firedragon-catppuccin

maintainer stefanwimmer128 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds a browser from source hosted on the project's official GitLab instance, which is a normal AUR practice; the non-whitelisted host is the project's own domain, and the source is verified via checksum.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds a browser from source hosted on the project's official GitLab instance, which is a normal AUR practice; the non-whitelisted host is the project's own domain, and the source is verified via checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:95 https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Stefan Wimmer <info@stefanwimmer128.xyz>
    
      2
    
      3_pkgname=firedragon
    
      4__pkgname=$_pkgname-catppuccin
    
      5_rdns=org.garudalinux.$__pkgname
    
      6_pkgver=13.0.1
    
      7_branding=catppuccin
    
      8_gentoo=firefox-153-patches-01.tar.xz
    
      9_gentoo_exclude=(0015-bgo-940031-wasm-support.patch)
    
      10
    
      11pkgname=$__pkgname
    
      12pkgver=${_pkgver//-/_}
    
      13pkgrel=1
    
      14epoch=2
    
      15pkgdesc="FireDragon is a cross-platform, feature-rich and privacy-focused web browser"
    
      16url="https://gitlab.com/garuda-linux/firedragon/firedragon13"
    
      17arch=(x86_64 aarch64)
    
      18license=(MPL-2.0)
    
      19depends=(
    
      20  alsa-lib
    
      21  at-spi2-core
    
      22  bash
    
      23  cairo
    
      24  dbus
    
      25  ffmpeg
    
      26  fontconfig
    
      27  freetype2
    
      28  gdk-pixbuf2
    
      29  glib2
    
      30  glibc
    
      31  gtk3
    
      32  hicolor-icon-theme
    
      33  libgcc
    
      34  libpulse
    
      35  libstdc++
    
      36  libx11
    
      37  libxcb
    
      38  libxcomposite
    
      39  libxdamage
    
      40  libxext
    
      41  libxfixes
    
      42  libxrandr
    
      43  libxss
    
      44  libxt
    
      45  mime-types
    
      46  nspr
    
      47  nss
    
      48  pango
    
      49  ttf-font
    
      50)
    
      51makedepends=(
    
      52  cbindgen
    
      53  clang
    
      54  diffutils
    
      55  imake
    
      56  jack
    
      57  lld
    
      58  llvm
    
      59  mesa
    
      60  nasm
    
      61  nodejs
    
      62  onnxruntime
    
      63  pnpm
    
      64  python
    
      65  rust
    
      66  unzip
    
      67  wasi-compiler-rt
    
      68  wasi-libc
    
      69  wasi-libc++
    
      70  wasi-libc++abi
    
      71  xorg-server-xvfb
    
      72  yasm
    
      73  zip
    
      74)
    
      75optdepends=(
    
      76  'hunspell-en_US: Spell checking, American English'
    
      77  'libnotify: Notification integration'
    
      78  'networkmanager: Location detection via available WiFi networks'
    
      79  'onnxruntime: Local machine learning features such as smart tab groups'
    
      80  'speech-dispatcher: Text-to-Speech'
    
      81  'xdg-desktop-portal: Screensharing with Wayland'
    
      82)
    
      83provides=($_pkgname)
    
      84conflicts=($_pkgname)
    
      85replaces=($__pkgname-next)
    
      86options=(
    
      87  !emptydirs
    
      88  !lto
    
      89  !makeflags
    
      90)
    
      91install=$_pkgname.install
    
      92noextract=($_gentoo)
    
      93source=(
    
      94  $_pkgname-v$_pkgver.source.tar.xz::$url/-/releases/v$_pkgver/downloads/$_pkgname.source.tar.xz
    
      95  https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo
    
      96)
    
      97sha256sums=('c61c07a3fa2a2929207c1c7d477b1b2f3063e33e32dbaf3ea2c6d774b1d750b7'
    
      98            '9dc3e9423eea9b8bf16cd7cc2545a539717e9b32c1e4242a332988ff0add923e')
    
      99
    
      100prepare() {
    
      101  mkdir -p mozbuild
    
      102  cd $_pkgname-v$_pkgver
    
      103
    
      104  tar -Oxf "$srcdir/$_gentoo" $(printf -- '--exclude=%s' "${_gentoo_exclude[@]}") | patch -Nsp1
    
      105
    
      106  echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/edition/$_pkgname-$_branding.mozconfig\"" > ../mozconfig
    
      107  export FIREDRAGON_EDITION=$_branding
    
      108
    
      109  if [ $CARCH = x86_64 ]; then
    
      110    echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/target/linux-x64.mozconfig\"" >> ../mozconfig
    
      111    export FIREDRAGON_TARGET=linux-x64
    
      112  elif [ $CARCH = aarch64 ]; then
    
      113    echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/target/linux-arm64.mozconfig\"" >> ../mozconfig
    
      114    export FIREDRAGON_TARGET=linux-arm64
    
      115  fi
    
      116
    
      117  pnpm -C browser/$_pkgname install --frozen-lockfile
    
      118  pnpm -C browser/$_pkgname all:build
    
      119
    
      120  cat >> ../mozconfig <<END
    
      121ac_add_options --enable-linker=lld
    
      122ac_add_options --disable-bootstrap
    
      123ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
    
      124
    
      125# System libraries
    
      126ac_add_options --with-system-nspr
    
      127ac_add_options --with-system-nss
    
      128
    
      129# Features
    
      130ac_add_options --enable-jack
    
      131ac_add_options --disable-updater
    
      132END
    
      133}
    
      134
    
      135build() {
    
      136  cd $_pkgname-v$_pkgver
    
      137
    
      138  export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=pip
    
      139  export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
    
      140  export MOZ_BUILD_DATE="$(date -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH} +%Y%m%d%H%M%S)"
    
      141  export MOZ_NOSPAM=1
    
      142
    
      143  # malloc_usable_size is used in various parts of the codebase
    
      144  CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
    
      145  CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
    
      146
    
      147  # Breaks compilation since https://bugzilla.mozilla.org/show_bug.cgi?id=1896066
    
      148  CFLAGS="${CFLAGS/-fexceptions/}"
    
      149  CXXFLAGS="${CXXFLAGS/-fexceptions/}"
    
      150
    
      151  # LTO needs more open files
    
      152  ulimit -n 4096
    
      153
    
      154  if [[ "${_build_pgo:-t}" == "t" ]]; then
    
      155    # Do 3-tier PGO
    
      156    echo "Building instrumented browser..."
    
      157    cat >.mozconfig ../mozconfig - <<END
    
      158ac_add_options --enable-profile-generate=cross
    
      159END
    
      160    ./mach build --priority normal
    
      161
    
      162    echo "Profiling instrumented browser..."
    
      163    ./mach package
    
      164    LLVM_PROFDATA=llvm-profdata JARLOG_FILE="$PWD/jarlog" \
    
      165      dbus-run-session \
    
      166      xvfb-run -s "-screen 0 1920x1080x24 -nolisten local" \
    
      167      ./mach python build/pgo/profileserver.py
    
      168
    
      169    stat -c "Profile data found (%s bytes)" merged.profdata
    
      170    test -s merged.profdata
    
      171
    
      172    stat -c "Jar log found (%s bytes)" jarlog
    
      173    test -s jarlog
    
      174
    
      175    echo "Removing instrumented browser..."
    
      176    ./mach clobber objdir
    
      177
    
      178    echo "Building optimized browser..."
    
      179    cat >.mozconfig ../mozconfig - <<END
    
      180ac_add_options --enable-lto=cross,full
    
      181ac_add_options --enable-profile-use=cross
    
      182ac_add_options --with-pgo-profile-path=${PWD@Q}/merged.profdata
    
      183ac_add_options --with-pgo-jarlog=${PWD@Q}/jarlog
    
      184END
    
      185  else
    
      186    cat >.mozconfig ../mozconfig
    
      187  fi
    
      188  ./mach build --priority normal
    
      189
    
      190  cat browser/locales/shipped-locales | xargs ./mach package-multi-locale --locales
    
      191}
    
      192
    
      193package() {
    
      194  cd $_pkgname-v$_pkgver
    
      195
    
      196  mkdir -p "$pkgdir/usr/lib"
    
      197  tar -xvf obj/dist/"$(cat obj/dist/package_name.txt)" -C "$pkgdir/usr/lib"
    
      198
    
      199  local appdir="$pkgdir/usr/lib/$_pkgname"
    
      200
    
      201  install -Dvm644 /dev/stdin "$appdir/browser/defaults/preferences/vendor.js" <<END
    
      202// Use LANG environment variable to choose locale
    
      203pref("intl.locale.requested", "");
    
      204
    
      205// Use system-provided dictionaries
    
      206pref("spellchecker.dictionary_path", "/usr/share/hunspell");
    
      207
    
      208// Disable default browser checking.
    
      209pref("browser.shell.checkDefaultBrowser", false);
    
      210
    
      211// Don't disable extensions in the application directory
    
      212pref("extensions.autoDisableScopes", 11);
    
      213
    
      214// Enable GNOME Shell search provider
    
      215pref("browser.gnome-search-provider.enabled", true);
    
      216END
    
      217
    
      218  install -Dvm644 /dev/stdin "$appdir/distribution/distribution.ini" <<END
    
      219[Global]
    
      220id=${pkgname}
    
      221version=${pkgver}-${pkgrel}
    
      222about=${pkgdesc}
    
      223
    
      224[Preferences]
    
      225app.distributor=garudalinux
    
      226app.distributor.channel=${pkgname}
    
      227app.partner.garudalinux=garudalinux
    
      228END
    
      229
    
      230  # Link up system ONNX runtime
    
      231  ln -srv "$pkgdir/usr/lib/libonnxruntime.so" -t "$appdir"
    
      232
    
      233  # Install desktop icons and metadata
    
      234  local i
    
      235  for i in 16 22 24 32 48 64 128 256; do
    
      236    install -Dvm644 "browser/$_pkgname/branding/$_branding/default$i.png" \
    
      237      "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$_rdns.png"
    
      238  done
    
      239
    
      240  install -Dvm644 browser/$_pkgname/assets/$_rdns.desktop -t "$pkgdir/usr/share/applications"
    
      241  install -Dvm644 browser/$_pkgname/assets/$_rdns.metainfo.xml -t "$pkgdir/usr/share/metainfo"
    
      242
    
      243  # Install a wrapper to avoid confusion about binary path
    
      244  install -Dvm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" <<END
    
      245#!/bin/sh
    
      246exec /usr/lib/$_pkgname/$_pkgname "\$@"
    
      247END
    
      248
    
      249  # Replace duplicate binary with wrapper
    
      250  # https://bugzilla.mozilla.org/show_bug.cgi?id=658850
    
      251  ln -srfv "$pkgdir/usr/bin/$_pkgname" "$pkgdir/usr/lib/$_pkgname/$_pkgname-bin"
    
      252
    
      253  # Use system certificates
    
      254  if [[ -e $appdir/libnss3.so ]]; then
    
      255    ln -sfv ../libnssckbi.so -t "$appdir"
    
      256  fi
    
      257
    
      258  # Register GNOME search provider
    
      259  install -Dvm644 /dev/stdin "$pkgdir/usr/share/gnome-shell/search-providers/$_pkgname.search-provider.ini" <<END
    
      260[Shell Search Provider]
    
      261DesktopId=$_pkgname.desktop
    
      262BusName=org.mozilla.${_pkgname//-/_}.SearchProvider
    
      263ObjectPath=/org/mozilla/${_pkgname//-/_}/SearchProvider
    
      264Version=2
    
      265END
    
      266}
    
      267

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 _pkgname=firedragon
 __pkgname=$_pkgname-catppuccin
 _rdns=org.garudalinux.$__pkgname
-_pkgver=13.0.0
+_pkgver=13.0.1
 _branding=catppuccin
 _gentoo=firefox-153-patches-01.tar.xz
 _gentoo_exclude=(0015-bgo-940031-wasm-support.patch)
@@ -94,7 +94,7 @@
   $_pkgname-v$_pkgver.source.tar.xz::$url/-/releases/v$_pkgver/downloads/$_pkgname.source.tar.xz
   https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo
 )
-sha256sums=('a4058023d5d1eb45ae240eeb6dc0a390ba3c3abd2ad061a96d2f6046e9348dcc'
+sha256sums=('c61c07a3fa2a2929207c1c7d477b1b2f3063e33e32dbaf3ea2c6d774b1d750b7'
             '9dc3e9423eea9b8bf16cd7cc2545a539717e9b32c1e4242a332988ff0add923e')
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 09:17:30	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 21:33:42	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0