mullvad-browser-bin

LOW
maintainer tarball 81 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The source uses dist.torproject.org, which is a legitimate and official distribution point for the Mullvad Browser, co-developed by the Tor Project; downloading a prebuilt browser bundle from this trusted project-owned domain, even if not on a default whitelist, represents a normal and expected packaging practice with low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source uses dist.torproject.org, which is a legitimate and official distribution point for the Mullvad Browser, co-developed by the Tor Project; downloading a prebuilt browser bundle from this trusted project-owned domain, even if not on a default whitelist, represents a normal and expected packaging practice with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:68 https://dist.torproject.org/mullvadbrowser/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: tarball <bootctl@gmail.com>
2# Contributor: Mark Wagie <mark.wagie@proton.me>
3#
4# Fetching the signing key:
5# https://mullvad.net/en/help/verifying-mullvad-browser-signature
6# If you can't open the page, here's the important line:
7# gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
8#
9# Please discuss bugs in AUR comments before reporting them upstream!
10
11pkgname=mullvad-browser-bin
12pkgver=15.0.21
13pkgrel=1
14pkgdesc='Privacy-focused web browser developed by Mullvad VPN and the Tor Project'
15arch=(x86_64)
16url=https://mullvad.net/en/browser
17license=(MPL-2.0) # see about:license
18depends=(
19 alsa-lib
20 at-spi2-core
21 bash
22 cairo
23 dbus
24 ffmpeg4.4
25 fontconfig
26 freetype2
27 libgcc
28 libstdc++
29 gdk-pixbuf2
30 glib2
31 glibc
32 gtk3
33 hicolor-icon-theme
34 libpulse
35 libx11
36 libxcb
37 libxcomposite
38 libxcursor
39 libxdamage
40 libxext
41 libxfixes
42 libxi
43 libxrandr
44 libxrender
45 libxss
46 libxt
47 mime-types
48 nspr
49 nss
50 pango
51 ttf-font
52)
53optdepends=(
54 'hunspell-en_US: Spell checking, American English'
55 'libnotify: Notification integration'
56 'networkmanager: Location detection via available WiFi networks'
57 'pulse-native-provider: Sound support when using PipeWire or PulseAudio' # thanks to @cyberpunkrocker for the suggestion
58 'speech-dispatcher: Text-to-Speech'
59 'xdg-desktop-portal: Screensharing with Wayland'
60)
61provides=(mullvad-browser=$pkgver mullvad-browser)
62conflicts=(mullvad-browser)
63
64# mullvad.net is blocked or slow in many countries around the world.
65source=(
66 #https://github.com/mullvad/mullvad-browser/releases/download/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}
67 #https://cdn.mullvad.net/browser/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}
68 https://dist.torproject.org/mullvadbrowser/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}
69 #https://tor.eff.org/dist/mullvadbrowser/$pkgver/mullvad-browser-linux-x86_64-$pkgver.tar.xz{,.asc}
70
71 mullvad-browser.sh
72 mullvad-browser.desktop
73)
74validpgpkeys=(
75 'EF6E286DDA85EA2A4BA7DE684E2C6E8793298290' # Tor Browser Developers (signing key) <torbrowser@torproject.org>
76)
77changelog='mullvad-browser.changelog'
78
79sha256sums=('2c7bff858fda6e6cbbffc9ec3642a2c0987e4af44bcc43bdedf34dbcfb985d0a'
80 'SKIP'
81 '9e1a8b33705972bd372be3af3bdf3039297e6d568e53dcf2e3da03f6f2f2aadd'
82 '6e218bdd9c442143088dec784d898f2668e36ae55f6cde45038408bc2bd59488')
83
84package() {
85 local pkg=${pkgname%%-bin}
86
87 # cli wrapper
88 install -Dvm755 "$pkg.sh" "$pkgdir/usr/bin/$pkg"
89
90 # desktop file
91 install -Dvm644 "$pkg.desktop" -t "$pkgdir/usr/share/applications/"
92
93 cd mullvad-browser
94
95 # only owner has access to all files
96 chmod --recursive --verbose a+r .
97
98 # mark all files executable by the owner as executable by all users
99 # `-executable` finds nothing on `noexec` filesystems (thank you vesinum@aur)
100 find . -perm -u=x -execdir chmod --verbose a+x '{}' +
101
102 # copy files from archive
103 install -dvm755 "$pkgdir/opt/$pkg/"
104 cp --archive --verbose Browser/. "$pkgdir/opt/$pkg/"
105
106 # fix "open file" dialog crash
107 sed -i 's|<dir prefix="cwd">fonts</dir>|<dir>/opt/mullvad-browser/fonts</dir>|' \
108 "$pkgdir/opt/$pkg/fonts/fonts.conf"
109
110 # create profiles in ~
111 install -Dvm644 /dev/null "$pkgdir/opt/$pkg/system-install"
112
113 # disable built-in updates
114 install -Dvm644 /dev/null "$pkgdir/opt/$pkg/is-packaged-app"
115
116 # icons
117 local size
118 for size in 16 32 48 64 128; do
119 install -Dvm644 "$pkgdir/opt/$pkg/browser/chrome/icons/default/default$size.png" \
120 "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$pkg.png"
121 done
122 install -Dvm644 "$pkgdir/opt/$pkg/browser/chrome/icons/default/about-logo.svg" \
123 "$pkgdir/usr/share/icons/hicolor/scalable/apps/$pkg.svg"
124
125 # license files
126 install -dvm755 "$pkgdir/usr/share/licenses/"
127 ln -sfv "/opt/$pkg/MullvadBrowser/Docs/Licenses" "$pkgdir/usr/share/licenses/$pkg"
128
129 # distribution channel
130 install -Dvm644 /dev/stdin "$pkgdir/opt/$pkg/distribution/distribution.ini" <<END
131[Global]
132id=archlinux-aur
133version=1.0
134about=Mullvad Browser for Arch Linux (AUR)
135
136[Preferences]
137app.distributor=archlinux-aur
138app.distributor.channel=$pkgname
139app.partner.archlinux=archlinux-aur
140END
141
142 # GNOME search provider (while the browser is running)
143 install -Dvm644 /dev/stdin "$pkgdir/opt/$pkg/browser/defaults/preferences/vendor.js" <<END
144// Use system-provided dictionaries
145pref("spellchecker.dictionary_path", "/usr/share/hunspell");
146
147// Enable GNOME Shell search provider
148pref("browser.gnome-search-provider.enabled", true);
149END
150
151 install -Dvm644 /dev/stdin "$pkgdir/usr/share/gnome-shell/search-providers/$pkg.search-provider.ini" <<END
152[Shell Search Provider]
153DesktopId=mullvad-browser.desktop
154BusName=org.mozilla.mullvadbrowser.SearchProvider
155ObjectPath=/org/mozilla/mullvadbrowser/SearchProvider
156Version=2
157END
158}
159

Changes since previous scan

--- PKGBUILD @ 2026-09-15 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -9,7 +9,7 @@
# Please discuss bugs in AUR comments before reporting them upstream!
pkgname=mullvad-browser-bin
-pkgver=15.0.20
+pkgver=15.0.21
pkgrel=1
pkgdesc='Privacy-focused web browser developed by Mullvad VPN and the Tor Project'
arch=(x86_64)
@@ -76,7 +76,7 @@
)
changelog='mullvad-browser.changelog'
-sha256sums=('13256287592494883b6f77dd87ab6ab441375e1fd43e93cc6607ddc6d63a739b'
+sha256sums=('2c7bff858fda6e6cbbffc9ec3642a2c0987e4af44bcc43bdedf34dbcfb985d0a'
'SKIP'
'9e1a8b33705972bd372be3af3bdf3039297e6d568e53dcf2e3da03f6f2f2aadd'
'6e218bdd9c442143088dec784d898f2668e36ae55f6cde45038408bc2bd59488')

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 11:19:45 Medium 1
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 17:48:51 Medium 1
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion