firefox-extension-ruffle
maintainer ZhangHua
· 0 votes
· base
ruffle
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The PKGBUILD installs wasm-bindgen-cli via cargo only when a local flag is set, which is a legitimate build dependency for the project being compiled from its official source; this is normal build tooling, not an external untrusted install.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The PKGBUILD installs wasm-bindgen-cli via cargo only when a local flag is set, which is a legitimate build dependency for the project being compiled from its official source; this is normal build tooling, not an external untrusted install.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:37
cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"
PKGBUILD
1 offending line(s) highlighted
1
_system_wasm_bindgen=false
2
3
pkgbase=ruffle
4
pkgname=(ruffle
5
ruffle-demo
6
ruffle-selfhosted
7
firefox-extension-ruffle
8
chromium-extension-ruffle)
9
pkgver=0.4.0
10
pkgrel=1
11
arch=("x86_64")
12
pkgdesc="A Flash Player emulator written in Rust."
13
url="https://ruffle.rs/"
14
license=("MIT OR Apache-2.0")
15
makedepends=("cargo" "cmake" "java-environment" "npm" "nodejs-lts-jod"
16
"binaryen" "gtk3" "alsa-lib" "libxcb" "systemd-libs"
17
"clang" "jq" "git" "openssl" "rust-wasm" "rust-src")
18
if "$_system_wasm_bindgen"
19
then
20
makedepends+=("wasm-bindgen")
21
else
22
makedepends+=("yq")
23
fi
24
source=("git+https://github.com/ruffle-rs/ruffle.git#tag=v$pkgver")
25
sha256sums=('7900b7de8f4a4da410d30d2b290db5d4dd247d9b28e3bf6b42a27bf4bb1236d2')
26
options=("!lto")
27
28
_FIREFOX_EXTENSION_ID="ruffle@ruffle.rs"
29
30
prepare() {
31
cd "$srcdir/ruffle"
32
export RUSTUP_TOOLCHAIN=stable
33
if ! "$_system_wasm_bindgen"
34
then
35
local require_wasm_bindgen_version
36
require_wasm_bindgen_version="$(tomlq -r '.package[] | select(.name == "wasm-bindgen") | .version' Cargo.lock)"
37
cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"
38
fi
39
cargo fetch --locked --target host-tuple
40
cargo fetch --locked --target wasm32-unknown-unknown
41
cd web
42
npm ci
43
jq --null-input \
44
--arg version_channel "stable" \
45
--arg version_number "$pkgver" \
46
--arg version_name "$pkgver" \
47
--arg build_date "$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)" \
48
--arg build_id "$pkgrel" \
49
--arg commitHash "$(git rev-parse HEAD)" \
50
--arg firefox_extension_id "$_FIREFOX_EXTENSION_ID" \
51
'$ARGS.named' > version_seal.json
52
echo "Generated version_seal.json:"
53
cat version_seal.json
54
}
55
56
build() {
57
cd "$srcdir/ruffle"
58
if ! "$_system_wasm_bindgen"
59
then
60
export PATH="$PATH:$HOME/.cargo/bin"
61
fi
62
export RUSTUP_TOOLCHAIN=stable
63
export CARGO_TARGET_DIR=target
64
# libtracy_client-sys seems missing some symbols, skip enabling all features.
65
# jpegxr is not compatible to rust 1.94.0
66
cargo build --frozen --release \
67
--package=ruffle_desktop \
68
--package=ruffle_scanner \
69
--package=exporter
70
71
# Script will read binary at hardcoded path
72
# See web/packages/core/tools/build_wasm.ts for more info.
73
unset CARGO_TARGET_DIR
74
# Flags does not supported by WASM target:
75
# C/CXX: -mtune -march -fcf-protection
76
# RUST: -Ctarget-cpu
77
CFLAGS="$(echo "$CFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
78
CXXFLAGS="$(echo "$CXXFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
79
RUSTFLAGS="$(echo "$RUSTFLAGS" | sed -E 's/\s*-C\s*target-cpu=[0-9a-zA-Z]+//')"
80
81
cd web
82
npm run build:repro
83
}
84
85
check() {
86
cd "$srcdir/ruffle"
87
export RUSTUP_TOOLCHAIN=stable
88
cargo test --frozen \
89
--package=ruffle_desktop \
90
--package=ruffle_scanner \
91
--package=exporter
92
93
cd web
94
npm run test
95
}
96
97
package_ruffle() {
98
depends=("hicolor-icon-theme" "alsa-lib" "systemd-libs" "libgcc" "glibc")
99
pkgdesc+=" (Desktop app and utils)"
100
101
cd "$srcdir/ruffle"
102
local f
103
find target/release -maxdepth 1 -executable -type f | while read -r f
104
do
105
local target
106
target="$(basename "$f")"
107
target=${target/_/-}
108
if ! [[ "$target" =~ ^ruffle- ]]
109
then
110
target="ruffle-$target"
111
fi
112
if [[ "$target" == "ruffle-desktop" ]]
113
then
114
target="ruffle"
115
fi
116
echo "Installing $f to $target..."
117
install -Dm755 "$f" "$pkgdir/usr/bin/$target"
118
done
119
120
install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.desktop \
121
"$pkgdir/usr/share/applications/rs.ruffle.Ruffle.desktop"
122
install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.metainfo.xml \
123
"$pkgdir/usr/share/metainfo/rs.ruffle.Ruffle.metainfo.xml"
124
install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.svg \
125
"$pkgdir/usr/share/icons/hicolor/scalable/apps/rs.ruffle.Ruffle.svg"
126
install -Dm644 LICENSE.md \
127
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
128
install -Dm644 README.md \
129
"$pkgdir/usr/share/doc/ruffle/README.md"
130
}
131
132
package_ruffle-demo() {
133
pkgdesc+=" (Demo web app)"
134
arch=("any")
135
136
cd "$srcdir/ruffle"
137
mkdir -p "$pkgdir/usr/share/webapps"
138
cp -a --no-preserve=ownership \
139
web/packages/demo/dist \
140
"$pkgdir/usr/share/webapps/ruffle"
141
install -Dm644 web/packages/demo/LICENSE_APACHE \
142
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
143
install -Dm644 web/packages/demo/LICENSE_MIT \
144
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
145
install -Dm644 web/packages/demo/README.md \
146
"$pkgdir/usr/share/doc/ruffle/demo/README.md"
147
}
148
149
package_ruffle-selfhosted() {
150
pkgdesc+=" (JavaScript module)"
151
arch=("any")
152
153
cd "$srcdir/ruffle"
154
mkdir -p \
155
"$pkgdir/usr/lib/node_modules" \
156
"$pkgdir/usr/share/licenses/$pkgname"
157
cp -a --no-preserve=ownership \
158
web/packages/selfhosted/dist \
159
"$pkgdir/usr/lib/node_modules/ruffle"
160
ln -srfv \
161
"$pkgdir/usr/lib/node_modules/ruffle/LICENSE_APACHE" \
162
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
163
ln -srfv \
164
"$pkgdir/usr/lib/node_modules/ruffle/LICENSE_MIT" \
165
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
166
install -Dm644 web/packages/selfhosted/README.md \
167
"$pkgdir/usr/share/doc/ruffle/selfhosted/README.md"
168
}
169
170
package_firefox-extension-ruffle() {
171
optdepends=("firefox: Load extension in browser.")
172
pkgdesc+=" (Unsigned Firefox extension)"
173
arch=("any")
174
175
cd "$srcdir/ruffle"
176
install -Dm644 web/packages/extension/dist/firefox_unsigned.xpi \
177
"$pkgdir/usr/lib/firefox/browser/extensions/$_FIREFOX_EXTENSION_ID.xpi"
178
install -Dm644 web/packages/extension/LICENSE_APACHE \
179
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
180
install -Dm644 web/packages/extension/LICENSE_MIT \
181
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
182
}
183
184
package_chromium-extension-ruffle() {
185
optdepends=("chromium: Load extension in browser.")
186
pkgdesc+=" (Chromium extension)"
187
arch=("any")
188
189
cd "$srcdir/ruffle"
190
local extension_id=donbcfbmhbcapadipfkeojnmajbakjdc # https://chromewebstore.google.com/detail/ruffle-flash-emulator/donbcfbmhbcapadipfkeojnmajbakjdc
191
echo "Installing chromium extension $extension_id..."
192
jq --null-input --raw-output \
193
--arg external_update_url https://clients2.google.com/service/update2/crx \
194
'$ARGS.named' | \
195
install -Dm644 "/dev/stdin" \
196
"$pkgdir/usr/share/chromium/extensions/$extension_id.json"
197
install -Dm644 web/packages/extension/LICENSE_APACHE \
198
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
199
install -Dm644 web/packages/extension/LICENSE_MIT \
200
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
201
}
202
Changes since previous scan
--- PKGBUILD @ 2026-07-19 00:17+++ PKGBUILD @ 2026-08-03 00:08@@ -6,7 +6,7 @@ ruffle-selfhosted firefox-extension-ruffle chromium-extension-ruffle)-pkgver=0.3.0+pkgver=0.4.0 pkgrel=1 arch=("x86_64") pkgdesc="A Flash Player emulator written in Rust."@@ -22,7 +22,7 @@ makedepends+=("yq") fi source=("git+https://github.com/ruffle-rs/ruffle.git#tag=v$pkgver")-sha256sums=('4e8ebe2b041d72fc5d9560434e7c2599e9977f8565ea915a2d42ea36dd0a57a4')+sha256sums=('7900b7de8f4a4da410d30d2b290db5d4dd247d9b28e3bf6b42a27bf4bb1236d2') options=("!lto") _FIREFOX_EXTENSION_ID="ruffle@ruffle.rs"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 01:12:32 | MEDIUM | 1 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 02:00:03 | MEDIUM | 1 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |