mullvad-browser
LOW
maintainer noureddinex
19 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source code and checksums from the official Mullvad and Tor Project infrastructure; the non-whitelisted host cdn.mullvad.net is legitimate and used by the project, posing no supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and checksums from the official Mullvad and Tor Project infrastructure; the non-whitelisted host cdn.mullvad.net is legitimate and used by the project, posing no supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:41
git+https://gitlab.torproject.org/tpo/applications/tor-browser-build.git -
PKGBUILD:42
https://cdn.mullvad.net/browser/$pkgver/sha256sums-unsigned-build.txt
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: NourEddineX
2
# Contributor: Ralph Torres <mail at ralphptorr dot es>
3
# Contributor: éclairevoyant
4
# Contributor: tarball <bootctl at gmail dot com>
5
6
# NOTE: fetch keys to allow verification of sigs in sha256sums-unsigned-build.txt:
7
# gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
8
# TODO: enable incremental builds, add addarmor
9
10
pkgname=mullvad-browser
11
pkgver=15.0.16
12
_buildver=build1
13
pkgrel=1
14
pkgdesc='Privacy-focused web browser developed by Mullvad VPN and the Tor Project'
15
arch=(x86_64)
16
url=https://mullvad.net/browser
17
license=(MPL-2.0)
18
19
depends=(
20
alsa-lib at-spi2-core bash cairo dbus ffmpeg fontconfig freetype2 gcc-libs
21
gdk-pixbuf2 glib2 glibc gtk3 hicolor-icon-theme libpulse libx11 libxcb
22
libxcomposite libxdamage libxext libxfixes libxrandr libxss libxt mime-types
23
nspr nss pango ttf-font
24
)
25
makedepends=(
26
git perl-capture-tiny perl-data-dump perl-data-uuid perl-datetime
27
perl-digest-sha1 perl-file-copy-recursive perl-file-slurp perl-io-all
28
perl-json perl-lwp-protocol-https perl-parallel-forkmanager perl-path-tiny
29
perl-sort-versions perl-string-shellquote perl-sys-syscall
30
perl-template-toolkit perl-xml-libxml perl-yaml perl-yaml-libyaml
31
perl-yaml-tiny wget zstd
32
)
33
optdepends=(
34
'hunspell-en_US: Spell checking, american english'
35
'libnotify: Notification integration'
36
'networkmanager: Location detection via available wifi networks'
37
'speech-dispatcher: Text-to-speech'
38
'xdg-desktop-portal: Screensharing with wayland'
39
)
40
source=(
41
git+https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
42
https://cdn.mullvad.net/browser/$pkgver/sha256sums-unsigned-build.txt
43
https://cdn.mullvad.net/browser/$pkgver/sha256sums-unsigned-build.txt.asc
44
$pkgname.desktop
45
)
46
sha256sums=('SKIP'
47
'1465715f3a35a32bb4d4ea0339a16e383b8d34f5b90290caffffcebffc826a7c'
48
'SKIP'
49
'a7f82f8d89b00bc0ea368299e979b900c87710b86b89eafb7122a502e5b47eaf')
50
validpgpkeys=(
51
EF6E286DDA85EA2A4BA7DE684E2C6E8793298290 # Tor Browser Developers (signing key) <torbrowser@torproject.org>
52
CAAE408AEBE2288E96FC5D5E157432CF78A65729 # Older one
53
)
54
55
_builder=tor-browser-build
56
_pkgname=mullvadbrowser
57
_pkgver=mb-$pkgver-$_buildver
58
59
_export_perllib() {
60
export PERLLIB="${srcdir}/sys-ph-includes:${srcdir}/sys-ph-includes/usr/include:${srcdir}/sys-ph-includes/usr/include/sys:${srcdir}/sys-ph-includes/usr/include/asm:${srcdir}/sys-ph-includes/usr/include/bits"
61
}
62
63
prepare() {
64
mkdir -p sys-ph-includes
65
h2ph -d sys-ph-includes /usr/include/{sys/syscall.h,asm/unistd.h,asm/unistd_64.h,bits/syscall.h}
66
67
_export_perllib
68
69
cd "$srcdir"/$_builder
70
git checkout -f tags/$_pkgver
71
make submodule-update
72
73
gpg --no-default-keyring --no-auto-check-trustdb \
74
--keyring /tmp/$_pkgver.gpg --import keyring/* || true
75
}
76
77
build() {
78
_export_perllib
79
cd "$srcdir"/$_builder
80
make $_pkgname-release-linux-$arch
81
}
82
83
check() {
84
cd "$srcdir"/$_builder/$_pkgname/release/unsigned/$pkgver-build1
85
sha256sum --ignore-missing -c "${srcdir}"/sha256sums-unsigned-build.txt
86
}
87
88
package() {
89
install -d "$pkgdir"/usr/lib/$pkgname "$pkgdir"/usr/bin
90
tar -C "$pkgdir"/usr/lib/$pkgname --strip-components=2 \
91
-xf "$srcdir"/$_builder/$_pkgname/release/unsigned/$pkgver-build1/$pkgname-linux-$arch-$pkgver.tar.xz
92
ln -srfv "$pkgdir"/usr/lib/$pkgname/start-$pkgname "$pkgdir"/usr/bin/$pkgname
93
install -Dm644 -t "$pkgdir"/usr/share/applications "$srcdir"/$pkgname.desktop
94
95
# fix perms
96
cd "$pkgdir"/usr/lib/$pkgname
97
chmod -R a+r .
98
find . -executable -execdir chmod a+x '{}' +
99
100
# replicate mb official deb pkg quirks to "blend with the crowd".
101
# is-packaged-app sets browser_home to HOME
102
cd "$pkgdir"/usr/lib/$pkgname
103
rm -r .config/ start-$pkgname.desktop
104
install -Dm644 -T /dev/null is-packaged-app
105
106
# for docs. doc/Licenses is also a deb quirk
107
cd "$pkgdir"/usr/lib/$pkgname/MullvadBrowser/Docs
108
install -Dm644 -t "$pkgdir"/usr/share/doc/$pkgname ChangeLog.txt
109
install -Dm644 -t "$pkgdir"/usr/share/doc/$pkgname/Licenses Licenses/*
110
install -Dm644 -t "$pkgdir"/usr/share/licenses/$pkgname Licenses/*
111
112
# for icons
113
cd "$pkgdir"/usr
114
for i in 16 32 48 64 128 scalable
115
do
116
if test $i == "scalable"
117
then
118
dir=share/icons/hicolor/scalable/apps
119
fr=lib/$pkgname/browser/chrome/icons/default/about-logo.svg
120
to=$dir/$pkgname.svg
121
else
122
dir=share/icons/hicolor/${i}x${i}/apps
123
fr=lib/$pkgname/browser/chrome/icons/default/default${i}.png
124
to=$dir/$pkgname.png
125
fi
126
install -d $dir
127
ln -srf $fr $to
128
done
129
}
130
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |