google-chrome-canary-bin

maintainer jhonforbes_2009 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Chrome binary from Google's official storage bucket, which is not in source=() and has no checksum verification, creating a supply-chain risk if the host were compromised or spoofed.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:51 curl -fsSL -A "Mozilla/5.0" -o chrome-linux64.zip "https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/chrome-linux64.zip"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt Chrome binary from Google's official storage bucket, which is not in source=() and has no checksum verification, creating a supply-chain risk if the host were compromised or spoofed.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jhonforbes_2009 <hermanojhonforbes@hotmail.com>
    
      2pkgname=google-chrome-canary-bin
    
      3pkgver=152.0.7969.0
    
      4pkgrel=1
    
      5pkgdesc="The web browser from Google (Canary channel via Chrome for Testing)"
    
      6arch=('x86_64')
    
      7url="https://googlechromelabs.github.io/chrome-for-testing/"
    
      8license=('custom')
    
      9depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'gdk-pixbuf2' 'glib2' 'gtk3' 'libcups' 'libdrm' 'libx11' 'libxcb' 'libxcursor' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'libxshmfence' 'libxtst' 'mesa' 'nss' 'nspr' 'pango' 'systemd-libs' 'util-linux-libs' 'xdg-utils' 'hicolor-icon-theme' 'ca-certificates' 'wget' 'libcurl-gnutls')
    
      10makedepends=('curl' 'grep')
    
      11optdepends=('pipewire: WebRTC desktop sharing under Wayland'
    
      12            'wayland: for native Wayland support'
    
      13            'vulkan-icd-loader: for Vulkan GPU acceleration'
    
      14            'libglvnd: for OpenGL dispatch'
    
      15            'libpulse: for PulseAudio audio backend'
    
      16            'libsecret: for storing passwords'
    
      17            'krb5: for Kerberos network authentication'
    
      18            'libspeechd: for text-to-speech support'
    
      19            'libva: for hardware video decoding (VA-API)'
    
      20            'onnxruntime: for local AI model execution'
    
      21            'apparmor: for additional process sandboxing'
    
      22            'qt5-base: for using Qt5 file dialogs'
    
      23            'qt6-base: for using Qt6 file dialogs'
    
      24            'kdialog: for file dialogs in KDE'
    
      25            'ttf-liberation: fix fonts for some PDFs'
    
      26            'gnome-keyring: for storing passwords in GNOME keyring'
    
      27            'gnome-control-center: for default browser settings in GNOME')
    
      28options=('!emptydirs' '!strip' '!zipman')
    
      29source=()
    
      30sha256sums=()
    
      31
    
      32pkgver() {
    
      33    # MÉTODO 1: API JSON de Chrome for Testing (con grep)
    
      34    _ver=$(curl -fsSL -A "Mozilla/5.0" "https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions.json" | grep -oP '"Canary": \{[^}]*"version": "\K[^"]+' || true)
    
      35    
    
      36    # MÉTODO 2 (FALLBACK): Si la API JSON falla, leer la API de Chromium Dash
    
      37    if [[ -z "$_ver" ]]; then
    
      38        _ver=$(curl -fsSL -A "Mozilla/5.0" "https://chromiumdash.appspot.com/fetch_releases?channel=Canary&platform=Linux" | grep -oP '"version": "\K[^"]+' | head -1 || true)
    
      39    fi
    
      40    
    
      41    # Si ambas fallan, usar la versión real hardcodeada en el PKGBUILD
    
      42    if [[ -z "$_ver" ]]; then
    
      43        _ver="$pkgver"
    
      44    fi
    
      45    
    
      46    echo "$_ver"
    
      47}
    
      48
    
      49prepare() {
    
      50    cd "$srcdir"
    
      51    curl -fsSL -A "Mozilla/5.0" -o chrome-linux64.zip "https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/chrome-linux64.zip"
    
      52    bsdtar -xf chrome-linux64.zip
    
      53}
    
      54
    
      55package() {
    
      56    mkdir -p "$pkgdir/opt/google/chrome-canary" "$pkgdir/usr/bin" "$pkgdir/usr/share/applications" "$pkgdir/usr/share/icons/hicolor"
    
      57    cp -a "$srcdir/chrome-linux64/." "$pkgdir/opt/google/chrome-canary/"
    
      58    
    
      59    find "$pkgdir/opt/google/chrome-canary/" -name "product_logo_*.png" | while read -r img; do
    
      60        size=$(basename "$img" | grep -oP '\d+')
    
      61        if [[ -n "$size" ]]; then
    
      62            install -Dm644 "$img" "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/google-chrome-canary.png"
    
      63        fi
    
      64    done
    
      65    
    
      66    ln -s /opt/google/chrome-canary/chrome "$pkgdir/usr/bin/google-chrome-canary"
    
      67    
    
      68    cat > "$pkgdir/usr/share/applications/google-chrome-canary.desktop" <<EOF
    
      69[Desktop Entry]
    
      70Version=1.0
    
      71Name=Google Chrome Canary
    
      72Exec=/usr/bin/google-chrome-canary %U
    
      73Terminal=false
    
      74Icon=google-chrome-canary
    
      75Type=Application
    
      76Categories=Network;WebBrowser;
    
      77MimeType=text/html;text/xml;application/xhtml_xml;image/webp;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/ftp;
    
      78Actions=new-window;new-private-window;
    
      79
    
      80[Desktop Action new-window]
    
      81Name=New Window
    
      82Exec=/usr/bin/google-chrome-canary
    
      83
    
      84[Desktop Action new-private-window]
    
      85Name=New Incognito Window
    
      86Exec=/usr/bin/google-chrome-canary --incognito
    
      87EOF
    
      88}
    
      89

Changes since previous scan

--- PKGBUILD @ 2026-07-24 15:27
+++ PKGBUILD @ 2026-08-03 00:08
@@ -7,6 +7,7 @@
 url="https://googlechromelabs.github.io/chrome-for-testing/"
 license=('custom')
 depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'gdk-pixbuf2' 'glib2' 'gtk3' 'libcups' 'libdrm' 'libx11' 'libxcb' 'libxcursor' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'libxshmfence' 'libxtst' 'mesa' 'nss' 'nspr' 'pango' 'systemd-libs' 'util-linux-libs' 'xdg-utils' 'hicolor-icon-theme' 'ca-certificates' 'wget' 'libcurl-gnutls')
+makedepends=('curl' 'grep')
 optdepends=('pipewire: WebRTC desktop sharing under Wayland'
             'wayland: for native Wayland support'
             'vulkan-icd-loader: for Vulkan GPU acceleration'
@@ -24,17 +25,22 @@
             'ttf-liberation: fix fonts for some PDFs'
             'gnome-keyring: for storing passwords in GNOME keyring'
             'gnome-control-center: for default browser settings in GNOME')
-provides=('google-chrome-canary' 'google-chrome')
-conflicts=('google-chrome-canary' 'google-chrome')
 options=('!emptydirs' '!strip' '!zipman')
 source=()
 sha256sums=()
 
 pkgver() {
-    _ver=$(curl -fsSL "https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions.json" | grep -oP '"Canary": \{[^}]*"version": "\K[^"]+' | head -1)
+    # MÉTODO 1: API JSON de Chrome for Testing (con grep)
+    _ver=$(curl -fsSL -A "Mozilla/5.0" "https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions.json" | grep -oP '"Canary": \{[^}]*"version": "\K[^"]+' || true)
     
+    # MÉTODO 2 (FALLBACK): Si la API JSON falla, leer la API de Chromium Dash
     if [[ -z "$_ver" ]]; then
-        _ver=$(curl -fsSL "https://chromiumdash.appspot.com/fetch_releases?channel=Canary&platform=Linux" | grep -oP '"version": "\K[^"]+' | head -1)
+        _ver=$(curl -fsSL -A "Mozilla/5.0" "https://chromiumdash.appspot.com/fetch_releases?channel=Canary&platform=Linux" | grep -oP '"version": "\K[^"]+' | head -1 || true)
+    fi
+    
+    # Si ambas fallan, usar la versión real hardcodeada en el PKGBUILD
+    if [[ -z "$_ver" ]]; then
+        _ver="$pkgver"
     fi
     
     echo "$_ver"
@@ -42,8 +48,7 @@
 
 prepare() {
     cd "$srcdir"
-    _url="https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/chrome-linux64.zip"
-    curl -fsSL -A "Mozilla/5.0" -o chrome-linux64.zip "$_url"
+    curl -fsSL -A "Mozilla/5.0" -o chrome-linux64.zip "https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/chrome-linux64.zip"
     bsdtar -xf chrome-linux64.zip
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 17:28:09	MEDIUM	3
2026-07-24 15:27:57	LOW	2
2026-07-24 13:27:52	LOW	2
2026-07-24 09:27:42	LOW	1
2026-07-24 05:27:22	LOW	1
2026-07-24 03:27:03	LOW	1
2026-07-24 00:02:28	CLEAN	2
2026-07-23 23:26:18	LOW	1