mullvad-browser-bin

maintainer tarball · 81 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a prebuilt binary from the official Tor Project distribution domain, which is a trusted and project-owned source for Mullvad Browser; downloading from a non-whitelisted but legitimate infrastructure is normal for AUR packages and does not constitute a high risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt binary from the official Tor Project distribution domain, which is a trusted and project-owned source for Mullvad Browser; downloading from a non-whitelisted but legitimate infrastructure is normal for AUR packages and does not constitute a high risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:68 https://dist.torproject.org/mullvadbrowser/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: tarball <bootctl@gmail.com>
    
      2# Contributor: Mark Wagie <mark.wagie@proton.me>
    
      3#
    
      4# Fetching the signing key:
    
      5#     https://mullvad.net/en/help/verifying-mullvad-browser-signature
    
      6# If you can't open the page, here's the important line:
    
      7#     gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
    
      8#
    
      9# Please discuss bugs in AUR comments before reporting them upstream!
    
      10
    
      11pkgname=mullvad-browser-bin
    
      12pkgver=15.0.19
    
      13pkgrel=1
    
      14pkgdesc='Privacy-focused web browser developed by Mullvad VPN and the Tor Project'
    
      15arch=(x86_64)
    
      16url=https://mullvad.net/en/browser
    
      17license=(MPL-2.0) # see about:license
    
      18depends=(
    
      19  alsa-lib
    
      20  at-spi2-core
    
      21  bash
    
      22  cairo
    
      23  dbus
    
      24  ffmpeg4.4
    
      25  fontconfig
    
      26  freetype2
    
      27  libgcc
    
      28  libstdc++
    
      29  gdk-pixbuf2
    
      30  glib2
    
      31  glibc
    
      32  gtk3
    
      33  hicolor-icon-theme
    
      34  libpulse
    
      35  libx11
    
      36  libxcb
    
      37  libxcomposite
    
      38  libxcursor
    
      39  libxdamage
    
      40  libxext
    
      41  libxfixes
    
      42  libxi
    
      43  libxrandr
    
      44  libxrender
    
      45  libxss
    
      46  libxt
    
      47  mime-types
    
      48  nspr
    
      49  nss
    
      50  pango
    
      51  ttf-font
    
      52)
    
      53optdepends=(
    
      54  'hunspell-en_US: Spell checking, American English'
    
      55  'libnotify: Notification integration'
    
      56  'networkmanager: Location detection via available WiFi networks'
    
      57  'pulse-native-provider: Sound support when using PipeWire or PulseAudio' # thanks to @cyberpunkrocker for the suggestion
    
      58  'speech-dispatcher: Text-to-Speech'
    
      59  'xdg-desktop-portal: Screensharing with Wayland'
    
      60)
    
      61provides=(mullvad-browser=$pkgver mullvad-browser)
    
      62conflicts=(mullvad-browser)
    
      63
    
      64# mullvad.net is blocked or slow in many countries around the world.
    
      65source=(
    
      66  #https://github.com/mullvad/mullvad-browser/releases/download/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}
    
      67  #https://cdn.mullvad.net/browser/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}
    
      68  https://dist.torproject.org/mullvadbrowser/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}
    
      69  #https://tor.eff.org/dist/mullvadbrowser/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}
    
      70
    
      71  mullvad-browser.sh
    
      72  mullvad-browser.desktop
    
      73)
    
      74validpgpkeys=(
    
      75  'EF6E286DDA85EA2A4BA7DE684E2C6E8793298290' # Tor Browser Developers (signing key) <torbrowser@torproject.org>
    
      76)
    
      77changelog='mullvad-browser.changelog'
    
      78
    
      79sha256sums=('f556efec0f096ab62d4f42e5d5bbde426c227fbfc8562aba81e33132a785f92e'
    
      80            'SKIP'
    
      81            '9e1a8b33705972bd372be3af3bdf3039297e6d568e53dcf2e3da03f6f2f2aadd'
    
      82            '6e218bdd9c442143088dec784d898f2668e36ae55f6cde45038408bc2bd59488')
    
      83
    
      84package() {
    
      85  local pkg=${pkgname%%-bin}
    
      86
    
      87  # cli wrapper
    
      88  install -Dvm755 "$pkg.sh" "$pkgdir/usr/bin/$pkg"
    
      89
    
      90  # desktop file
    
      91  install -Dvm644 "$pkg.desktop" -t "$pkgdir/usr/share/applications/"
    
      92
    
      93  cd mullvad-browser
    
      94
    
      95  # only owner has access to all files
    
      96  chmod --recursive --verbose a+r .
    
      97
    
      98  # mark all files executable by the owner as executable by all users
    
      99  # `-executable` finds nothing on `noexec` filesystems (thank you vesinum@aur)
    
      100  find . -perm -u=x -execdir chmod --verbose a+x '{}' +
    
      101
    
      102  # copy files from archive
    
      103  install -dvm755 "$pkgdir/opt/$pkg/"
    
      104  cp --archive --verbose Browser/. "$pkgdir/opt/$pkg/"
    
      105
    
      106  # fix "open file" dialog crash
    
      107  sed -i 's|<dir prefix="cwd">fonts</dir>|<dir>/opt/mullvad-browser/fonts</dir>|' \
    
      108    "$pkgdir/opt/$pkg/fonts/fonts.conf"
    
      109
    
      110  # create profiles in ~
    
      111  install -Dvm644 /dev/null "$pkgdir/opt/$pkg/system-install"
    
      112
    
      113  # disable built-in updates
    
      114  install -Dvm644 /dev/null "$pkgdir/opt/$pkg/is-packaged-app"
    
      115
    
      116  # icons
    
      117  local size
    
      118  for size in 16 32 48 64 128; do
    
      119    install -Dvm644 "$pkgdir/opt/$pkg/browser/chrome/icons/default/default$size.png" \
    
      120      "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$pkg.png"
    
      121  done
    
      122  install -Dvm644 "$pkgdir/opt/$pkg/browser/chrome/icons/default/about-logo.svg" \
    
      123      "$pkgdir/usr/share/icons/hicolor/scalable/apps/$pkg.svg"
    
      124
    
      125  # license files
    
      126  install -dvm755 "$pkgdir/usr/share/licenses/"
    
      127  ln -sfv "/opt/$pkg/MullvadBrowser/Docs/Licenses" "$pkgdir/usr/share/licenses/$pkg"
    
      128
    
      129  # distribution channel
    
      130  install -Dvm644 /dev/stdin "$pkgdir/opt/$pkg/distribution/distribution.ini" <<END
    
      131[Global]
    
      132id=archlinux-aur
    
      133version=1.0
    
      134about=Mullvad Browser for Arch Linux (AUR)
    
      135
    
      136[Preferences]
    
      137app.distributor=archlinux-aur
    
      138app.distributor.channel=$pkgname
    
      139app.partner.archlinux=archlinux-aur
    
      140END
    
      141
    
      142  # GNOME search provider (while the browser is running)
    
      143  install -Dvm644 /dev/stdin "$pkgdir/opt/$pkg/browser/defaults/preferences/vendor.js" <<END
    
      144// Use system-provided dictionaries
    
      145pref("spellchecker.dictionary_path", "/usr/share/hunspell");
    
      146
    
      147// Enable GNOME Shell search provider
    
      148pref("browser.gnome-search-provider.enabled", true);
    
      149END
    
      150
    
      151  install -Dvm644 /dev/stdin "$pkgdir/usr/share/gnome-shell/search-providers/$pkg.search-provider.ini" <<END
    
      152[Shell Search Provider]
    
      153DesktopId=mullvad-browser.desktop
    
      154BusName=org.mozilla.mullvadbrowser.SearchProvider
    
      155ObjectPath=/org/mozilla/mullvadbrowser/SearchProvider
    
      156Version=2
    
      157END
    
      158}
    
      159

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,7 +9,7 @@
 # Please discuss bugs in AUR comments before reporting them upstream!
 
 pkgname=mullvad-browser-bin
-pkgver=15.0.18
+pkgver=15.0.19
 pkgrel=1
 pkgdesc='Privacy-focused web browser developed by Mullvad VPN and the Tor Project'
 arch=(x86_64)
@@ -76,7 +76,7 @@
 )
 changelog='mullvad-browser.changelog'
 
-sha256sums=('86f2dfb751c38ffe4d8007d06f58a061d8493791ff8d9dbeeecfc928a2dfe06b'
+sha256sums=('f556efec0f096ab62d4f42e5d5bbde426c227fbfc8562aba81e33132a785f92e'
             'SKIP'
             '9e1a8b33705972bd372be3af3bdf3039297e6d568e53dcf2e3da03f6f2f2aadd'
             '6e218bdd9c442143088dec784d898f2668e36ae55f6cde45038408bc2bd59488')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 15:17:04	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2