firefox-pure

LOW
maintainer ventureo 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package builds Firefox from official Mozilla source code and applies patches from a Gentoo developer's domain; the non-whitelisted host hosts only patch files, not executables, and the build process is transparent and standard for AUR.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds Firefox from official Mozilla source code and applies patches from a Gentoo developer's domain; the non-whitelisted host hosts only patch files, not executables, and the build process is transparent and standard for AUR.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:84 "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-156-patches-01.tar.xz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Vasiliy Stelmachenok <ventureo@yandex.ru>
2## Arch Linux's maintainers:
3# Maintainer: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
4# Contributor: Ionut Biru <ibiru@archlinux.org>
5# Contributor: Jakub Schmidtke <sjakub@gmail.com>
6
7pkgname=firefox-pure
8pkgver=156.0
9pkgrel=1
10pkgdesc="Fast, Private & Safe Web Browser"
11url="https://www.firefox.com"
12arch=(x86_64)
13license=(MPL-2.0)
14depends=(
15 alsa-lib
16 at-spi2-core
17 bash
18 cairo
19 dbus
20 ffmpeg
21 fontconfig
22 freetype2
23 gdk-pixbuf2
24 glib2
25 glibc
26 gtk3
27 hicolor-icon-theme
28 icu
29 libgcc
30 libjpeg-turbo
31 libpulse
32 libstdc++
33 libvpx
34 libwebp
35 mime-types
36 nspr
37 nss
38 pango
39 ttf-font
40 zlib
41)
42makedepends=(
43 cbindgen
44 clang
45 diffutils
46 imake
47 lld
48 llvm
49 mesa
50 nasm
51 nodejs
52 python
53 rust
54 unzip
55 wasi-compiler-rt
56 wasi-libc
57 wasi-libc++
58 wasi-libc++abi
59 cage
60 xorg-xwayland
61 yasm
62 zip
63)
64optdepends=(
65 'firefox-i18n: Localizations'
66 'hunspell-dictionary: Spell checking, American English'
67 'libnotify: Notification integration'
68 'xdg-desktop-portal: Screensharing with Wayland'
69)
70options=(
71 !emptydirs
72 !lto
73 !makeflags
74 !ccache
75)
76provides=("firefox" "firefox=${pkgver}")
77conflicts=(firefox)
78source=(
79 "https://archive.mozilla.org/pub/firefox/releases/$pkgver/source/firefox-$pkgver.source.tar.xz"
80 "firefox-symbolic.svg"
81 "firefox.desktop"
82 "org.mozilla.firefox.metainfo.xml"
83 "0001-Install-under-remoting-name.patch"
84 "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-156-patches-01.tar.xz"
85)
86sha256sums=(
87 '1f2768c043510009abaa3f078123664e106d3ab9dfce75d1819ad96b2145aab9'
88 'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
89 '71fe797430198ac8c00b538dce537284cf526e48be0496698cf5a980d70c16da'
90 '4e01a62e20026b67466943bad9dfba47874c5e1492375f8293aeb85ecedf2288'
91 'a7364ddb3b6eab922873f35731ed5cfb61e8022a35d54edd2f80b95a4f5625ed'
92 '97bb045e0ab033c71ab7c524e517e479a37ad81cf418b961944ed494479d6d06'
93)
94
95prepare() {
96 mkdir mozbuild
97 cd "firefox-$pkgver"
98
99 # Make different channels installable in parallel
100 patch -Np1 -i "${srcdir}"/0001-Install-under-remoting-name.patch
101
102 # Gentoo patches
103 for patch in "${srcdir}/firefox-patches"/*.patch; do
104 echo "Applying patch $patch..."
105 [[ "$patch" == */0015-bgo-940031-wasm-support-firefox-155.patch ]] && continue
106 patch -Np1 -i "${patch}"
107 done
108
109 # Unset variables to prevent issues with PGO profiling
110 unset \
111 DBUS_SESSION_BUS_ADDRESS \
112 DISPLAY \
113 ORBIT_SOCKETDIR \
114 SESSION_MANAGER \
115 XAUTHORITY \
116 XDG_CACHE_HOME \
117 XDG_SESSION_COOKIE
118
119 export LLVM_PROFDATA="llvm-profdata"
120
121 cat >../mozconfig <<END
122ac_add_options --enable-project=browser
123ac_add_options --disable-artifact-builds
124ac_add_options MOZ_PGO=1
125mk_add_options MOZ_OBJDIR=${PWD@Q}/obj
126
127ac_add_options --prefix=/usr
128ac_add_options --enable-release
129ac_add_options --enable-hardening
130ac_add_options --enable-rust-simd
131ac_add_options --enable-wasm-simd
132ac_add_options --enable-lto=cross,full
133ac_add_options --enable-linker=lld
134ac_add_options --enable-jemalloc
135ac_add_options --enable-replace-malloc
136ac_add_options --disable-cargo-incremental
137ac_add_options --disable-elf-hack
138ac_add_options --disable-bootstrap
139ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
140ac_add_options --enable-default-toolkit=cairo-gtk3-wayland-only
141
142# Branding
143ac_add_options --enable-official-branding
144ac_add_options --enable-update-channel=release
145ac_add_options --with-distribution-id=org.archlinux
146ac_add_options --with-unsigned-addon-scopes=app,system
147ac_add_options --allow-addon-sideload
148export MOZ_APP_REMOTINGNAME=firefox
149
150# System libraries
151ac_add_options --with-system-nspr
152ac_add_options --with-system-nss
153ac_add_options --with-system-libvpx
154ac_add_options --with-system-webp
155ac_add_options --with-system-jpeg
156ac_add_options --with-system-zlib
157
158# Optimization
159ac_add_options --enable-optimize=-O3
160ac_add_options OPT_LEVEL="3"
161ac_add_options RUSTC_OPT_LEVEL="3"
162
163# Features
164ac_add_options --enable-alsa
165ac_add_options --enable-pulseaudio
166ac_add_options --enable-jxl
167ac_add_options --disable-real-time-tracing
168ac_add_options --disable-webdriver
169ac_add_options --disable-accessibility
170ac_add_options --disable-wmf
171ac_add_options --disable-legacy-profile-creation
172ac_add_options --disable-negotiateauth
173ac_add_options --disable-synth-speechd
174ac_add_options --disable-necko-wifi
175ac_add_options --disable-webspeech
176ac_add_options --disable-webspeechtestbackend
177ac_add_options --disable-jack
178ac_add_options --disable-parental-controls
179ac_add_options --disable-crashreporter
180ac_add_options --disable-updater
181ac_add_options --disable-tests
182ac_add_options --disable-rust-tests
183ac_add_options --disable-debug
184ac_add_options --disable-debug-js-modules
185ac_add_options --disable-debug-symbols
186ac_add_options --enable-strip
187ac_add_options --enable-install-strip
188
189# Fuck telemetry
190mk_add_options MOZ_CRASHREPORTER=0
191mk_add_options MOZ_DATA_REPORTING=0
192mk_add_options MOZ_SERVICES_HEALTHREPORT=0
193mk_add_options MOZ_NORMANDY=0
194mk_add_options MOZ_TELEMETRY_REPORTING=0
195END
196}
197
198build() {
199 local VIRTWL VIRTWL_PID
200
201 cd "firefox-$pkgver"
202
203 export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=pip
204 export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
205 export MOZ_BUILD_DATE="$(date -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH} +%Y%m%d%H%M%S)"
206 export MOZ_NOSPAM=1
207 export DISABLE_TELEMETRY=1
208
209 # malloc_usable_size is used in various parts of the codebase
210 CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
211 CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
212
213 # Breaks compilation since https://bugzilla.mozilla.org/show_bug.cgi?id=1896066
214 CFLAGS="${CFLAGS/-fexceptions/}"
215 CXXFLAGS="${CXXFLAGS/-fexceptions/}"
216
217 # LTO needs more open files
218 ulimit -n 4096
219
220 echo "Building browser..."
221 cat >.mozconfig ../mozconfig
222
223 # Export XDG_RUNTIME_DIR for cage
224 XDG_RUNTIME_DIR="/tmp/$(id -u)-runtime-dir"
225 mkdir -pm 0700 "$XDG_RUNTIME_DIR"
226 export XDG_RUNTIME_DIR
227
228 # Run cage compositor for PGO profiling
229 coproc VIRTWL {
230 WLR_RENDERER=pixman WLR_BACKENDS=headless \
231 exec dbus-run-session -- cage -- sh -c 'echo $WAYLAND_DISPLAY; read _; kill $PPID'
232 }
233 local -x WAYLAND_DISPLAY
234 read WAYLAND_DISPLAY <&${VIRTWL[0]}
235
236 ./mach build
237
238 exec {VIRTWL[0]}<&- {VIRTWL[1]}>&-
239 rm -rf "${XDG_RUNTIME_DIR}"
240}
241
242package() {
243 cd firefox-$pkgver
244 DESTDIR="$pkgdir" ./mach install
245
246 local distini="$pkgdir/usr/lib/firefox/distribution/distribution.ini"
247 install -Dvm644 /dev/stdin "$distini" <<END
248[Global]
249id=archlinux
250version=1.0
251about=Mozilla Firefox for Arch Linux
252
253[Preferences]
254app.distributor=archlinux
255app.distributor.channel=firefox
256app.partner.archlinux=archlinux
257END
258
259 local i theme=official
260 for i in 16 22 24 32 48 64 128 256; do
261 install -Dvm644 browser/branding/$theme/default$i.png \
262 "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/firefox.png"
263 done
264 install -Dvm644 browser/branding/$theme/content/about-logo.png \
265 "$pkgdir/usr/share/icons/hicolor/192x192/apps/firefox.png"
266 install -Dvm644 browser/branding/$theme/content/about-logo@2x.png \
267 "$pkgdir/usr/share/icons/hicolor/384x384/apps/firefox.png"
268 install -Dvm644 browser/branding/$theme/content/about-logo.svg \
269 "$pkgdir/usr/share/icons/hicolor/scalable/apps/firefox.svg"
270
271 install -Dvm644 ../firefox-symbolic.svg -t "$pkgdir/usr/share/icons/hicolor/symbolic/apps"
272 install -Dvm644 ../firefox.desktop -t "$pkgdir/usr/share/applications"
273 install -Dvm644 ../org.mozilla.firefox.metainfo.xml -t "$pkgdir/usr/share/metainfo"
274
275 # Install a wrapper to avoid confusion about binary path
276 install -Dvm755 /dev/stdin "$pkgdir/usr/bin/firefox" <<END
277#!/bin/sh
278exec /usr/lib/firefox/firefox "\$@"
279END
280
281 # Replace duplicate binary with wrapper
282 # https://bugzilla.mozilla.org/show_bug.cgi?id=658850
283 ln -srfv "$pkgdir/usr/bin/firefox" "$pkgdir/usr/lib/firefox/firefox-bin"
284}
285
286# vim:set sw=2 sts=-1 et:
287

Changes since previous scan

--- PKGBUILD @ 2026-09-15 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -5,7 +5,7 @@
# Contributor: Jakub Schmidtke <sjakub@gmail.com>
pkgname=firefox-pure
-pkgver=155.0.1
+pkgver=156.0
pkgrel=1
pkgdesc="Fast, Private & Safe Web Browser"
url="https://www.firefox.com"
@@ -81,15 +81,15 @@
"firefox.desktop"
"org.mozilla.firefox.metainfo.xml"
"0001-Install-under-remoting-name.patch"
- "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-155-patches-05.tar.xz"
+ "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-156-patches-01.tar.xz"
)
sha256sums=(
- '7548acd4788d4d0dce7ef9e14e62f7041df8746d9cfe4c05e923747954370d13'
+ '1f2768c043510009abaa3f078123664e106d3ab9dfce75d1819ad96b2145aab9'
'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
'71fe797430198ac8c00b538dce537284cf526e48be0496698cf5a980d70c16da'
'4e01a62e20026b67466943bad9dfba47874c5e1492375f8293aeb85ecedf2288'
'a7364ddb3b6eab922873f35731ed5cfb61e8022a35d54edd2f80b95a4f5625ed'
- '2900045a70ed374967828f705a18d859a22ee3d5708c8510ddbd6853392cfcb4'
+ '97bb045e0ab033c71ab7c524e517e479a37ad81cf418b961944ed494479d6d06'
)
prepare() {

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 11:19:45 Medium 1
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 17:15:15 Medium 1
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 11:50:42 Medium 1
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion