firedragon-catppuccin-next
LOW
maintainer stefanwimmer128
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source code from the project's own GitLab instance and a Gentoo developer's site to build the browser from source, which is normal for AUR packages; the non-whitelisted host is plausibly project-related and the downloaded files are not prebuilt binaries but source/patches intended for compilation.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from the project's own GitLab instance and a Gentoo developer's site to build the browser from source, which is normal for AUR packages; the non-whitelisted host is plausibly project-related and the downloaded files are not prebuilt binaries but source/patches intended for compilation.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:91
https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Stefan Wimmer <info@stefanwimmer128.xyz>
2
3
_pkgname=firedragon
4
__pkgname=$_pkgname-catppuccin
5
_rdns=org.garudalinux.$__pkgname
6
_pkgver=13.0.0-rc.27
7
_branding=catppuccin
8
_gentoo=firefox-153-patches-01.tar.xz
9
_gentoo_exclude=(0015-bgo-940031-wasm-support.patch)
10
11
pkgname=$__pkgname-next
12
pkgver=${_pkgver//-/_}
13
pkgrel=1
14
pkgdesc="FireDragon is a cross-platform, feature-rich and privacy-focused web browser"
15
url="https://gitlab.com/garuda-linux/firedragon/firedragon13"
16
arch=(x86_64 aarch64)
17
license=(MPL-2.0)
18
depends=(
19
alsa-lib
20
at-spi2-core
21
bash
22
cairo
23
dbus
24
ffmpeg
25
fontconfig
26
freetype2
27
gdk-pixbuf2
28
glib2
29
glibc
30
gtk3
31
hicolor-icon-theme
32
libgcc
33
libpulse
34
libstdc++
35
libx11
36
libxcb
37
libxcomposite
38
libxdamage
39
libxext
40
libxfixes
41
libxrandr
42
libxss
43
libxt
44
mime-types
45
nspr
46
nss
47
pango
48
ttf-font
49
)
50
makedepends=(
51
cbindgen
52
clang
53
diffutils
54
imake
55
jack
56
lld
57
llvm
58
mesa
59
nasm
60
nodejs
61
onnxruntime
62
pnpm
63
python
64
rust
65
unzip
66
wasi-compiler-rt
67
wasi-libc
68
wasi-libc++
69
wasi-libc++abi
70
xorg-server-xvfb
71
yasm
72
zip
73
)
74
optdepends=(
75
'hunspell-en_US: Spell checking, American English'
76
'libnotify: Notification integration'
77
'networkmanager: Location detection via available WiFi networks'
78
'onnxruntime: Local machine learning features such as smart tab groups'
79
'speech-dispatcher: Text-to-Speech'
80
'xdg-desktop-portal: Screensharing with Wayland'
81
)
82
provides=($_pkgname)
83
conflicts=($_pkgname)
84
options=(
85
!emptydirs
86
!lto
87
!makeflags
88
)
89
source=(
90
$_pkgname-v$_pkgver.source.tar.xz::$url/-/releases/v$_pkgver/downloads/$_pkgname.source.tar.xz
91
https://dev.gentoo.org/~juippis/mozilla/patchsets/$_gentoo
92
)
93
sha256sums=('5520b0d0dbc80e96a81f4b4a859a4feccddea210c349d49dda3b7f5e264d5270'
94
'9dc3e9423eea9b8bf16cd7cc2545a539717e9b32c1e4242a332988ff0add923e')
95
noextract=($_gentoo)
96
97
prepare() {
98
mkdir -p mozbuild
99
cd $_pkgname-v$_pkgver
100
101
tar -Oxf "$srcdir/$_gentoo" $(printf -- '--exclude=%s' "${_gentoo_exclude[@]}") | patch -Nsp1
102
103
echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/edition/$_pkgname-$_branding.mozconfig\"" > ../mozconfig
104
export FIREDRAGON_EDITION=$_branding
105
106
if [ $CARCH = x86_64 ]; then
107
echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/target/linux-x64.mozconfig\"" >> ../mozconfig
108
export FIREDRAGON_TARGET=linux-x64
109
elif [ $CARCH = aarch64 ]; then
110
echo ". \"\$topsrcdir/browser/$_pkgname/mozconfig/target/linux-arm64.mozconfig\"" >> ../mozconfig
111
export FIREDRAGON_TARGET=linux-arm64
112
fi
113
114
pnpm -C browser/$_pkgname install --frozen-lockfile
115
pnpm -C browser/$_pkgname all:build
116
117
cat >> ../mozconfig <<END
118
ac_add_options --enable-linker=lld
119
ac_add_options --disable-bootstrap
120
ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
121
122
# System libraries
123
ac_add_options --with-system-nspr
124
ac_add_options --with-system-nss
125
126
# Features
127
ac_add_options --enable-jack
128
ac_add_options --disable-updater
129
END
130
}
131
132
build() {
133
cd $_pkgname-v$_pkgver
134
135
export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=pip
136
export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
137
export MOZ_BUILD_DATE="$(date -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH} +%Y%m%d%H%M%S)"
138
export MOZ_NOSPAM=1
139
140
# malloc_usable_size is used in various parts of the codebase
141
CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
142
CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
143
144
# Breaks compilation since https://bugzilla.mozilla.org/show_bug.cgi?id=1896066
145
CFLAGS="${CFLAGS/-fexceptions/}"
146
CXXFLAGS="${CXXFLAGS/-fexceptions/}"
147
148
# LTO needs more open files
149
ulimit -n 4096
150
151
if [[ "${_build_pgo:-t}" == "t" ]]; then
152
# Do 3-tier PGO
153
echo "Building instrumented browser..."
154
cat >.mozconfig ../mozconfig - <<END
155
ac_add_options --enable-profile-generate=cross
156
END
157
./mach build --priority normal
158
159
echo "Profiling instrumented browser..."
160
./mach package
161
LLVM_PROFDATA=llvm-profdata JARLOG_FILE="$PWD/jarlog" \
162
dbus-run-session \
163
xvfb-run -s "-screen 0 1920x1080x24 -nolisten local" \
164
./mach python build/pgo/profileserver.py
165
166
stat -c "Profile data found (%s bytes)" merged.profdata
167
test -s merged.profdata
168
169
stat -c "Jar log found (%s bytes)" jarlog
170
test -s jarlog
171
172
echo "Removing instrumented browser..."
173
./mach clobber objdir
174
175
echo "Building optimized browser..."
176
cat >.mozconfig ../mozconfig - <<END
177
ac_add_options --enable-lto=cross,full
178
ac_add_options --enable-profile-use=cross
179
ac_add_options --with-pgo-profile-path=${PWD@Q}/merged.profdata
180
ac_add_options --with-pgo-jarlog=${PWD@Q}/jarlog
181
END
182
else
183
cat >.mozconfig ../mozconfig
184
fi
185
./mach build --priority normal
186
187
cat browser/locales/shipped-locales | xargs ./mach package-multi-locale --locales
188
}
189
190
package() {
191
cd $_pkgname-v$_pkgver
192
193
mkdir -p "$pkgdir/usr/lib"
194
tar -xvf obj/dist/"$(cat obj/dist/package_name.txt)" -C "$pkgdir/usr/lib"
195
196
local appdir="$pkgdir/usr/lib/$_pkgname"
197
198
install -Dvm644 /dev/stdin "$appdir/browser/defaults/preferences/vendor.js" <<END
199
// Use LANG environment variable to choose locale
200
pref("intl.locale.requested", "");
201
202
// Use system-provided dictionaries
203
pref("spellchecker.dictionary_path", "/usr/share/hunspell");
204
205
// Disable default browser checking.
206
pref("browser.shell.checkDefaultBrowser", false);
207
208
// Don't disable extensions in the application directory
209
pref("extensions.autoDisableScopes", 11);
210
211
// Enable GNOME Shell search provider
212
pref("browser.gnome-search-provider.enabled", true);
213
END
214
215
install -Dvm644 /dev/stdin "$appdir/distribution/distribution.ini" <<END
216
[Global]
217
id=${pkgname}
218
version=${pkgver}-${pkgrel}
219
about=${pkgdesc}
220
221
[Preferences]
222
app.distributor=garudalinux
223
app.distributor.channel=${pkgname}
224
app.partner.garudalinux=garudalinux
225
END
226
227
# Link up system ONNX runtime
228
ln -srv "$pkgdir/usr/lib/libonnxruntime.so" -t "$appdir"
229
230
# Install desktop icons and metadata
231
local i
232
for i in 16 22 24 32 48 64 128 256; do
233
install -Dvm644 "browser/$_pkgname/branding/$_branding/default$i.png" \
234
"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$_rdns.png"
235
done
236
237
install -Dvm644 browser/$_pkgname/assets/$_rdns.desktop -t "$pkgdir/usr/share/applications"
238
install -Dvm644 browser/$_pkgname/assets/$_rdns.metainfo.xml -t "$pkgdir/usr/share/metainfo"
239
240
# Install a wrapper to avoid confusion about binary path
241
install -Dvm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" <<END
242
#!/bin/sh
243
exec /usr/lib/$_pkgname/$_pkgname "\$@"
244
END
245
246
# Replace duplicate binary with wrapper
247
# https://bugzilla.mozilla.org/show_bug.cgi?id=658850
248
ln -srfv "$pkgdir/usr/bin/$_pkgname" "$pkgdir/usr/lib/$_pkgname/$_pkgname-bin"
249
250
# Use system certificates
251
if [[ -e $appdir/libnss3.so ]]; then
252
ln -sfv ../libnssckbi.so -t "$appdir"
253
fi
254
255
# Register GNOME search provider
256
install -Dvm644 /dev/stdin "$pkgdir/usr/share/gnome-shell/search-providers/$_pkgname.search-provider.ini" <<END
257
[Shell Search Provider]
258
DesktopId=$_pkgname.desktop
259
BusName=org.mozilla.${_pkgname//-/_}.SearchProvider
260
ObjectPath=/org/mozilla/${_pkgname//-/_}/SearchProvider
261
Version=2
262
END
263
}
264
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |