70 zip)
71optdepends=('hunspell-en_US: Spell checking, American English'
72 'libnotify: Notification integration'
73 'networkmanager: Location detection via available WiFi networks'
74 'onnxruntime: Local machine learning features such as smart tab groups'
75 'speech-dispatcher: Text-to-Speech'
76 'xdg-desktop-portal: Screensharing with Wayland')
77provides=($_pkgname)
78conflicts=($_pkgname)
79replaces=($__pkgname-next)
80options=(!emptydirs
81 !lto
82 !makeflags)
83install=$_pkgname.install
84noextract=($_gentoo)
85source=($_pkgname-v$_pkgver.source.tar.xz::$url/-/releases/v$_pkgver/downloads/$_pkgname.source.tar.xz
86 https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo)
87sha256sums=('a41d3ca48a271b275999d06a929d185764f7f2f92b458a274648336fcd46aa48'
88 '2900045a70ed374967828f705a18d859a22ee3d5708c8510ddbd6853392cfcb4')
89
90prepare() {
91 mkdir -p mozbuild
92 cd $_pkgname-v$_pkgver
93
94 for patch in $(tar -tf "$srcdir/$_gentoo" --wildcards '*.patch' $(printf -- '--exclude=%s' "${_gentoo_exclude[@]}")); do
95 tar -Oxf "$srcdir/$_gentoo" "$patch" | patch -Nsp1
96 done
97
98 echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/edition/$_pkgname-$_branding.mozconfig\"" > ../mozconfig
99 export FIREDRAGON_EDITION=$_branding
100
101 if [ $CARCH = x86_64 ]; then
102 echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/target/linux-x64.mozconfig\"" >> ../mozconfig
103 export FIREDRAGON_TARGET=linux-x64
104 elif [ $CARCH = aarch64 ]; then
105 echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/target/linux-arm64.mozconfig\"" >> ../mozconfig
106 export FIREDRAGON_TARGET=linux-arm64
107 fi
108
109 pnpm -C browser/$_pkgname install --frozen-lockfile
110 pnpm -C browser/$_pkgname all:build
111
112 cat >> ../mozconfig << END
113ac_add_options --enable-linker=lld
114ac_add_options --disable-bootstrap
115ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
116
117# System libraries
118ac_add_options --with-system-nspr
119ac_add_options --with-system-nss
120
121# Features
122ac_add_options --enable-jack
123ac_add_options --disable-updater
124END
125}
126
127build() {
128 cd $_pkgname-v$_pkgver
129
130 export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=pip
131 export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
132 export MOZ_BUILD_DATE="$(date -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH} +%Y%m%d%H%M%S)"
133 export MOZ_NOSPAM=1
134
135 # malloc_usable_size is used in various parts of the codebase
136 CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
137 CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
138
139 # Breaks compilation since https://bugzilla.mozilla.org/show_bug.cgi?id=1896066
140 CFLAGS="${CFLAGS/-fexceptions/}"
141 CXXFLAGS="${CXXFLAGS/-fexceptions/}"
142
143 # LTO needs more open files
144 ulimit -n 4096
145
146 if [[ "${_build_pgo:-t}" == "t" ]]; then
147 # Do 3-tier PGO
148 echo "Building instrumented browser..."
149 cat > .mozconfig ../mozconfig - << END
150ac_add_options --enable-profile-generate=cross
151END
152 ./mach build --priority normal
153
154 echo "Profiling instrumented browser..."
155 ./mach package
156 LLVM_PROFDATA=llvm-profdata JARLOG_FILE="$PWD/jarlog" \
157 dbus-run-session \
158 xvfb-run -s "-screen 0 1920x1080x24 -nolisten local" \
159 ./mach python build/pgo/profileserver.py
160
161 stat -c "Profile data found (%s bytes)" merged.profdata
162 test -s merged.profdata
163
164 stat -c "Jar log found (%s bytes)" jarlog
165 test -s jarlog
166
167 echo "Removing instrumented browser..."
168 ./mach clobber objdir
169
170 echo "Building optimized browser..."
171 cat > .mozconfig ../mozconfig - << END
172ac_add_options --enable-lto=cross,full
173ac_add_options --enable-profile-use=cross
174ac_add_options --with-pgo-profile-path=${PWD@Q}/merged.profdata
175ac_add_options --with-pgo-jarlog=${PWD@Q}/jarlog
176END
177 else
178 cat > .mozconfig ../mozconfig
179 fi
180 ./mach build --priority normal
181
182 cat browser/locales/shipped-locales | xargs ./mach package-multi-locale --locales
183}
184
185package() {
186 cd $_pkgname-v$_pkgver
187
188 mkdir -p "$pkgdir/usr/lib"
189 tar -xvf obj/dist/"$(cat obj/dist/package_name.txt)" -C "$pkgdir/usr/lib"
190
191 local appdir="$pkgdir/usr/lib/$_pkgname"
192
193 install -Dvm644 /dev/stdin "$appdir/browser/defaults/preferences/vendor.js" << END
194// Use LANG environment variable to choose locale
195pref("intl.locale.requested", "");
196
197// Use system-provided dictionaries
198pref("spellchecker.dictionary_path", "/usr/share/hunspell");
199
200// Disable default browser checking.
201pref("browser.shell.checkDefaultBrowser", false);
202
203// Don't disable extensions in the application directory
204pref("extensions.autoDisableScopes", 11);
205
206// Enable GNOME Shell search provider
207pref("browser.gnome-search-provider.enabled", true);
208END
209
210 install -Dvm644 /dev/stdin "$appdir/distribution/distribution.ini" << END
211[Global]
212id=${pkgname}
213version=${pkgver}-${pkgrel}
214about=${pkgdesc}
215
216[Preferences]
217app.distributor=garudalinux
218app.distributor.channel=${pkgname}
219app.partner.garudalinux=garudalinux
220END
221
222 # Link up system ONNX runtime
223 ln -srv "$pkgdir/usr/lib/libonnxruntime.so" -t "$appdir"
224
225 # Install desktop icons and metadata
226 local i
227 for i in 16 22 24 32 48 64 128 256; do
228 install -Dvm644 "browser/$_pkgname/branding/$_branding/default$i.png" \
229 "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$_rdns.png"
230 done
231
232 install -Dvm644 browser/$_pkgname/assets/$_rdns.desktop -t "$pkgdir/usr/share/applications"
233 install -Dvm644 browser/$_pkgname/assets/$_rdns.metainfo.xml -t "$pkgdir/usr/share/metainfo"
234
235 # Install a wrapper to avoid confusion about binary path
236 install -Dvm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << END
237#!/bin/sh
238exec /usr/lib/$_pkgname/$_pkgname "\$@"
239END
240
241 # Replace duplicate binary with wrapper
242 # https://bugzilla.mozilla.org/show_bug.cgi?id=658850
243 ln -srfv "$pkgdir/usr/bin/$_pkgname" "$pkgdir/usr/lib/$_pkgname/$_pkgname-bin"
244
245 # Use system certificates
246 if [[ -e $appdir/libnss3.so ]]; then
247 ln -sfv ../libnssckbi.so -t "$appdir"
248 fi
249
250 # Register GNOME search provider
251 install -Dvm644 /dev/stdin "$pkgdir/usr/share/gnome-shell/search-providers/$_pkgname.search-provider.ini" << END
252[Shell Search Provider]
253DesktopId=$_pkgname.desktop
254BusName=org.mozilla.${_pkgname//-/_}.SearchProvider
255ObjectPath=/org/mozilla/${_pkgname//-/_}/SearchProvider
256Version=2
257END
258}
259

Changes since previous scan

--- PKGBUILD @ 2026-09-06 00:17
+++ PKGBUILD @ 2026-09-17 00:27
@@ -3,9 +3,9 @@
_pkgname=firedragon
__pkgname=$_pkgname-catppuccin
_rdns=org.garudalinux.$__pkgname
-_pkgver=13.5.0
+_pkgver=13.5.1
_branding=catppuccin
-_gentoo=firefox-155-patches-04.tar.xz
+_gentoo=firefox-155-patches-05.tar.xz
_gentoo_exclude=(0015-bgo-940031-wasm-support-firefox-155.patch)
pkgname=$__pkgname
@@ -84,8 +84,8 @@
noextract=($_gentoo)
source=($_pkgname-v$_pkgver.source.tar.xz::$url/-/releases/v$_pkgver/downloads/$_pkgname.source.tar.xz
https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo)
-sha256sums=('7c7ea866d0017fa49fa62334e7ac23b67a8e2e6934adbac79be24df2c5ff5b25'
- '44389430272fc70fb5a86a19f75e24792fd500581431abee8fd042712c364841')
+sha256sums=('a41d3ca48a271b275999d06a929d185764f7f2f92b458a274648336fcd46aa48'
+ '2900045a70ed374967828f705a18d859a22ee3d5708c8510ddbd6853392cfcb4')
prepare() {
mkdir -p mozbuild

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 07:10:31 Medium 1
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 17:54:21 Medium 1
2026-09-03 00:15:47 Low 2
2026-09-02 09:50:35 Medium 1
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion