libpdfium-nojs

LOW

maintainer selmf 24 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package builds from official Chromium and PDFium source repositories, with downloads from googlesource.com which, while not on a standard whitelist, are legitimate project hosts; the curl calls fetch only build scripts or version data, not executable binaries, and all sources are version-controlled and checksummed where possible, posing minimal risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official Chromium and PDFium source repositories, with downloads from googlesource.com which, while not on a standard whitelist, are legitimate project hosts; the curl calls fetch only build scripts or version data, not executable binaries, and all sources are version-controlled and checksummed where possible, posing minimal risk.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:57 chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/stable/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
PKGBUILD:92 curl https://chromium.googlesource.com/chromium/src/+/main/tools/generate_shim_headers/generate_shim_headers.py?format=TEXT \

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("git+https://pdfium.googlesource.com/pdfium"
PKGBUILD:16 "git+https://chromium.googlesource.com/chromium/src/build.git"

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Felix Kauselmann <licorn@gmail.com>
    
      2
    
      3pkgname=libpdfium-nojs
    
      4pkgver=8059.r3.39f0ed4a65
    
      5pkgrel=1
    
      6pkgdesc="Open-source PDF rendering engine."
    
      7arch=('x86_64')
    
      8url="https://pdfium.googlesource.com/pdfium/"
    
      9license=('BSD')
    
      10depends=('freetype2' 'lcms2' 'libjpeg-turbo' 'openjpeg2' 'icu' 'harfbuzz')
    
      11conflicts=('libpdfium-bin')
    
      12provides=('libpdfium')
    
      13makedepends=('git' 'python' 'gn' 'ninja' 'fast_float')
    
      14
    
      15source=("git+https://pdfium.googlesource.com/pdfium"
    
      16    "git+https://chromium.googlesource.com/chromium/src/build.git"
    
      17    "git+https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp"
    
      18    "git+https://chromium.googlesource.com/chromium/src/third_party/simdutf"
    
      19    "git+https://chromium.googlesource.com/external/github.com/jk-jeon/dragonbox.git#branch=upstream/master"
    
      20    "libpdfium.pc"
    
      21    )
    
      22
    
      23md5sums=('SKIP'
    
      24         'SKIP'
    
      25         'SKIP'
    
      26	 'SKIP'
    
      27	 'SKIP'
    
      28         'feb270967925a0844b1b9a9e15288eb3')
    
      29
    
      30pkgver() {
    
      31
    
      32  cd $srcdir/pdfium
    
      33  
    
      34  # Version = branch name/number + number of commits since branch creation
    
      35  # + short head
    
      36  printf  "%s.r%s.%s" $(git rev-parse --abbrev-ref HEAD | cut -d '/' -f2)\
    
      37   $(git rev-list --count main..) $(git rev-parse --short HEAD)
    
      38
    
      39}
    
      40
    
      41prepare() {
    
      42
    
      43  cd "$srcdir/pdfium"
    
      44
    
      45  ln -sf $srcdir/build build
    
      46  ln -sf $srcdir/abseil-cpp third_party/abseil-cpp
    
      47  ln -sf $srcdir/simdutf third_party/simdutf
    
      48  ln -sf $srcdir/dragonbox third_party/dragonbox/src
    
      49
    
      50  
    
      51  # Pdfium is developed alongside Chromium and does not provide releases
    
      52  # Upstream recommends using Chromium's dev channels instead
    
      53
    
      54  # Extract pdfium branch name used in stable channel from chrome version history and do
    
      55  # a checkout
    
      56  
    
      57   chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/stable/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
    
      58  # chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/beta/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
    
      59  # chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/dev/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
    
      60
    
      61  git checkout "chromium/$chrome_version"
    
      62
    
      63  # Extract build repo revision needed from DEPS file and do a checkout
    
      64  cd "$srcdir/pdfium/build"
    
      65  # Use a newer build revision to work around a build system bug in v6367
    
      66  if [[ $chrome_version -gt 7049 ]]
    
      67  then
    
      68    git checkout $(awk '/build_revision/ {print substr($2,2,40)}' $srcdir/pdfium/DEPS) -q
    
      69  else
    
      70    git checkout 3dd73ffc3708962da298795d99f35fc06ed0defc -q
    
      71  fi
    
      72  
    
      73  # Extract abseil-cpp repo revision needed from DEPS file and do a checkout
    
      74  cd "$srcdir/pdfium/third_party/abseil-cpp"
    
      75  git checkout $(awk '/abseil_revision/ {print substr($2,2,40)}' $srcdir/pdfium/DEPS) -q
    
      76
    
      77  # Patch abseil build to be static
    
      78  sed -i 's/component(/static_library(/' BUILD.gn
    
      79  sed -i 's/is_component_build(/false/' BUILD.gn
    
      80
    
      81  # Use system fast_float
    
      82  mkdir -p "$srcdir/pdfium/third_party/fast_float/src/include/"
    
      83  ln -sfn /usr/include/fast_float "$srcdir/pdfium/third_party/fast_float/src/include/fast_float"
    
      84
    
      85  # Use system provided icu library (unbundling)
    
      86  mkdir -p "$srcdir/pdfium/third_party/icu"
    
      87  ln -sf "$srcdir/build/linux/unbundle/icu.gn" "$srcdir/pdfium/third_party/icu/BUILD.gn"
    
      88
    
      89  # Download and decode shim header script needed to unbundle icu (gittiles is weird)
    
      90  mkdir -p "$srcdir/pdfium/tools/generate_shim_headers/"
    
      91  echo "Downloading generate_shim_headers script from Chromium."
    
      92  curl https://chromium.googlesource.com/chromium/src/+/main/tools/generate_shim_headers/generate_shim_headers.py?format=TEXT \
    
      93    | base64 --decode > "$srcdir/pdfium/tools/generate_shim_headers/generate_shim_headers.py"
    
      94  echo "Done."
    
      95  
    
      96  # Create fake gclient_args.gni file to satisfy include list for build/config/compiler/compiler.gni
    
      97  touch "$srcdir/build/config/gclient_args.gni"
    
      98  echo "build_with_chromium = false" > "$srcdir/build/config/gclient_args.gni"
    
      99  
    
      100  # Exclude test fonts from build
    
      101  cd "$srcdir/pdfium/testing/"
    
      102  sed -i '/"\/\/third_party\/test_fonts",/s/^/#/g' BUILD.gn
    
      103  
    
      104} 
    
      105
    
      106build() {
    
      107  cd "$srcdir/pdfium"
    
      108
    
      109  local _flags=(
    
      110      'is_clang=false'
    
      111      'use_sysroot=false'
    
      112      'is_debug=false'
    
      113      'symbol_level=0'
    
      114      'pdf_enable_v8=false'
    
      115      'pdf_enable_xfa=false'
    
      116      'treat_warnings_as_errors=false'
    
      117      'use_system_libjpeg=true'
    
      118      'use_system_zlib=true'
    
      119      'pdf_bundle_freetype=false'
    
      120      'use_system_freetype=true'
    
      121      'use_system_lcms2=true'
    
      122      'use_system_libpng=true'
    
      123      'use_custom_libcxx=false'
    
      124      'pdf_is_standalone = true'
    
      125      'use_system_libopenjpeg2 = true'
    
      126      'is_component_build = true'
    
      127      'pdf_use_partition_alloc = false'
    
      128      'use_system_harfbuzz = true'
    
      129  )
    
      130  
    
      131  gn gen out/Release --args="${_flags[*]}" --script-executable=python3
    
      132  ninja -C out/Release pdfium
    
      133
    
      134  # Set pdfium version in pc file
    
      135  sed "s/@VERSION@/${pkgver}/g" -i "${srcdir}/libpdfium.pc"
    
      136
    
      137}
    
      138
    
      139package() {
    
      140
    
      141  cd "$srcdir/pdfium"
    
      142
    
      143  install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      144  install -D public/*.h --target-directory="${pkgdir}/usr/include/pdfium"
    
      145  install -D public/cpp/* --target-directory="${pkgdir}/usr/include/pdfium/cpp"
    
      146  install -D docs/* --target-directory="${pkgdir}/usr/share/doc/pdfium"
    
      147  install -Dm755 out/Release/libpdfium.so --target-directory="${pkgdir}/usr/lib"
    
      148  install -Dm644 ${srcdir}/libpdfium.pc --target-directory=${pkgdir}/usr/lib/pkgconfig
    
      149
    
      150}
    
      151

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	3
2026-10-31 00:07:41	Low	3
2026-10-30 00:29:30	Low	3
2026-10-29 00:13:55	Low	3
2026-10-28 00:06:54	Low	3
2026-10-27 00:23:28	Low	3
2026-10-26 00:12:40	Low	3
2026-10-25 00:20:48	Low	3
2026-10-24 00:14:55	Low	3
2026-10-23 00:02:19	Low	3
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 00:23:45	Low	3