firefox-pure

LOW

maintainer ventureo 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The source is a Mozilla official tarball from archive.mozilla.org, a legitimate and expected host for Firefox source code, despite not being on the analyzer's whitelist; building from official project source is normal for AUR packages.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Mozilla official tarball from archive.mozilla.org, a legitimate and expected host for Firefox source code, despite not being on the analyzer's whitelist; building from official project source is normal for AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:84 "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-${pkgver%%.*}-patches-01.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vasiliy Stelmachenok <ventureo@yandex.ru>
    
      2## Arch Linux's maintainers:
    
      3# Maintainer: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
    
      4# Contributor: Ionut Biru <ibiru@archlinux.org>
    
      5# Contributor: Jakub Schmidtke <sjakub@gmail.com>
    
      6
    
      7pkgname=firefox-pure
    
      8pkgver=157.0
    
      9pkgrel=1
    
      10pkgdesc="Fast, Private & Safe Web Browser"
    
      11url="https://www.firefox.com"
    
      12arch=(x86_64)
    
      13license=(MPL-2.0)
    
      14depends=(
    
      15  alsa-lib
    
      16  at-spi2-core
    
      17  bash
    
      18  cairo
    
      19  dbus
    
      20  ffmpeg
    
      21  fontconfig
    
      22  freetype2
    
      23  gdk-pixbuf2
    
      24  glib2
    
      25  glibc
    
      26  gtk3
    
      27  hicolor-icon-theme
    
      28  icu
    
      29  libgcc
    
      30  libjpeg-turbo
    
      31  libpulse
    
      32  libstdc++
    
      33  libvpx
    
      34  libwebp
    
      35  mime-types
    
      36  nspr
    
      37  nss
    
      38  pango
    
      39  ttf-font
    
      40  zlib
    
      41)
    
      42makedepends=(
    
      43  cbindgen
    
      44  clang
    
      45  diffutils
    
      46  imake
    
      47  lld
    
      48  llvm
    
      49  mesa
    
      50  nasm
    
      51  nodejs
    
      52  python
    
      53  rust
    
      54  unzip
    
      55  wasi-compiler-rt
    
      56  wasi-libc
    
      57  wasi-libc++
    
      58  wasi-libc++abi
    
      59  cage
    
      60  xorg-xwayland
    
      61  yasm
    
      62  zip
    
      63)
    
      64optdepends=(
    
      65  'firefox-i18n: Localizations'
    
      66  'hunspell-dictionary: Spell checking, American English'
    
      67  'libnotify: Notification integration'
    
      68  'xdg-desktop-portal: Screensharing with Wayland'
    
      69)
    
      70options=(
    
      71  !emptydirs
    
      72  !lto
    
      73  !makeflags
    
      74  !ccache
    
      75)
    
      76provides=("firefox" "firefox=${pkgver}")
    
      77conflicts=(firefox)
    
      78source=(
    
      79  "https://archive.mozilla.org/pub/firefox/releases/$pkgver/source/firefox-$pkgver.source.tar.xz"
    
      80  "firefox-symbolic.svg"
    
      81  "firefox.desktop"
    
      82  "org.mozilla.firefox.metainfo.xml"
    
      83  "0001-Install-under-remoting-name.patch"
    
      84  "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-${pkgver%%.*}-patches-01.tar.xz"
    
      85)
    
      86sha256sums=(
    
      87  '259c564dd4bbd56bbe8a9a6cf001fc8812853567fd3a78e77c9ddf10d7d4e982'
    
      88  'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
    
      89  '71fe797430198ac8c00b538dce537284cf526e48be0496698cf5a980d70c16da'
    
      90  '4e01a62e20026b67466943bad9dfba47874c5e1492375f8293aeb85ecedf2288'
    
      91  'a7364ddb3b6eab922873f35731ed5cfb61e8022a35d54edd2f80b95a4f5625ed'
    
      92  'e615f4512a4faf9b8cd96ff5484875176a3c636083966659f65260cc64737060'
    
      93)
    
      94
    
      95prepare() {
    
      96  mkdir mozbuild
    
      97  cd "firefox-$pkgver"
    
      98
    
      99  # Make different channels installable in parallel
    
      100  patch -Np1 -i "${srcdir}"/0001-Install-under-remoting-name.patch
    
      101
    
      102  # Gentoo patches
    
      103  for patch in "${srcdir}/firefox-patches"/*.patch; do
    
      104    echo "Applying patch $patch..."
    
      105    [[ "$patch" == */0015-bgo-940031-wasm-support-firefox-155.patch ]] && continue
    
      106    [[ "$patch" == */0027-bgo-981812-bindgen-libcxx-fix.patch ]] && continue
    
      107    patch -Np1 -i "${patch}"
    
      108  done
    
      109
    
      110  # Unset variables to prevent issues with PGO profiling
    
      111  unset \
    
      112    DBUS_SESSION_BUS_ADDRESS \
    
      113    DISPLAY \
    
      114    ORBIT_SOCKETDIR \
    
      115    SESSION_MANAGER \
    
      116    XAUTHORITY \
    
      117    XDG_CACHE_HOME \
    
      118    XDG_SESSION_COOKIE
    
      119
    
      120  export LLVM_PROFDATA="llvm-profdata"
    
      121
    
      122  cat >../mozconfig <<END
    
      123ac_add_options --enable-project=browser
    
      124ac_add_options --disable-artifact-builds
    
      125ac_add_options MOZ_PGO=1
    
      126mk_add_options MOZ_OBJDIR=${PWD@Q}/obj
    
      127
    
      128ac_add_options --prefix=/usr
    
      129ac_add_options --enable-release
    
      130ac_add_options --enable-hardening
    
      131ac_add_options --enable-rust-simd
    
      132ac_add_options --enable-jit-simd
    
      133ac_add_options --enable-lto=cross,full
    
      134ac_add_options --enable-linker=lld
    
      135ac_add_options --enable-jemalloc
    
      136ac_add_options --enable-replace-malloc
    
      137ac_add_options --disable-cargo-incremental
    
      138ac_add_options --disable-elf-hack
    
      139ac_add_options --disable-bootstrap
    
      140ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
    
      141ac_add_options --enable-default-toolkit=cairo-gtk3-wayland-only
    
      142
    
      143# Branding
    
      144ac_add_options --enable-official-branding
    
      145ac_add_options --enable-update-channel=release
    
      146ac_add_options --with-distribution-id=org.archlinux
    
      147ac_add_options --with-unsigned-addon-scopes=app,system
    
      148ac_add_options --allow-addon-sideload
    
      149export MOZ_APP_REMOTINGNAME=firefox
    
      150
    
      151# System libraries
    
      152ac_add_options --with-system-nspr
    
      153ac_add_options --with-system-nss
    
      154ac_add_options --with-system-libvpx
    
      155ac_add_options --with-system-webp
    
      156ac_add_options --with-system-jpeg
    
      157ac_add_options --with-system-zlib
    
      158
    
      159# Optimization
    
      160ac_add_options --enable-optimize=-O3
    
      161ac_add_options OPT_LEVEL="3"
    
      162ac_add_options RUSTC_OPT_LEVEL="3"
    
      163
    
      164# Features
    
      165ac_add_options --enable-alsa
    
      166ac_add_options --enable-pulseaudio
    
      167ac_add_options --enable-jxl
    
      168ac_add_options --disable-real-time-tracing
    
      169ac_add_options --disable-webdriver
    
      170ac_add_options --disable-accessibility
    
      171ac_add_options --disable-legacy-profile-creation
    
      172ac_add_options --disable-negotiateauth
    
      173ac_add_options --disable-synth-speechd
    
      174ac_add_options --disable-necko-wifi
    
      175ac_add_options --disable-jack
    
      176ac_add_options --disable-parental-controls
    
      177ac_add_options --disable-crashreporter
    
      178ac_add_options --disable-updater
    
      179ac_add_options --disable-tests
    
      180ac_add_options --disable-rust-tests
    
      181ac_add_options --disable-debug
    
      182ac_add_options --disable-debug-js-modules
    
      183ac_add_options --disable-debug-symbols
    
      184ac_add_options --enable-strip
    
      185ac_add_options --enable-install-strip
    
      186
    
      187# Fuck telemetry
    
      188mk_add_options MOZ_CRASHREPORTER=0
    
      189mk_add_options MOZ_DATA_REPORTING=0
    
      190mk_add_options MOZ_SERVICES_HEALTHREPORT=0
    
      191mk_add_options MOZ_NORMANDY=0
    
      192mk_add_options MOZ_TELEMETRY_REPORTING=0
    
      193END
    
      194}
    
      195
    
      196build() {
    
      197  local VIRTWL VIRTWL_PID
    
      198
    
      199  cd "firefox-$pkgver"
    
      200
    
      201  export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=pip
    
      202  export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
    
      203  export MOZ_BUILD_DATE="$(date -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH} +%Y%m%d%H%M%S)"
    
      204  export MOZ_NOSPAM=1
    
      205  export DISABLE_TELEMETRY=1
    
      206
    
      207  # malloc_usable_size is used in various parts of the codebase
    
      208  CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
    
      209  CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
    
      210
    
      211  # Breaks compilation since https://bugzilla.mozilla.org/show_bug.cgi?id=1896066
    
      212  CFLAGS="${CFLAGS/-fexceptions/}"
    
      213  CXXFLAGS="${CXXFLAGS/-fexceptions/}"
    
      214
    
      215  # LTO needs more open files
    
      216  ulimit -n 4096
    
      217
    
      218  echo "Building browser..."
    
      219  cat >.mozconfig ../mozconfig
    
      220
    
      221  # Export XDG_RUNTIME_DIR for cage
    
      222  XDG_RUNTIME_DIR="/tmp/$(id -u)-runtime-dir"
    
      223  mkdir -pm 0700 "$XDG_RUNTIME_DIR"
    
      224  export XDG_RUNTIME_DIR
    
      225
    
      226  # Run cage compositor for PGO profiling
    
      227  coproc VIRTWL {
    
      228    WLR_RENDERER=pixman WLR_BACKENDS=headless \
    
      229      exec dbus-run-session -- cage -- sh -c 'echo $WAYLAND_DISPLAY; read _; kill $PPID'
    
      230  }
    
      231  local -x WAYLAND_DISPLAY
    
      232  read WAYLAND_DISPLAY <&${VIRTWL[0]}
    
      233
    
      234  ./mach build
    
      235
    
      236  exec {VIRTWL[0]}<&- {VIRTWL[1]}>&-
    
      237  rm -rf "${XDG_RUNTIME_DIR}"
    
      238}
    
      239
    
      240package() {
    
      241  cd firefox-$pkgver
    
      242  DESTDIR="$pkgdir" ./mach install
    
      243
    
      244  local distini="$pkgdir/usr/lib/firefox/distribution/distribution.ini"
    
      245  install -Dvm644 /dev/stdin "$distini" <<END
    
      246[Global]
    
      247id=archlinux
    
      248version=1.0
    
      249about=Mozilla Firefox for Arch Linux
    
      250
    
      251[Preferences]
    
      252app.distributor=archlinux
    
      253app.distributor.channel=firefox
    
      254app.partner.archlinux=archlinux
    
      255END
    
      256
    
      257  local i theme=official
    
      258  for i in 16 22 24 32 48 64 128 256; do
    
      259    install -Dvm644 browser/branding/$theme/default$i.png \
    
      260      "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/firefox.png"
    
      261  done
    
      262  install -Dvm644 browser/branding/$theme/content/about-logo.png \
    
      263    "$pkgdir/usr/share/icons/hicolor/192x192/apps/firefox.png"
    
      264  install -Dvm644 browser/branding/$theme/content/about-logo@2x.png \
    
      265    "$pkgdir/usr/share/icons/hicolor/384x384/apps/firefox.png"
    
      266  install -Dvm644 browser/branding/$theme/content/about-logo.svg \
    
      267    "$pkgdir/usr/share/icons/hicolor/scalable/apps/firefox.svg"
    
      268
    
      269  install -Dvm644 ../firefox-symbolic.svg -t "$pkgdir/usr/share/icons/hicolor/symbolic/apps"
    
      270  install -Dvm644 ../firefox.desktop -t "$pkgdir/usr/share/applications"
    
      271  install -Dvm644 ../org.mozilla.firefox.metainfo.xml -t "$pkgdir/usr/share/metainfo"
    
      272
    
      273  # Install a wrapper to avoid confusion about binary path
    
      274  install -Dvm755 /dev/stdin "$pkgdir/usr/bin/firefox" <<END
    
      275#!/bin/sh
    
      276exec /usr/lib/firefox/firefox "\$@"
    
      277END
    
      278
    
      279  # Replace duplicate binary with wrapper
    
      280  # https://bugzilla.mozilla.org/show_bug.cgi?id=658850
    
      281  ln -srfv "$pkgdir/usr/bin/firefox" "$pkgdir/usr/lib/firefox/firefox-bin"
    
      282}
    
      283
    
      284# vim:set sw=2 sts=-1 et:
    
      285

Changes since previous scan

--- PKGBUILD @ 2026-10-22 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,7 +5,7 @@
 # Contributor: Jakub Schmidtke <sjakub@gmail.com>
 
 pkgname=firefox-pure
-pkgver=156.0
+pkgver=157.0
 pkgrel=1
 pkgdesc="Fast, Private & Safe Web Browser"
 url="https://www.firefox.com"
@@ -81,15 +81,15 @@
   "firefox.desktop"
   "org.mozilla.firefox.metainfo.xml"
   "0001-Install-under-remoting-name.patch"
-  "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-156-patches-01.tar.xz"
+  "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-${pkgver%%.*}-patches-01.tar.xz"
 )
 sha256sums=(
-  '1f2768c043510009abaa3f078123664e106d3ab9dfce75d1819ad96b2145aab9'
+  '259c564dd4bbd56bbe8a9a6cf001fc8812853567fd3a78e77c9ddf10d7d4e982'
   'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
   '71fe797430198ac8c00b538dce537284cf526e48be0496698cf5a980d70c16da'
   '4e01a62e20026b67466943bad9dfba47874c5e1492375f8293aeb85ecedf2288'
   'a7364ddb3b6eab922873f35731ed5cfb61e8022a35d54edd2f80b95a4f5625ed'
-  '97bb045e0ab033c71ab7c524e517e479a37ad81cf418b961944ed494479d6d06'
+  'e615f4512a4faf9b8cd96ff5484875176a3c636083966659f65260cc64737060'
 )
 
 prepare() {
@@ -103,6 +103,7 @@
   for patch in "${srcdir}/firefox-patches"/*.patch; do
     echo "Applying patch $patch..."
     [[ "$patch" == */0015-bgo-940031-wasm-support-firefox-155.patch ]] && continue
+    [[ "$patch" == */0027-bgo-981812-bindgen-libcxx-fix.patch ]] && continue
     patch -Np1 -i "${patch}"
   done
 
@@ -128,7 +129,7 @@
 ac_add_options --enable-release
 ac_add_options --enable-hardening
 ac_add_options --enable-rust-simd
-ac_add_options --enable-wasm-simd
+ac_add_options --enable-jit-simd
 ac_add_options --enable-lto=cross,full
 ac_add_options --enable-linker=lld
 ac_add_options --enable-jemalloc
@@ -167,13 +168,10 @@
 ac_add_options --disable-real-time-tracing
 ac_add_options --disable-webdriver
 ac_add_options --disable-accessibility
-ac_add_options --disable-wmf
 ac_add_options --disable-legacy-profile-creation
 ac_add_options --disable-negotiateauth
 ac_add_options --disable-synth-speechd
 ac_add_options --disable-necko-wifi
-ac_add_options --disable-webspeech
-ac_add_options --disable-webspeechtestbackend
 ac_add_options --disable-jack
 ac_add_options --disable-parental-controls
 ac_add_options --disable-crashreporter

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 21:36:17	Medium	1
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2