google-chrome-canary-bin
MEDIUM
maintainer jhonforbes_2009
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt Chrome binary from Google's official storage bucket, which is not in source=() and has no checksum verification, creating a supply-chain risk if the host were compromised or spoofed.
Triggered rules
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:51
curl -fsSL -A "Mozilla/5.0" -o chrome-linux64.zip "https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/chrome-linux64.zip"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt Chrome binary from Google's official storage bucket, which is not in source=() and has no checksum verification, creating a supply-chain risk if the host were compromised or spoofed.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: jhonforbes_2009 <hermanojhonforbes@hotmail.com>
2
pkgname=google-chrome-canary-bin
3
pkgver=152.0.7969.0
4
pkgrel=1
5
pkgdesc="The web browser from Google (Canary channel via Chrome for Testing)"
6
arch=('x86_64')
7
url="https://googlechromelabs.github.io/chrome-for-testing/"
8
license=('custom')
9
depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'gdk-pixbuf2' 'glib2' 'gtk3' 'libcups' 'libdrm' 'libx11' 'libxcb' 'libxcursor' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'libxshmfence' 'libxtst' 'mesa' 'nss' 'nspr' 'pango' 'systemd-libs' 'util-linux-libs' 'xdg-utils' 'hicolor-icon-theme' 'ca-certificates' 'wget' 'libcurl-gnutls')
10
makedepends=('curl' 'grep')
11
optdepends=('pipewire: WebRTC desktop sharing under Wayland'
12
'wayland: for native Wayland support'
13
'vulkan-icd-loader: for Vulkan GPU acceleration'
14
'libglvnd: for OpenGL dispatch'
15
'libpulse: for PulseAudio audio backend'
16
'libsecret: for storing passwords'
17
'krb5: for Kerberos network authentication'
18
'libspeechd: for text-to-speech support'
19
'libva: for hardware video decoding (VA-API)'
20
'onnxruntime: for local AI model execution'
21
'apparmor: for additional process sandboxing'
22
'qt5-base: for using Qt5 file dialogs'
23
'qt6-base: for using Qt6 file dialogs'
24
'kdialog: for file dialogs in KDE'
25
'ttf-liberation: fix fonts for some PDFs'
26
'gnome-keyring: for storing passwords in GNOME keyring'
27
'gnome-control-center: for default browser settings in GNOME')
28
options=('!emptydirs' '!strip' '!zipman')
29
source=()
30
sha256sums=()
31
32
pkgver() {
33
# MÉTODO 1: API JSON de Chrome for Testing (con grep)
34
_ver=$(curl -fsSL -A "Mozilla/5.0" "https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions.json" | grep -oP '"Canary": \{[^}]*"version": "\K[^"]+' || true)
35
36
# MÉTODO 2 (FALLBACK): Si la API JSON falla, leer la API de Chromium Dash
37
if [[ -z "$_ver" ]]; then
38
_ver=$(curl -fsSL -A "Mozilla/5.0" "https://chromiumdash.appspot.com/fetch_releases?channel=Canary&platform=Linux" | grep -oP '"version": "\K[^"]+' | head -1 || true)
39
fi
40
41
# Si ambas fallan, usar la versión real hardcodeada en el PKGBUILD
42
if [[ -z "$_ver" ]]; then
43
_ver="$pkgver"
44
fi
45
46
echo "$_ver"
47
}
48
49
prepare() {
50
cd "$srcdir"
51
curl -fsSL -A "Mozilla/5.0" -o chrome-linux64.zip "https://storage.googleapis.com/chrome-for-testing-public/${pkgver}/linux64/chrome-linux64.zip"
52
bsdtar -xf chrome-linux64.zip
53
}
54
55
package() {
56
mkdir -p "$pkgdir/opt/google/chrome-canary" "$pkgdir/usr/bin" "$pkgdir/usr/share/applications" "$pkgdir/usr/share/icons/hicolor"
57
cp -a "$srcdir/chrome-linux64/." "$pkgdir/opt/google/chrome-canary/"
58
59
find "$pkgdir/opt/google/chrome-canary/" -name "product_logo_*.png" | while read -r img; do
60
size=$(basename "$img" | grep -oP '\d+')
61
if [[ -n "$size" ]]; then
62
install -Dm644 "$img" "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/google-chrome-canary.png"
63
fi
64
done
65
66
ln -s /opt/google/chrome-canary/chrome "$pkgdir/usr/bin/google-chrome-canary"
67
68
cat > "$pkgdir/usr/share/applications/google-chrome-canary.desktop" <<EOF
69
[Desktop Entry]
70
Version=1.0
71
Name=Google Chrome Canary
72
Exec=/usr/bin/google-chrome-canary %U
73
Terminal=false
74
Icon=google-chrome-canary
75
Type=Application
76
Categories=Network;WebBrowser;
77
MimeType=text/html;text/xml;application/xhtml_xml;image/webp;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/ftp;
78
Actions=new-window;new-private-window;
79
80
[Desktop Action new-window]
81
Name=New Window
82
Exec=/usr/bin/google-chrome-canary
83
84
[Desktop Action new-private-window]
85
Name=New Incognito Window
86
Exec=/usr/bin/google-chrome-canary --incognito
87
EOF
88
}
89
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |