librewolf-allow-dark
LOW
maintainer Mecso
7 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The source is a tarball from librewolf.dev, a project-associated domain, used to build the browser from source; this is normal AUR packaging behavior despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from librewolf.dev, a project-associated domain, used to build the browser from source; this is normal AUR packaging behavior despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:100
https://librewolf.dev/api/packages/librewolf/generic/librewolf-source/$_pkgver/librewolf-$_pkgver.source.tar.gz{,.sig}
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: mecso2
2
3
pkgname=librewolf-allow-dark
4
_pkgname=librewolf
5
provides=(librewolf)
6
conflicts=(librewolf)
7
# The pkgver should always ends with a trailing ".0" for "round" release, so "155.0_1" should instead be "155.0.0_1" for instance
8
# Otherwise, we will face version comparison issues: "warning: librewolf: local (154.0_2-1) is newer than extra-testing (154.0.1_2-1)"
9
# We therefore "re-compute" the pkgver to match the actual upstream version scheme in the custom _pkgver variable, see README.md for more details
10
pkgver=157.0.1_1
11
# Extract the first part of the pkgver, this represents the Firefox release this LibreWolf release is based on
12
_firefoxver="${pkgver%_*}"
13
# Remove any trailing ".0" to match the real Firefox version, as "round" Firefox releases actually doesn't contain it,
14
# (despite what https://www.firefox.com/en-US/releases/ is showing)
15
# For "155.0.0" this will result in "155.0", for "155.0.1" it won't change anything
16
_realfirefoxver="${_firefoxver%.0}"
17
# Extract the second part of the pkgver, this represents the Librewolf release
18
_librewolfver="${pkgver#*_}"
19
# Combine the "re-computed" pkgver (which actually matches the upstream version scheme) into a custom _pkgver variable
20
_pkgver="${_realfirefoxver}-${_librewolfver}"
21
pkgrel=1
22
pkgdesc="Librewolf with the privacy.override_rfp_for_color_scheme about:config option added, which (if enabled) let's you change the color scheme even if rfp is turned on"
23
url="https://librewolf.net/"
24
arch=(x86_64 aarch64)
25
license=(MPL-2.0)
26
27
depends=(
28
alsa-lib
29
at-spi2-core
30
bash
31
cairo
32
dbus
33
ffmpeg
34
fontconfig
35
freetype2
36
gdk-pixbuf2
37
glib2
38
glibc
39
gtk3
40
hicolor-icon-theme
41
libgcc
42
libpulse
43
libstdc++
44
libx11
45
libxcb
46
libxcomposite
47
libxdamage
48
libxext
49
libxfixes
50
libxrandr
51
libxss
52
libxt
53
mime-types
54
nspr
55
nss
56
pango
57
ttf-font
58
)
59
makedepends=(
60
cbindgen
61
clang
62
diffutils
63
git
64
imake
65
jack
66
jq
67
lld
68
llvm
69
mesa
70
nasm
71
nodejs
72
onnxruntime
73
python
74
rust
75
unzip
76
wasi-compiler-rt
77
wasi-libc
78
wasi-libc++
79
wasi-libc++abi
80
xorg-server-xvfb
81
yasm
82
zip
83
)
84
optdepends=(
85
'hunspell-dictionary: Spell checking'
86
'libnotify: Notification integration'
87
'networkmanager: Location detection via available WiFi networks'
88
'speech-dispatcher: Text-to-Speech'
89
'xdg-desktop-portal: Screensharing with Wayland'
90
)
91
92
options=(
93
!debug
94
!emptydirs
95
!lto
96
!makeflags
97
)
98
99
source=(
100
https://librewolf.dev/api/packages/librewolf/generic/librewolf-source/$_pkgver/librewolf-$_pkgver.source.tar.gz{,.sig}
101
$_pkgname.desktop
102
allow_dark.patch
103
)
104
105
sha256sums=('4b363d2c85eda694c671bda98fc1f0a0ad9cfa030c975ae4fd0e1092a3f59eb2'
106
'SKIP'
107
'3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae'
108
'5745d2548227c498f7619b3503fcae06d00b7829b783143639f2688bba6a4aee')
109
110
validpgpkeys=('662E3CDD6FE329002D0CA5BB40339DD82B12EF16') # https://rpm.librewolf.net/pubkey.gpg
111
112
113
prepare() {
114
mkdir -p mozbuild
115
cd librewolf-$_pkgver
116
117
local src
118
for src in "${source[@]}"; do
119
src="${src%%::*}"
120
src="${src##*/}"
121
src="${src%.zst}"
122
[[ $src = *.patch ]] || continue
123
echo "Applying patch $src..."
124
patch -Np1 < "../$src"
125
done
126
127
mv mozconfig ../mozconfig
128
129
cat >>../mozconfig <<END
130
mk_add_options MOZ_OBJDIR=${PWD@Q}/obj
131
132
ac_add_options --prefix=/usr
133
ac_add_options --enable-release
134
ac_add_options --enable-hardening
135
ac_add_options --enable-optimize
136
ac_add_options --enable-rust-simd
137
ac_add_options --enable-linker=lld
138
ac_add_options --disable-install-strip
139
ac_add_options --disable-bootstrap
140
ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
141
142
# Branding
143
ac_add_options --with-app-name=${_pkgname}
144
export MOZ_APP_REMOTINGNAME=${_pkgname}
145
146
# Language packs
147
ac_add_options --with-l10n-base=$PWD/lw/l10n
148
149
# System libraries
150
ac_add_options --with-system-nspr
151
ac_add_options --with-system-nss
152
153
# Features
154
# keep alsa option in here until merged upstream
155
ac_add_options --enable-alsa
156
ac_add_options --enable-jack
157
ac_add_options --enable-pulseaudio
158
ac_add_options --disable-updater
159
END
160
161
# reduce chance of builds failung during linking due to running out of memory
162
export LDFLAGS+=" -Wl,--no-keep-memory"
163
164
# upstream Arch fixes
165
166
}
167
168
pkgver() {
169
# Ensure the pkgver is properly formatted to avoid eventual version comparison issues
170
# See README.md for more details
171
echo "$pkgver" | sed -E 's/^([0-9]+\.[0-9]+)_/\1.0_/'
172
}
173
174
build() {
175
cd librewolf-$_pkgver
176
177
export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=pip
178
export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
179
export MOZ_BUILD_DATE="$(date -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH} +%Y%m%d%H%M%S)"
180
export MOZ_NOSPAM=1
181
182
# malloc_usable_size is used in various parts of the codebase
183
CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
184
CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
185
186
# Breaks compilation since https://bugzilla.mozilla.org/show_bug.cgi?id=1896066
187
CFLAGS="${CFLAGS/-fexceptions/}"
188
CXXFLAGS="${CXXFLAGS/-fexceptions/}"
189
190
# LTO needs more open files
191
ulimit -n 4096
192
193
# temporarily disable ublock-origin, interferes with profiling
194
cp "lw/policies.json" "$srcdir/policies.json"
195
jq 'del(.policies.Extensions.Install)' "$srcdir/policies.json" > "lw/policies.json"
196
197
# Do 3-tier PGO
198
echo "Building instrumented browser..."
199
cat >.mozconfig ../mozconfig - <<END
200
ac_add_options --enable-profile-generate=cross
201
END
202
./mach build --priority normal
203
204
echo "Profiling instrumented browser..."
205
./mach package
206
LLVM_PROFDATA=llvm-profdata JARLOG_FILE="$PWD/jarlog" \
207
dbus-run-session \
208
xvfb-run -s "-screen 0 1920x1080x24 -nolisten local" \
209
./mach python build/pgo/profileserver.py
210
211
stat -c "Profile data found (%s bytes)" merged.profdata
212
test -s merged.profdata
213
214
stat -c "Jar log found (%s bytes)" jarlog
215
test -s jarlog
216
217
echo "Removing instrumented browser..."
218
./mach clobber objdir
219
220
# reenable ublock-origin
221
cp "$srcdir/policies.json" "lw/policies.json"
222
223
echo "Building optimized browser..."
224
cat >.mozconfig ../mozconfig - <<END
225
ac_add_options --enable-lto=cross
226
ac_add_options --enable-profile-use=cross
227
ac_add_options --with-pgo-profile-path=${PWD@Q}/merged.profdata
228
ac_add_options --with-pgo-jarlog=${PWD@Q}/jarlog
229
END
230
./mach build --priority normal
231
232
# Re-package built sources including language packs
233
xargs ./mach package-multi-locale --locales < browser/locales/shipped-locales
234
}
235
236
package() {
237
cd librewolf-$_pkgver
238
239
# The `install` target doesn't install the language packs generated with the `package-multi-locale` target
240
# We are therefore "manually" copying the packaged browser to the relevant directory in `$pkgdir` instead
241
#DESTDIR="$pkgdir" ./mach install
242
local appdir="$pkgdir/usr/lib/$_pkgname"
243
install -dvm755 "$appdir/"
244
cp -a obj/dist/librewolf/. "$appdir/"
245
touch "$appdir/is-packaged-app"
246
247
install -Dvm644 /dev/stdin "$appdir/browser/defaults/preferences/vendor.js" <<END
248
// Use system-provided dictionaries
249
pref("spellchecker.dictionary_path", "/usr/share/hunspell");
250
251
// Don't disable extensions in the application directory
252
// done in librewolf.cfg
253
// pref("extensions.autoDisableScopes", 11);
254
END
255
256
install -Dvm644 /dev/stdin "$appdir/distribution/distribution.ini" <<END
257
[Global]
258
id=io.gitlab.${_pkgname}-community
259
version=1.0
260
about=LibreWolf
261
262
[Preferences]
263
app.distributor="LibreWolf Community"
264
app.distributor.channel=$_pkgname
265
app.partner.librewolf=$_pkgname
266
END
267
268
# Install desktop icons and metadata
269
local i theme=librewolf
270
for i in 16 32 48 64 128 256; do
271
install -Dvm644 browser/branding/$theme/default$i.png \
272
"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$_pkgname.png"
273
done
274
install -Dvm644 browser/branding/$theme/content/about-logo.png \
275
"$pkgdir/usr/share/icons/hicolor/192x192/apps/$_pkgname.png"
276
install -Dvm644 browser/branding/$theme/content/about-logo@2x.png \
277
"$pkgdir/usr/share/icons/hicolor/384x384/apps/$_pkgname.png"
278
279
# Librewolf is missing an svg logo
280
install -Dvm644 browser/branding/${theme}/default16.png \
281
"$pkgdir/usr/share/icons/hicolor/symbolic/apps/$_pkgname-symbolic.png"
282
283
# Install desktop file
284
install -Dvm644 ../$_pkgname.desktop "$pkgdir/usr/share/applications/$_pkgname.desktop"
285
286
# Install a wrapper to avoid confusion about binary path
287
install -Dvm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" <<END
288
#!/bin/sh
289
exec /usr/lib/$_pkgname/librewolf "\$@"
290
END
291
292
# Replace duplicate binary with wrapper
293
# https://bugzilla.mozilla.org/show_bug.cgi?id=658850
294
ln -srfv "$pkgdir/usr/bin/$_pkgname" "$appdir/librewolf-bin"
295
296
# Use system certificates
297
if [[ -e $appdir/libnss3.so ]]; then
298
ln -sfv ../libnssckbi.so -t "$appdir"
299
fi
300
}
301
302
# vim: ts=2 sw=2 et:
303
Changes since previous scan
--- PKGBUILD @ 2026-10-09 00:05+++ PKGBUILD @ 2026-10-17 00:21@@ -7,7 +7,7 @@ # The pkgver should always ends with a trailing ".0" for "round" release, so "155.0_1" should instead be "155.0.0_1" for instance # Otherwise, we will face version comparison issues: "warning: librewolf: local (154.0_2-1) is newer than extra-testing (154.0.1_2-1)" # We therefore "re-compute" the pkgver to match the actual upstream version scheme in the custom _pkgver variable, see README.md for more details-pkgver=154.0.1_2+pkgver=157.0.1_1 # Extract the first part of the pkgver, this represents the Firefox release this LibreWolf release is based on _firefoxver="${pkgver%_*}" # Remove any trailing ".0" to match the real Firefox version, as "round" Firefox releases actually doesn't contain it,@@ -102,10 +102,10 @@ allow_dark.patch ) -sha256sums=('87f8f3eb9766cf25a1f3e8231a7304d3977a90d21fe269702074b9d5acc8df29'+sha256sums=('4b363d2c85eda694c671bda98fc1f0a0ad9cfa030c975ae4fd0e1092a3f59eb2' 'SKIP' '3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae'- '16841807098201ea8577ed391f24282a761bd265cfd3f959da920f241a11e8fe')+ '5745d2548227c498f7619b3503fcae06d00b7829b783143639f2688bba6a4aee') validpgpkeys=('662E3CDD6FE329002D0CA5BB40339DD82B12EF16') # https://rpm.librewolf.net/pubkey.gpg Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 18:12:17 | Medium | 1 |
| 2026-10-09 16:11:33 | Medium | 1 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |