mullvad-browser

maintainer noureddinex · 19 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code and checksums from the official Mullvad and Tor Project infrastructure; the non-whitelisted host cdn.mullvad.net is legitimate and used by the project, posing no supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and checksums from the official Mullvad and Tor Project infrastructure; the non-whitelisted host cdn.mullvad.net is legitimate and used by the project, posing no supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 git+https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
PKGBUILD:42 https://cdn.mullvad.net/browser/$pkgver/sha256sums-unsigned-build.txt

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: NourEddineX
    
      2# Contributor: Ralph Torres <mail at ralphptorr dot es>
    
      3# Contributor: éclairevoyant
    
      4# Contributor: tarball <bootctl at gmail dot com>
    
      5
    
      6# NOTE: fetch keys to allow verification of sigs in sha256sums-unsigned-build.txt:
    
      7# gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
    
      8# TODO: enable incremental builds, add addarmor
    
      9
    
      10pkgname=mullvad-browser
    
      11pkgver=15.0.16
    
      12_buildver=build1
    
      13pkgrel=1
    
      14pkgdesc='Privacy-focused web browser developed by Mullvad VPN and the Tor Project'
    
      15arch=(x86_64)
    
      16url=https://mullvad.net/browser
    
      17license=(MPL-2.0)
    
      18
    
      19depends=(
    
      20    alsa-lib at-spi2-core bash cairo dbus ffmpeg fontconfig freetype2 gcc-libs
    
      21    gdk-pixbuf2 glib2 glibc gtk3 hicolor-icon-theme libpulse libx11 libxcb
    
      22    libxcomposite libxdamage libxext libxfixes libxrandr libxss libxt mime-types
    
      23    nspr nss pango ttf-font
    
      24)
    
      25makedepends=(
    
      26    git perl-capture-tiny perl-data-dump perl-data-uuid perl-datetime
    
      27    perl-digest-sha1 perl-file-copy-recursive perl-file-slurp perl-io-all
    
      28    perl-json perl-lwp-protocol-https perl-parallel-forkmanager perl-path-tiny
    
      29    perl-sort-versions perl-string-shellquote perl-sys-syscall
    
      30    perl-template-toolkit perl-xml-libxml perl-yaml perl-yaml-libyaml
    
      31    perl-yaml-tiny wget zstd
    
      32)
    
      33optdepends=(
    
      34    'hunspell-en_US: Spell checking, american english'
    
      35    'libnotify: Notification integration'
    
      36    'networkmanager: Location detection via available wifi networks'
    
      37    'speech-dispatcher: Text-to-speech'
    
      38    'xdg-desktop-portal: Screensharing with wayland'
    
      39)
    
      40source=(
    
      41    git+https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    
      42    https://cdn.mullvad.net/browser/$pkgver/sha256sums-unsigned-build.txt
    
      43    https://cdn.mullvad.net/browser/$pkgver/sha256sums-unsigned-build.txt.asc
    
      44    $pkgname.desktop
    
      45)
    
      46sha256sums=('SKIP'
    
      47            '1465715f3a35a32bb4d4ea0339a16e383b8d34f5b90290caffffcebffc826a7c'
    
      48            'SKIP'
    
      49            'a7f82f8d89b00bc0ea368299e979b900c87710b86b89eafb7122a502e5b47eaf')
    
      50validpgpkeys=(
    
      51    EF6E286DDA85EA2A4BA7DE684E2C6E8793298290 # Tor Browser Developers (signing key) <torbrowser@torproject.org>
    
      52    CAAE408AEBE2288E96FC5D5E157432CF78A65729 # Older one
    
      53)
    
      54
    
      55_builder=tor-browser-build
    
      56_pkgname=mullvadbrowser
    
      57_pkgver=mb-$pkgver-$_buildver
    
      58
    
      59_export_perllib() {
    
      60    export PERLLIB="${srcdir}/sys-ph-includes:${srcdir}/sys-ph-includes/usr/include:${srcdir}/sys-ph-includes/usr/include/sys:${srcdir}/sys-ph-includes/usr/include/asm:${srcdir}/sys-ph-includes/usr/include/bits"
    
      61}
    
      62
    
      63prepare() {
    
      64    mkdir -p sys-ph-includes
    
      65    h2ph -d sys-ph-includes /usr/include/{sys/syscall.h,asm/unistd.h,asm/unistd_64.h,bits/syscall.h}
    
      66
    
      67    _export_perllib
    
      68
    
      69    cd "$srcdir"/$_builder
    
      70    git checkout -f tags/$_pkgver
    
      71    make submodule-update
    
      72
    
      73    gpg --no-default-keyring --no-auto-check-trustdb \
    
      74        --keyring /tmp/$_pkgver.gpg --import keyring/* || true
    
      75}
    
      76
    
      77build() {
    
      78    _export_perllib
    
      79    cd "$srcdir"/$_builder
    
      80    make $_pkgname-release-linux-$arch
    
      81}
    
      82
    
      83check() {
    
      84    cd "$srcdir"/$_builder/$_pkgname/release/unsigned/$pkgver-build1
    
      85    sha256sum --ignore-missing -c "${srcdir}"/sha256sums-unsigned-build.txt
    
      86}
    
      87
    
      88package() {
    
      89    install -d "$pkgdir"/usr/lib/$pkgname "$pkgdir"/usr/bin
    
      90    tar -C "$pkgdir"/usr/lib/$pkgname --strip-components=2 \
    
      91        -xf "$srcdir"/$_builder/$_pkgname/release/unsigned/$pkgver-build1/$pkgname-linux-$arch-$pkgver.tar.xz
    
      92    ln -srfv "$pkgdir"/usr/lib/$pkgname/start-$pkgname "$pkgdir"/usr/bin/$pkgname
    
      93    install -Dm644 -t "$pkgdir"/usr/share/applications "$srcdir"/$pkgname.desktop
    
      94
    
      95    # fix perms
    
      96    cd "$pkgdir"/usr/lib/$pkgname
    
      97    chmod -R a+r .
    
      98    find . -executable -execdir chmod a+x '{}' +
    
      99
    
      100    # replicate mb official deb pkg quirks to "blend with the crowd".
    
      101    # is-packaged-app sets browser_home to HOME
    
      102    cd "$pkgdir"/usr/lib/$pkgname
    
      103    rm -r .config/ start-$pkgname.desktop
    
      104    install -Dm644 -T /dev/null is-packaged-app
    
      105
    
      106    # for docs. doc/Licenses is also a deb quirk
    
      107    cd "$pkgdir"/usr/lib/$pkgname/MullvadBrowser/Docs
    
      108    install -Dm644 -t "$pkgdir"/usr/share/doc/$pkgname ChangeLog.txt
    
      109    install -Dm644 -t "$pkgdir"/usr/share/doc/$pkgname/Licenses Licenses/*
    
      110    install -Dm644 -t "$pkgdir"/usr/share/licenses/$pkgname Licenses/*
    
      111
    
      112    # for icons
    
      113    cd "$pkgdir"/usr
    
      114    for i in 16 32 48 64 128 scalable
    
      115    do
    
      116        if test $i == "scalable"
    
      117        then
    
      118            dir=share/icons/hicolor/scalable/apps
    
      119            fr=lib/$pkgname/browser/chrome/icons/default/about-logo.svg
    
      120            to=$dir/$pkgname.svg
    
      121        else
    
      122            dir=share/icons/hicolor/${i}x${i}/apps
    
      123            fr=lib/$pkgname/browser/chrome/icons/default/default${i}.png
    
      124            to=$dir/$pkgname.png
    
      125        fi
    
      126        install -d $dir
    
      127        ln -srf $fr $to
    
      128    done
    
      129}
    
      130

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2