karere-custom-css

LOW

maintainer rutilante 0 votes scanned 2026-09-16 09:21:46.704965

View on AUR

Why flagged

The package builds from a known fork of Karere and includes prebuilt CEF binaries from a GitHub release; while the source has few votes and is recent, it does not execute untrusted remote code or exfiltrate data, and the CEF download, though from a non-upstream source, is checksummed and used as a standard dependency.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a known fork of Karere and includes prebuilt CEF binaries from a GitHub release; while the source has few votes and is recent, it does not execute untrusted remote code or exfiltrate data, and the CEF download, though from a non-upstream source, is checksummed and used as a standard dependency.

PKGBUILD

      1#!/usr/bin/bash
    
      2
    
      3# Maintainer: Riccardo Marotti
    
      4
    
      5# Downstream package tracking upstream Karere with the optional custom.css
    
      6# live-reload support from PR #183:
    
      7# https://github.com/tobagin/karere/pull/183
    
      8#
    
      9# The feature was declined upstream because it falls outside Karere's intended
    
      10# scope and would add maintenance burden as WhatsApp Web's CSS changes.
    
      11
    
      12pkgname=karere-custom-css
    
      13pkgver=4.2.5
    
      14pkgrel=1
    
      15pkgdesc="Karere with optional custom.css live reload"
    
      16arch=('x86_64')
    
      17url="https://github.com/riccardomarotti/karere"
    
      18license=('GPL-3.0-or-later')
    
      19options=('!lto')
    
      20provides=("karere=$pkgver")
    
      21conflicts=('karere' 'karere-git' 'karere-custom-css-git')
    
      22
    
      23_cef_ver="150.0.10"
    
      24_cef_chromium="150.0.7871.101"
    
      25_cef_hash="g8042e43"
    
      26_cef_dir="cef_binary_${_cef_ver}+${_cef_hash}+chromium-${_cef_chromium}_linux64_minimal"
    
      27_commit="6bf8b2b3bc0ba95b2461f2f88cfefedb906b6191"
    
      28
    
      29# libcef.so runtime libraries (readelf -d)
    
      30depends=(
    
      31    'gtk4'
    
      32    'libadwaita'
    
      33    'glib2'
    
      34    'gdk-pixbuf2'
    
      35    'libepoxy'
    
      36    'hicolor-icon-theme'
    
      37
    
      38    'alsa-lib'
    
      39    'at-spi2-core'
    
      40    'cairo'
    
      41    'dbus'
    
      42    'dconf'
    
      43    'expat'
    
      44    'fontconfig'
    
      45    'graphene'
    
      46    'harfbuzz'
    
      47    'lcms2'
    
      48    'libcups'
    
      49    'libdrm'
    
      50    'libjpeg-turbo'
    
      51    'libx11'
    
      52    'libxcb'
    
      53    'libxcomposite'
    
      54    'libxdamage'
    
      55    'libxext'
    
      56    'libxfixes'
    
      57    'libxkbcommon'
    
      58    'libxrandr'
    
      59    'mesa'
    
      60    'nspr'
    
      61    'nss'
    
      62    'openjpeg2'
    
      63    'pango'
    
      64    'systemd-libs'
    
      65    'wayland'
    
      66)
    
      67
    
      68makedepends=(
    
      69    'git'
    
      70    'meson'
    
      71    'ninja'
    
      72    'cmake'
    
      73    'rust'
    
      74    'gettext'
    
      75    'patchelf'
    
      76    'desktop-file-utils'
    
      77    'appstream-glib'
    
      78    'appstream'
    
      79    'blueprint-compiler'
    
      80    'python-gobject'
    
      81)
    
      82
    
      83optdepends=(
    
      84    'hunspell: spell checking support'
    
      85    'libappindicator-gtk3: system tray support'
    
      86)
    
      87
    
      88source=(
    
      89    "karere::git+https://github.com/riccardomarotti/karere.git#commit=${_commit}"
    
      90    "cef-${_cef_ver}.zip::https://github.com/tobagin/karere/releases/download/cef-${_cef_ver}-proprietary-codecs/cef_binary_${_cef_ver}%2B${_cef_hash}%2Bchromium-${_cef_chromium}_linux64_minimal.zip"
    
      91)
    
      92
    
      93sha256sums=(
    
      94    'SKIP'
    
      95    '3bbe298368c4d87c19ad9b7ed4e8449ea91b32ffa3cefc8672791a1b96c9c3b9'
    
      96)
    
      97
    
      98prepare() {
    
      99    cd "$srcdir/karere"
    
      100
    
      101    # cef-rs expects CEF_PATH to point to a flattened/exported CEF tree.
    
      102    rm -rf "$srcdir/cef-flat"
    
      103    mkdir -p "$srcdir/cef-flat"
    
      104
    
      105    cp -a \
    
      106        "$srcdir/$_cef_dir/include" \
    
      107        "$srcdir/$_cef_dir/libcef_dll" \
    
      108        "$srcdir/$_cef_dir/cmake" \
    
      109        "$srcdir/$_cef_dir/CMakeLists.txt" \
    
      110        "$srcdir/cef-flat/"
    
      111
    
      112    cp -a \
    
      113        "$srcdir/$_cef_dir/Release/." \
    
      114        "$srcdir/cef-flat/"
    
      115
    
      116    cp -a \
    
      117        "$srcdir/$_cef_dir/Resources/." \
    
      118        "$srcdir/cef-flat/"
    
      119
    
      120    # Metadata expected by cef-dll-sys when using a supplied CEF_PATH.
    
      121    cat > "$srcdir/cef-flat/archive.json" <<EOF
    
      122{"type":"minimal","name":"cef_binary_${_cef_ver}+${_cef_hash}+chromium-${_cef_chromium}_linux64_minimal.tar.bz2","sha1":"0000000000000000000000000000000000000000"}
    
      123EOF
    
      124
    
      125    # build.rs adds an absolute CEF path to RUNPATH when CEF_PATH is set.
    
      126    # Keep the package relocatable and retain only the $ORIGIN entry.
    
      127    sed -i \
    
      128        '/println!("cargo:rustc-link-arg=-Wl,-rpath,{}", p\.display());/d' \
    
      129        build.rs
    
      130}
    
      131
    
      132build() {
    
      133    cd "$srcdir/karere"
    
      134
    
      135    export CEF_PATH="$srcdir/cef-flat"
    
      136    export RUSTFLAGS="--remap-path-prefix=$srcdir=/build"
    
      137
    
      138    meson setup build \
    
      139        --prefix=/usr \
    
      140        --bindir=lib/karere/cef \
    
      141        --buildtype=release \
    
      142        -Dprofile=default
    
      143
    
      144    meson compile -C build
    
      145}
    
      146
    
      147package() {
    
      148    cd "$srcdir/karere"
    
      149
    
      150    export RUSTFLAGS="--remap-path-prefix=$srcdir=/build"
    
      151    meson install -C build --destdir="$pkgdir"
    
      152
    
      153    # CEF requires its libraries/resources beside the real executable.
    
      154    install -d "$pkgdir/usr/lib/karere/cef"
    
      155
    
      156    cp -a \
    
      157        "$srcdir/$_cef_dir/Release/." \
    
      158        "$pkgdir/usr/lib/karere/cef/"
    
      159
    
      160    cp -a \
    
      161        "$srcdir/$_cef_dir/Resources/." \
    
      162        "$pkgdir/usr/lib/karere/cef/"
    
      163
    
      164    # Upstream expects all translations under share/karere/locale.
    
      165    if [[ -d "$pkgdir/usr/share/locale" ]]; then
    
      166        install -d "$pkgdir/usr/share/karere"
    
      167        mv \
    
      168            "$pkgdir/usr/share/locale" \
    
      169            "$pkgdir/usr/share/karere/locale"
    
      170    fi
    
      171
    
      172    # Keep the actual executable beside CEF. Set cwd to /usr/share/karere
    
      173    # because native Karere resolves ./locale.
    
      174    install -d "$pkgdir/usr/bin"
    
      175
    
      176    cat > "$pkgdir/usr/bin/karere" <<'EOF'
    
      177#!/bin/sh
    
      178cd /usr/share/karere || exit 1
    
      179exec /usr/lib/karere/cef/karere "$@"
    
      180EOF
    
      181
    
      182    chmod 0755 "$pkgdir/usr/bin/karere"
    
      183
    
      184    desktop-file-validate \
    
      185        "$pkgdir/usr/share/applications/"*.desktop
    
      186
    
      187    appstream-util validate-relax --nonet \
    
      188        "$pkgdir/usr/share/metainfo/"*.xml
    
      189}
    
      190

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 09:21:46	Low	2