libpdfium-nojs
LOW
maintainer selmf
24 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from official project repositories (pdfium.googlesource.com, chromium.googlesource.com), which are legitimate sources for Pdfium and its dependencies; the external downloads via curl are for a publicly available, non-executable Python script used in the build process and do not introduce remote code execution or supply-chain risks, as the script is part of the standard Chromium build tooling and is used transparently to generate headers.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official project repositories (pdfium.googlesource.com, chromium.googlesource.com), which are legitimate sources for Pdfium and its dependencies; the external downloads via curl are for a publicly available, non-executable Python script used in the build process and do not introduce remote code execution or supply-chain risks, as the script is part of the standard Chromium build tooling and is used transparently to generate headers.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:53
chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/stable/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)" -
PKGBUILD:88
curl https://chromium.googlesource.com/chromium/src/+/main/tools/generate_shim_headers/generate_shim_headers.py?format=TEXT \
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
source=("git+https://pdfium.googlesource.com/pdfium" -
PKGBUILD:16
"git+https://chromium.googlesource.com/chromium/src/build.git"
PKGBUILD
4 offending line(s) highlighted
1
# Maintainer: Felix Kauselmann <licorn@gmail.com>
2
3
pkgname=libpdfium-nojs
4
pkgver=7871.r1.c052afb72a
5
pkgrel=1
6
pkgdesc="Open-source PDF rendering engine."
7
arch=('x86_64')
8
url="https://pdfium.googlesource.com/pdfium/"
9
license=('BSD')
10
depends=('freetype2' 'lcms2' 'libjpeg-turbo' 'openjpeg2' 'icu' 'harfbuzz')
11
conflicts=('libpdfium-bin')
12
provides=('libpdfium')
13
makedepends=('git' 'python' 'gn' 'ninja' 'fast_float')
14
15
source=("git+https://pdfium.googlesource.com/pdfium"
16
"git+https://chromium.googlesource.com/chromium/src/build.git"
17
"git+https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp"
18
"git+https://chromium.googlesource.com/chromium/src/third_party/simdutf"
19
"libpdfium.pc"
20
)
21
22
md5sums=('SKIP'
23
'SKIP'
24
'SKIP'
25
'SKIP'
26
'feb270967925a0844b1b9a9e15288eb3')
27
28
pkgver() {
29
30
cd $srcdir/pdfium
31
32
# Version = branch name/number + number of commits since branch creation
33
# + short head
34
printf "%s.r%s.%s" $(git rev-parse --abbrev-ref HEAD | cut -d '/' -f2)\
35
$(git rev-list --count main..) $(git rev-parse --short HEAD)
36
37
}
38
39
prepare() {
40
41
cd "$srcdir/pdfium"
42
43
ln -sf $srcdir/build build
44
ln -sf $srcdir/abseil-cpp third_party/abseil-cpp
45
ln -sf $srcdir/simdutf third_party/simdutf
46
47
# Pdfium is developed alongside Chromium and does not provide releases
48
# Upstream recommends using Chromium's dev channels instead
49
50
# Extract pdfium branch name used in stable channel from chrome version history and do
51
# a checkout
52
53
chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/stable/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
54
# chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/beta/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
55
# chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/dev/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
56
57
git checkout "chromium/$chrome_version"
58
59
# Extract build repo revision needed from DEPS file and do a checkout
60
cd "$srcdir/pdfium/build"
61
# Use a newer build revision to work around a build system bug in v6367
62
if [[ $chrome_version -gt 7049 ]]
63
then
64
git checkout $(awk '/build_revision/ {print substr($2,2,40)}' $srcdir/pdfium/DEPS) -q
65
else
66
git checkout 3dd73ffc3708962da298795d99f35fc06ed0defc -q
67
fi
68
69
# Extract abseil-cpp repo revision needed from DEPS file and do a checkout
70
cd "$srcdir/pdfium/third_party/abseil-cpp"
71
git checkout $(awk '/abseil_revision/ {print substr($2,2,40)}' $srcdir/pdfium/DEPS) -q
72
73
# Patch abseil build to be static
74
sed -i 's/component(/static_library(/' BUILD.gn
75
sed -i 's/is_component_build(/false/' BUILD.gn
76
77
# Use system fast_float
78
mkdir -p third_party/fast_float/src/include/
79
ln -sf /usr/include/fast_float third_party/fast_float/src/include/
80
81
# Use system provided icu library (unbundling)
82
mkdir -p "$srcdir/pdfium/third_party/icu"
83
ln -sf "$srcdir/build/linux/unbundle/icu.gn" "$srcdir/pdfium/third_party/icu/BUILD.gn"
84
85
# Download and decode shim header script needed to unbundle icu (gittiles is weird)
86
mkdir -p "$srcdir/pdfium/tools/generate_shim_headers/"
87
echo "Downloading generate_shim_headers script from Chromium."
88
curl https://chromium.googlesource.com/chromium/src/+/main/tools/generate_shim_headers/generate_shim_headers.py?format=TEXT \
89
| base64 --decode > "$srcdir/pdfium/tools/generate_shim_headers/generate_shim_headers.py"
90
echo "Done."
91
92
# Create fake gclient_args.gni file to satisfy include list for build/config/compiler/compiler.gni
93
touch "$srcdir/build/config/gclient_args.gni"
94
echo "build_with_chromium = false" > "$srcdir/build/config/gclient_args.gni"
95
96
# Exclude test fonts from build
97
cd "$srcdir/pdfium/testing/"
98
sed -i '/"\/\/third_party\/test_fonts",/s/^/#/g' BUILD.gn
99
100
}
101
102
build() {
103
104
cd "$srcdir/pdfium"
105
106
local _flags=(
107
'is_clang=false'
108
'use_sysroot=false'
109
'is_debug=false'
110
'symbol_level=0'
111
'pdf_enable_v8=false'
112
'pdf_enable_xfa=false'
113
'treat_warnings_as_errors=false'
114
'use_system_libjpeg=true'
115
'use_system_zlib=true'
116
'pdf_bundle_freetype=false'
117
'use_system_freetype=true'
118
'use_system_lcms2=true'
119
'use_system_libpng=true'
120
'use_custom_libcxx=false'
121
'pdf_is_standalone = true'
122
'use_system_libopenjpeg2 = true'
123
'is_component_build = true'
124
'pdf_use_partition_alloc = false'
125
'use_system_harfbuzz = true'
126
)
127
128
gn gen out/Release --args="${_flags[*]}"
129
ninja -C out/Release pdfium
130
131
# Set pdfium version in pc file
132
sed "s/@VERSION@/${pkgver}/g" -i "${srcdir}/libpdfium.pc"
133
134
}
135
136
package() {
137
138
cd "$srcdir/pdfium"
139
140
install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
141
install -D public/*.h --target-directory="${pkgdir}/usr/include/pdfium"
142
install -D public/cpp/* --target-directory="${pkgdir}/usr/include/pdfium/cpp"
143
install -D docs/* --target-directory="${pkgdir}/usr/share/doc/pdfium"
144
install -Dm755 out/Release/libpdfium.so --target-directory="${pkgdir}/usr/lib"
145
install -Dm644 ${srcdir}/libpdfium.pc --target-directory=${pkgdir}/usr/lib/pkgconfig
146
147
}
148
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |
| 2026-08-29 00:29:17 | Low | 3 |