firefox-extension-ruffle
LOW
maintainer ZhangHua
0 votes
base
ruffle
scanned 2026-11-01 00:21:48.120785
Why flagged
The PKGBUILD installs wasm-bindgen-cli via cargo install during prepare(), but this is a build dependency for the project's own source from a trusted upstream (GitHub), not an untrusted external payload.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The PKGBUILD installs wasm-bindgen-cli via cargo install during prepare(), but this is a build dependency for the project's own source from a trusted upstream (GitHub), not an untrusted external payload.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:37
cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"
PKGBUILD
1 offending line(s) highlighted
1
_system_wasm_bindgen=false
2
3
pkgbase=ruffle
4
pkgname=(ruffle
5
ruffle-demo
6
ruffle-selfhosted
7
firefox-extension-ruffle
8
chromium-extension-ruffle)
9
pkgver=0.7.0
10
pkgrel=1
11
arch=("x86_64")
12
pkgdesc="A Flash Player emulator written in Rust."
13
url="https://ruffle.rs/"
14
license=("MIT OR Apache-2.0")
15
makedepends=("cargo" "cmake" "java-environment" "npm" "nodejs-lts-jod"
16
"binaryen" "gtk3" "alsa-lib" "libxcb" "systemd-libs"
17
"clang" "jq" "git" "openssl" "rust-wasm" "rust-src")
18
if "$_system_wasm_bindgen"
19
then
20
makedepends+=("wasm-bindgen")
21
else
22
makedepends+=("yq")
23
fi
24
source=("git+https://github.com/ruffle-rs/ruffle.git#tag=v$pkgver")
25
sha256sums=('7e80a5bf3ce7153828cb4debd5257b789adcbceb00be7f8669fcbbfe0e64caef')
26
options=("!lto")
27
28
_FIREFOX_EXTENSION_ID="ruffle@ruffle.rs"
29
30
prepare() {
31
cd "$srcdir/ruffle"
32
export RUSTUP_TOOLCHAIN=stable
33
if ! "$_system_wasm_bindgen"
34
then
35
local require_wasm_bindgen_version
36
require_wasm_bindgen_version="$(tomlq -r '.package[] | select(.name == "wasm-bindgen") | .version' Cargo.lock)"
37
cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"
38
fi
39
cargo fetch --locked --target host-tuple
40
cargo fetch --locked --target wasm32-unknown-unknown
41
cd web
42
npm ci
43
jq --null-input \
44
--arg version_channel "stable" \
45
--arg version_number "$pkgver" \
46
--arg version_name "$pkgver" \
47
--arg build_date "$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)" \
48
--arg build_id "$pkgrel" \
49
--arg commitHash "$(git rev-parse HEAD)" \
50
--arg firefox_extension_id "$_FIREFOX_EXTENSION_ID" \
51
'$ARGS.named' > version_seal.json
52
echo "Generated version_seal.json:"
53
cat version_seal.json
54
}
55
56
build() {
57
cd "$srcdir/ruffle"
58
if ! "$_system_wasm_bindgen"
59
then
60
export PATH="$PATH:$HOME/.cargo/bin"
61
fi
62
export RUSTUP_TOOLCHAIN=stable
63
export CARGO_TARGET_DIR=target
64
# libtracy_client-sys seems missing some symbols, skip enabling all features.
65
# jpegxr is not compatible to rust 1.94.0
66
cargo build --frozen --release \
67
--package=ruffle_desktop \
68
--package=ruffle_scanner \
69
--package=exporter
70
71
# Script will read binary at hardcoded path
72
# See web/packages/core/tools/build_wasm.ts for more info.
73
unset CARGO_TARGET_DIR
74
# Flags does not supported by WASM target:
75
# C/CXX: -mtune -march -fcf-protection
76
# RUST: -Ctarget-cpu
77
CFLAGS="$(echo "$CFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
78
CXXFLAGS="$(echo "$CXXFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
79
RUSTFLAGS="$(echo "$RUSTFLAGS" | sed -E 's/\s*-C\s*target-cpu=[0-9a-zA-Z]+//')"
80
81
cd web
82
npm run build:repro
83
}
84
85
check() {
86
cd "$srcdir/ruffle"
87
export RUSTUP_TOOLCHAIN=stable
88
cargo test --frozen \
89
--package=ruffle_desktop \
90
--package=ruffle_scanner \
91
--package=exporter
92
93
cd web
94
npm run test
95
}
96
97
package_ruffle() {
98
depends=("hicolor-icon-theme" "alsa-lib" "systemd-libs" "libgcc" "glibc")
99
pkgdesc+=" (Desktop app and utils)"
100
101
cd "$srcdir/ruffle"
102
local f
103
find target/release -maxdepth 1 -executable -type f | while read -r f
104
do
105
local target
106
target="$(basename "$f")"
107
target=${target/_/-}
108
if ! [[ "$target" =~ ^ruffle- ]]
109
then
110
target="ruffle-$target"
111
fi
112
if [[ "$target" == "ruffle-desktop" ]]
113
then
114
target="ruffle"
115
fi
116
echo "Installing $f to $target..."
117
install -Dm755 "$f" "$pkgdir/usr/bin/$target"
118
done
119
120
install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.desktop \
121
"$pkgdir/usr/share/applications/rs.ruffle.Ruffle.desktop"
122
install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.metainfo.xml \
123
"$pkgdir/usr/share/metainfo/rs.ruffle.Ruffle.metainfo.xml"
124
install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.svg \
125
"$pkgdir/usr/share/icons/hicolor/scalable/apps/rs.ruffle.Ruffle.svg"
126
install -Dm644 LICENSE.md \
127
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
128
install -Dm644 README.md \
129
"$pkgdir/usr/share/doc/ruffle/README.md"
130
}
131
132
package_ruffle-demo() {
133
pkgdesc+=" (Demo web app)"
134
arch=("any")
135
136
cd "$srcdir/ruffle"
137
mkdir -p "$pkgdir/usr/share/webapps"
138
cp -a --no-preserve=ownership \
139
web/packages/demo/dist \
140
"$pkgdir/usr/share/webapps/ruffle"
141
install -Dm644 web/packages/demo/LICENSE_APACHE \
142
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
143
install -Dm644 web/packages/demo/LICENSE_MIT \
144
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
145
install -Dm644 web/packages/demo/README.md \
146
"$pkgdir/usr/share/doc/ruffle/demo/README.md"
147
}
148
149
package_ruffle-selfhosted() {
150
pkgdesc+=" (JavaScript module)"
151
arch=("any")
152
153
cd "$srcdir/ruffle"
154
mkdir -p \
155
"$pkgdir/usr/lib/node_modules" \
156
"$pkgdir/usr/share/licenses/$pkgname"
157
cp -a --no-preserve=ownership \
158
web/packages/selfhosted/dist \
159
"$pkgdir/usr/lib/node_modules/ruffle"
160
ln -srfv \
161
"$pkgdir/usr/lib/node_modules/ruffle/LICENSE_APACHE" \
162
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
163
ln -srfv \
164
"$pkgdir/usr/lib/node_modules/ruffle/LICENSE_MIT" \
165
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
166
install -Dm644 web/packages/selfhosted/README.md \
167
"$pkgdir/usr/share/doc/ruffle/selfhosted/README.md"
168
}
169
170
package_firefox-extension-ruffle() {
171
optdepends=("firefox: Load extension in browser.")
172
pkgdesc+=" (Unsigned Firefox extension)"
173
arch=("any")
174
175
cd "$srcdir/ruffle"
176
install -Dm644 web/packages/extension/dist/firefox_unsigned.xpi \
177
"$pkgdir/usr/lib/firefox/browser/extensions/$_FIREFOX_EXTENSION_ID.xpi"
178
install -Dm644 web/packages/extension/LICENSE_APACHE \
179
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
180
install -Dm644 web/packages/extension/LICENSE_MIT \
181
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
182
}
183
184
package_chromium-extension-ruffle() {
185
optdepends=("chromium: Load extension in browser.")
186
pkgdesc+=" (Chromium extension)"
187
arch=("any")
188
189
cd "$srcdir/ruffle"
190
local extension_id=donbcfbmhbcapadipfkeojnmajbakjdc # https://chromewebstore.google.com/detail/ruffle-flash-emulator/donbcfbmhbcapadipfkeojnmajbakjdc
191
echo "Installing chromium extension $extension_id..."
192
jq --null-input --raw-output \
193
--arg external_update_url https://clients2.google.com/service/update2/crx \
194
'$ARGS.named' | \
195
install -Dm644 "/dev/stdin" \
196
"$pkgdir/usr/share/chromium/extensions/$extension_id.json"
197
install -Dm644 web/packages/extension/LICENSE_APACHE \
198
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
199
install -Dm644 web/packages/extension/LICENSE_MIT \
200
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
201
}
202
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |