libpdfium-nojs

maintainer selmf · 24 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from official project repositories (pdfium.googlesource.com, chromium.googlesource.com), which are legitimate sources for Pdfium and its dependencies; the external downloads via curl are for a publicly available, non-executable Python script used in the build process and do not introduce remote code execution or supply-chain risks, as the script is part of the standard Chromium build tooling and is used transparently to generate headers.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official project repositories (pdfium.googlesource.com, chromium.googlesource.com), which are legitimate sources for Pdfium and its dependencies; the external downloads via curl are for a publicly available, non-executable Python script used in the build process and do not introduce remote code execution or supply-chain risks, as the script is part of the standard Chromium build tooling and is used transparently to generate headers.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:53 chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/stable/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
PKGBUILD:88 curl https://chromium.googlesource.com/chromium/src/+/main/tools/generate_shim_headers/generate_shim_headers.py?format=TEXT \

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("git+https://pdfium.googlesource.com/pdfium"
PKGBUILD:16 "git+https://chromium.googlesource.com/chromium/src/build.git"

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Felix Kauselmann <licorn@gmail.com>
    
      2
    
      3pkgname=libpdfium-nojs
    
      4pkgver=7871.r1.c052afb72a
    
      5pkgrel=1
    
      6pkgdesc="Open-source PDF rendering engine."
    
      7arch=('x86_64')
    
      8url="https://pdfium.googlesource.com/pdfium/"
    
      9license=('BSD')
    
      10depends=('freetype2' 'lcms2' 'libjpeg-turbo' 'openjpeg2' 'icu' 'harfbuzz')
    
      11conflicts=('libpdfium-bin')
    
      12provides=('libpdfium')
    
      13makedepends=('git' 'python' 'gn' 'ninja' 'fast_float')
    
      14
    
      15source=("git+https://pdfium.googlesource.com/pdfium"
    
      16    "git+https://chromium.googlesource.com/chromium/src/build.git"
    
      17    "git+https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp"
    
      18    "git+https://chromium.googlesource.com/chromium/src/third_party/simdutf"
    
      19    "libpdfium.pc"
    
      20    )
    
      21
    
      22md5sums=('SKIP'
    
      23         'SKIP'
    
      24         'SKIP'
    
      25	 'SKIP'
    
      26         'feb270967925a0844b1b9a9e15288eb3')
    
      27
    
      28pkgver() {
    
      29
    
      30  cd $srcdir/pdfium
    
      31  
    
      32  # Version = branch name/number + number of commits since branch creation
    
      33  # + short head
    
      34  printf  "%s.r%s.%s" $(git rev-parse --abbrev-ref HEAD | cut -d '/' -f2)\
    
      35   $(git rev-list --count main..) $(git rev-parse --short HEAD)
    
      36
    
      37}
    
      38
    
      39prepare() {
    
      40
    
      41  cd "$srcdir/pdfium"
    
      42
    
      43  ln -sf $srcdir/build build
    
      44  ln -sf $srcdir/abseil-cpp third_party/abseil-cpp
    
      45  ln -sf $srcdir/simdutf third_party/simdutf
    
      46  
    
      47  # Pdfium is developed alongside Chromium and does not provide releases
    
      48  # Upstream recommends using Chromium's dev channels instead
    
      49
    
      50  # Extract pdfium branch name used in stable channel from chrome version history and do
    
      51  # a checkout
    
      52  
    
      53   chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/stable/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
    
      54  # chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/beta/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
    
      55  # chrome_version="$(curl https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/dev/versions/all/releases | grep 'version' | head -1 | cut -d'.' -f 3)"
    
      56
    
      57  git checkout "chromium/$chrome_version"
    
      58
    
      59  # Extract build repo revision needed from DEPS file and do a checkout
    
      60  cd "$srcdir/pdfium/build"
    
      61  # Use a newer build revision to work around a build system bug in v6367
    
      62  if [[ $chrome_version -gt 7049 ]]
    
      63  then
    
      64    git checkout $(awk '/build_revision/ {print substr($2,2,40)}' $srcdir/pdfium/DEPS) -q
    
      65  else
    
      66    git checkout 3dd73ffc3708962da298795d99f35fc06ed0defc -q
    
      67  fi
    
      68  
    
      69  # Extract abseil-cpp repo revision needed from DEPS file and do a checkout
    
      70  cd "$srcdir/pdfium/third_party/abseil-cpp"
    
      71  git checkout $(awk '/abseil_revision/ {print substr($2,2,40)}' $srcdir/pdfium/DEPS) -q
    
      72
    
      73  # Patch abseil build to be static
    
      74  sed -i 's/component(/static_library(/' BUILD.gn
    
      75  sed -i 's/is_component_build(/false/' BUILD.gn
    
      76
    
      77# Use system fast_float 
    
      78  mkdir -p third_party/fast_float/src/include/
    
      79  ln -sf /usr/include/fast_float third_party/fast_float/src/include/
    
      80
    
      81  # Use system provided icu library (unbundling)
    
      82  mkdir -p "$srcdir/pdfium/third_party/icu"
    
      83  ln -sf "$srcdir/build/linux/unbundle/icu.gn" "$srcdir/pdfium/third_party/icu/BUILD.gn"
    
      84
    
      85  # Download and decode shim header script needed to unbundle icu (gittiles is weird)
    
      86  mkdir -p "$srcdir/pdfium/tools/generate_shim_headers/"
    
      87  echo "Downloading generate_shim_headers script from Chromium."
    
      88  curl https://chromium.googlesource.com/chromium/src/+/main/tools/generate_shim_headers/generate_shim_headers.py?format=TEXT \
    
      89    | base64 --decode > "$srcdir/pdfium/tools/generate_shim_headers/generate_shim_headers.py"
    
      90  echo "Done."
    
      91  
    
      92  # Create fake gclient_args.gni file to satisfy include list for build/config/compiler/compiler.gni
    
      93  touch "$srcdir/build/config/gclient_args.gni"
    
      94  echo "build_with_chromium = false" > "$srcdir/build/config/gclient_args.gni"
    
      95  
    
      96  # Exclude test fonts from build
    
      97  cd "$srcdir/pdfium/testing/"
    
      98  sed -i '/"\/\/third_party\/test_fonts",/s/^/#/g' BUILD.gn
    
      99  
    
      100} 
    
      101
    
      102build() {
    
      103
    
      104  cd "$srcdir/pdfium"
    
      105
    
      106  local _flags=(
    
      107      'is_clang=false'
    
      108      'use_sysroot=false'
    
      109      'is_debug=false'
    
      110      'symbol_level=0'
    
      111      'pdf_enable_v8=false'
    
      112      'pdf_enable_xfa=false'
    
      113      'treat_warnings_as_errors=false'
    
      114      'use_system_libjpeg=true'
    
      115      'use_system_zlib=true'
    
      116      'pdf_bundle_freetype=false'
    
      117      'use_system_freetype=true'
    
      118      'use_system_lcms2=true'
    
      119      'use_system_libpng=true'
    
      120      'use_custom_libcxx=false'
    
      121      'pdf_is_standalone = true'
    
      122      'use_system_libopenjpeg2 = true'
    
      123      'is_component_build = true'
    
      124      'pdf_use_partition_alloc = false'
    
      125      'use_system_harfbuzz = true'
    
      126  )
    
      127  
    
      128  gn gen out/Release --args="${_flags[*]}"
    
      129  ninja -C out/Release pdfium
    
      130
    
      131  # Set pdfium version in pc file
    
      132  sed "s/@VERSION@/${pkgver}/g" -i "${srcdir}/libpdfium.pc"
    
      133
    
      134}
    
      135
    
      136package() {
    
      137
    
      138  cd "$srcdir/pdfium"
    
      139
    
      140  install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      141  install -D public/*.h --target-directory="${pkgdir}/usr/include/pdfium"
    
      142  install -D public/cpp/* --target-directory="${pkgdir}/usr/include/pdfium/cpp"
    
      143  install -D docs/* --target-directory="${pkgdir}/usr/share/doc/pdfium"
    
      144  install -Dm755 out/Release/libpdfium.so --target-directory="${pkgdir}/usr/lib"
    
      145  install -Dm644 ${srcdir}/libpdfium.pc --target-directory=${pkgdir}/usr/lib/pkgconfig
    
      146
    
      147}
    
      148

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3