firefox-pure

maintainer ventureo · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source URL is from a non-standard host (dev.gentoo.org), but it hosts patches for building Firefox, a legitimate use; the main source is from Mozilla's official archive, and the patches are checksummed, reducing supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URL is from a non-standard host (dev.gentoo.org), but it hosts patches for building Firefox, a legitimate use; the main source is from Mozilla's official archive, and the patches are checksummed, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:83 "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-153-patches-01.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vasiliy Stelmachenok <ventureo@yandex.ru>
    
      2## Arch Linux's maintainers:
    
      3# Maintainer: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
    
      4# Contributor: Ionut Biru <ibiru@archlinux.org>
    
      5# Contributor: Jakub Schmidtke <sjakub@gmail.com>
    
      6
    
      7pkgname=firefox-pure
    
      8pkgver=153.0
    
      9pkgrel=1
    
      10pkgdesc="Fast, Private & Safe Web Browser"
    
      11url="https://www.firefox.com"
    
      12arch=(x86_64)
    
      13license=(MPL-2.0)
    
      14depends=(
    
      15  alsa-lib
    
      16  at-spi2-core
    
      17  bash
    
      18  cairo
    
      19  dbus
    
      20  ffmpeg
    
      21  fontconfig
    
      22  freetype2
    
      23  gdk-pixbuf2
    
      24  glib2
    
      25  glibc
    
      26  gtk3
    
      27  hicolor-icon-theme
    
      28  icu
    
      29  libgcc
    
      30  libjpeg-turbo
    
      31  libpulse
    
      32  libstdc++
    
      33  libvpx
    
      34  libwebp
    
      35  mime-types
    
      36  nspr
    
      37  nss
    
      38  pango
    
      39  ttf-font
    
      40  zlib
    
      41)
    
      42makedepends=(
    
      43  cage
    
      44  cbindgen
    
      45  clang
    
      46  diffutils
    
      47  imake
    
      48  lld
    
      49  llvm
    
      50  mesa
    
      51  nasm
    
      52  nodejs
    
      53  python
    
      54  rust
    
      55  unzip
    
      56  wasi-compiler-rt
    
      57  wasi-libc
    
      58  wasi-libc++
    
      59  wasi-libc++abi
    
      60  xorg-xwayland
    
      61  yasm
    
      62  zip
    
      63)
    
      64optdepends=(
    
      65  'hunspell-en_US: Spell checking, American English'
    
      66  'libnotify: Notification integration'
    
      67  'xdg-desktop-portal: Screensharing with Wayland'
    
      68)
    
      69options=(
    
      70  !emptydirs
    
      71  !lto
    
      72  !makeflags
    
      73  !ccache
    
      74)
    
      75provides=("firefox" "firefox=${pkgver}")
    
      76conflicts=(firefox)
    
      77source=(
    
      78  "https://archive.mozilla.org/pub/firefox/releases/$pkgver/source/firefox-$pkgver.source.tar.xz"
    
      79  "firefox-symbolic.svg"
    
      80  "firefox.desktop"
    
      81  "org.mozilla.firefox.metainfo.xml"
    
      82  "0001-Install-under-remoting-name.patch"
    
      83  "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-153-patches-01.tar.xz"
    
      84)
    
      85sha256sums=(
    
      86  'bc510f74c8c4c692d31e559aeb5850849d13bc98214ac81e004f66f819a55522'
    
      87  'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
    
      88  '71fe797430198ac8c00b538dce537284cf526e48be0496698cf5a980d70c16da'
    
      89  '4e01a62e20026b67466943bad9dfba47874c5e1492375f8293aeb85ecedf2288'
    
      90  'a7364ddb3b6eab922873f35731ed5cfb61e8022a35d54edd2f80b95a4f5625ed'
    
      91  '9dc3e9423eea9b8bf16cd7cc2545a539717e9b32c1e4242a332988ff0add923e'
    
      92)
    
      93
    
      94prepare() {
    
      95  mkdir mozbuild
    
      96  cd "firefox-$pkgver"
    
      97
    
      98  # Make different channels installable in parallel
    
      99  patch -Np1 -i "${srcdir}"/0001-Install-under-remoting-name.patch
    
      100
    
      101  # Gentoo patches
    
      102  for patch in "${srcdir}/firefox-patches"/*.patch; do
    
      103    echo "Applying patch $patch..."
    
      104    [[ "$patch" == */0015-bgo-940031-wasm-support.patch ]] && continue
    
      105    patch -Np1 -i "${patch}"
    
      106  done
    
      107
    
      108  # Unset variables to prevent issues with PGO profiling
    
      109  unset \
    
      110    DBUS_SESSION_BUS_ADDRESS \
    
      111    DISPLAY \
    
      112    ORBIT_SOCKETDIR \
    
      113    SESSION_MANAGER \
    
      114    XAUTHORITY \
    
      115    XDG_CACHE_HOME \
    
      116    XDG_SESSION_COOKIE
    
      117
    
      118  export LLVM_PROFDATA="llvm-profdata"
    
      119
    
      120  cat >../mozconfig <<END
    
      121ac_add_options --enable-project=browser
    
      122ac_add_options --disable-artifact-builds
    
      123ac_add_options MOZ_PGO=1
    
      124mk_add_options MOZ_OBJDIR=${PWD@Q}/obj
    
      125
    
      126ac_add_options --prefix=/usr
    
      127ac_add_options --enable-release
    
      128ac_add_options --enable-hardening
    
      129ac_add_options --enable-rust-simd
    
      130ac_add_options --enable-wasm-simd
    
      131ac_add_options --enable-lto=cross,full
    
      132ac_add_options --enable-linker=lld
    
      133ac_add_options --enable-jemalloc
    
      134ac_add_options --enable-replace-malloc
    
      135ac_add_options --disable-cargo-incremental
    
      136ac_add_options --disable-elf-hack
    
      137ac_add_options --disable-bootstrap
    
      138ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
    
      139ac_add_options --enable-default-toolkit=cairo-gtk3-wayland-only
    
      140
    
      141# Branding
    
      142ac_add_options --enable-official-branding
    
      143ac_add_options --enable-update-channel=release
    
      144ac_add_options --with-distribution-id=org.archlinux
    
      145ac_add_options --with-unsigned-addon-scopes=app,system
    
      146ac_add_options --allow-addon-sideload
    
      147export MOZ_APP_REMOTINGNAME=firefox
    
      148
    
      149# System libraries
    
      150ac_add_options --with-system-nspr
    
      151ac_add_options --with-system-nss
    
      152ac_add_options --with-system-libvpx
    
      153ac_add_options --with-system-webp
    
      154ac_add_options --with-system-jpeg
    
      155ac_add_options --with-system-zlib
    
      156
    
      157# Optimization
    
      158ac_add_options --enable-optimize=-O3
    
      159ac_add_options OPT_LEVEL="3"
    
      160ac_add_options RUSTC_OPT_LEVEL="3"
    
      161
    
      162# Features
    
      163ac_add_options --enable-alsa
    
      164ac_add_options --enable-pulseaudio
    
      165ac_add_options --enable-jxl
    
      166ac_add_options --disable-real-time-tracing
    
      167ac_add_options --disable-webdriver
    
      168ac_add_options --disable-accessibility
    
      169ac_add_options --disable-wmf
    
      170ac_add_options --disable-legacy-profile-creation
    
      171ac_add_options --disable-negotiateauth
    
      172ac_add_options --disable-synth-speechd
    
      173ac_add_options --disable-necko-wifi
    
      174ac_add_options --disable-webspeech
    
      175ac_add_options --disable-webspeechtestbackend
    
      176ac_add_options --disable-jack
    
      177ac_add_options --disable-parental-controls
    
      178ac_add_options --disable-crashreporter
    
      179ac_add_options --disable-updater
    
      180ac_add_options --disable-tests
    
      181ac_add_options --disable-rust-tests
    
      182ac_add_options --disable-debug
    
      183ac_add_options --disable-debug-js-modules
    
      184ac_add_options --disable-debug-symbols
    
      185ac_add_options --enable-strip
    
      186ac_add_options --enable-install-strip
    
      187
    
      188# Fuck telemetry
    
      189mk_add_options MOZ_CRASHREPORTER=0
    
      190mk_add_options MOZ_DATA_REPORTING=0
    
      191mk_add_options MOZ_SERVICES_HEALTHREPORT=0
    
      192mk_add_options MOZ_NORMANDY=0
    
      193mk_add_options MOZ_TELEMETRY_REPORTING=0
    
      194END
    
      195}
    
      196
    
      197build() {
    
      198  local VIRTWL VIRTWL_PID
    
      199
    
      200  cd "firefox-$pkgver"
    
      201
    
      202  export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=pip
    
      203  export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
    
      204  export MOZ_BUILD_DATE="$(date -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH} +%Y%m%d%H%M%S)"
    
      205  export MOZ_NOSPAM=1
    
      206  export DISABLE_TELEMETRY=1
    
      207
    
      208  # malloc_usable_size is used in various parts of the codebase
    
      209  CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
    
      210  CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
    
      211
    
      212  # Breaks compilation since https://bugzilla.mozilla.org/show_bug.cgi?id=1896066
    
      213  CFLAGS="${CFLAGS/-fexceptions/}"
    
      214  CXXFLAGS="${CXXFLAGS/-fexceptions/}"
    
      215
    
      216  # LTO needs more open files
    
      217  ulimit -n 4096
    
      218
    
      219  echo "Building browser..."
    
      220  cat >.mozconfig ../mozconfig
    
      221
    
      222  # Export XDG_RUNTIME_DIR for cage
    
      223  XDG_RUNTIME_DIR="/tmp/$(id -u)-runtime-dir"
    
      224  mkdir -pm 0700 "$XDG_RUNTIME_DIR"
    
      225  export XDG_RUNTIME_DIR
    
      226
    
      227  # Run cage compositor for PGO profiling
    
      228  coproc VIRTWL {
    
      229    WLR_RENDERER=pixman WLR_BACKENDS=headless \
    
      230      exec dbus-run-session -- cage -- sh -c 'echo $WAYLAND_DISPLAY; read _; kill $PPID'
    
      231  }
    
      232  local -x WAYLAND_DISPLAY
    
      233  read WAYLAND_DISPLAY <&${VIRTWL[0]}
    
      234
    
      235  ./mach build
    
      236
    
      237  exec {VIRTWL[0]}<&- {VIRTWL[1]}>&-
    
      238  rm -rf "${XDG_RUNTIME_DIR}"
    
      239}
    
      240
    
      241package() {
    
      242  cd firefox-$pkgver
    
      243  DESTDIR="$pkgdir" ./mach install
    
      244
    
      245  local distini="$pkgdir/usr/lib/firefox/distribution/distribution.ini"
    
      246  install -Dvm644 /dev/stdin "$distini" <<END
    
      247[Global]
    
      248id=archlinux
    
      249version=1.0
    
      250about=Mozilla Firefox for Arch Linux
    
      251
    
      252[Preferences]
    
      253app.distributor=archlinux
    
      254app.distributor.channel=firefox
    
      255app.partner.archlinux=archlinux
    
      256END
    
      257
    
      258  local i theme=official
    
      259  for i in 16 22 24 32 48 64 128 256; do
    
      260    install -Dvm644 browser/branding/$theme/default$i.png \
    
      261      "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/firefox.png"
    
      262  done
    
      263  install -Dvm644 browser/branding/$theme/content/about-logo.png \
    
      264    "$pkgdir/usr/share/icons/hicolor/192x192/apps/firefox.png"
    
      265  install -Dvm644 browser/branding/$theme/content/about-logo@2x.png \
    
      266    "$pkgdir/usr/share/icons/hicolor/384x384/apps/firefox.png"
    
      267  install -Dvm644 browser/branding/$theme/content/about-logo.svg \
    
      268    "$pkgdir/usr/share/icons/hicolor/scalable/apps/firefox.svg"
    
      269
    
      270  install -Dvm644 ../firefox-symbolic.svg -t "$pkgdir/usr/share/icons/hicolor/symbolic/apps"
    
      271  install -Dvm644 ../firefox.desktop -t "$pkgdir/usr/share/applications"
    
      272  install -Dvm644 ../org.mozilla.firefox.metainfo.xml -t "$pkgdir/usr/share/metainfo"
    
      273
    
      274  # Install a wrapper to avoid confusion about binary path
    
      275  install -Dvm755 /dev/stdin "$pkgdir/usr/bin/firefox" <<END
    
      276#!/bin/sh
    
      277exec /usr/lib/firefox/firefox "\$@"
    
      278END
    
      279
    
      280  # Replace duplicate binary with wrapper
    
      281  # https://bugzilla.mozilla.org/show_bug.cgi?id=658850
    
      282  ln -srfv "$pkgdir/usr/bin/firefox" "$pkgdir/usr/lib/firefox/firefox-bin"
    
      283}
    
      284
    
      285# vim:set sw=2 sts=-1 et:
    
      286

Changes since previous scan

--- PKGBUILD @ 2026-07-23 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,10 +5,10 @@
 # Contributor: Jakub Schmidtke <sjakub@gmail.com>
 
 pkgname=firefox-pure
-pkgver=152.0.6
+pkgver=153.0
 pkgrel=1
 pkgdesc="Fast, Private & Safe Web Browser"
-url="https://www.mozilla.org/firefox/"
+url="https://www.firefox.com"
 arch=(x86_64)
 license=(MPL-2.0)
 depends=(
@@ -40,6 +40,7 @@
   zlib
 )
 makedepends=(
+  cage
   cbindgen
   clang
   diffutils
@@ -51,13 +52,12 @@
   nodejs
   python
   rust
-  cage
-  xorg-xwayland
   unzip
   wasi-compiler-rt
   wasi-libc
   wasi-libc++
   wasi-libc++abi
+  xorg-xwayland
   yasm
   zip
 )
@@ -80,15 +80,15 @@
   "firefox.desktop"
   "org.mozilla.firefox.metainfo.xml"
   "0001-Install-under-remoting-name.patch"
-  "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-152-patches-03.tar.xz"
+  "https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-153-patches-01.tar.xz"
 )
 sha256sums=(
-  'ea220c4f8d19d4edaa20e6dadfd3c4aeb07dbed017ade2828fd814d660660f0e'
-  'a9b8b4a0a1f4a7b4af77d5fc70c2686d624038909263c795ecc81e0aec7711e9'
+  'bc510f74c8c4c692d31e559aeb5850849d13bc98214ac81e004f66f819a55522'
+  'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
   '71fe797430198ac8c00b538dce537284cf526e48be0496698cf5a980d70c16da'
-  '23f557fa7989adcae03cc9458d94716981dbcf0e9d6d52a289a2426e50b4b785'
+  '4e01a62e20026b67466943bad9dfba47874c5e1492375f8293aeb85ecedf2288'
   'a7364ddb3b6eab922873f35731ed5cfb61e8022a35d54edd2f80b95a4f5625ed'
-  'dea4da8519403f9538f8c5095adb7c1a098397bbe4efefb8277e36b44d35f148'
+  '9dc3e9423eea9b8bf16cd7cc2545a539717e9b32c1e4242a332988ff0add923e'
 )
 
 prepare() {
@@ -224,7 +224,7 @@
   mkdir -pm 0700 "$XDG_RUNTIME_DIR"
   export XDG_RUNTIME_DIR
 
-  # Run tinywl compositor for PGO profiling
+  # Run cage compositor for PGO profiling
   coproc VIRTWL {
     WLR_RENDERER=pixman WLR_BACKENDS=headless \
       exec dbus-run-session -- cage -- sh -c 'echo $WAYLAND_DISPLAY; read _; kill $PPID'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 19:25:44	MEDIUM	1
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3