naiveproxy

LOW

maintainer bgme 5 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package builds from a legitimate GitHub source and downloads PGO profiles and a Clang toolchain from Google's official infrastructure (commondatastorage.googleapis.com, storage.googleapis.com), which are used during compilation; these are not executed binaries but build dependencies, posing minimal risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate GitHub source and downloads PGO profiles and a Clang toolchain from Google's official infrastructure (commondatastorage.googleapis.com, storage.googleapis.com), which are used during compilation; these are not executed binaries but build dependencies, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "${_PGO_PATH}::https://storage.googleapis.com/chromium-optimization-profiles/pgo_profiles/${_PGO_PATH}"
PKGBUILD:25 "${_clang_path}::https://commondatastorage.googleapis.com/chromium-browser-clang/Linux_x64/${_clang_path}"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: bgme <i@bgme.me>
    
      2# Contributor: navigaid <navigaid@gmail.com>
    
      3
    
      4pkgname=naiveproxy
    
      5pkgdesc="A Proxy using Chrome's network stack to camouflage traffic with strong censorship resistence and low detectablility."
    
      6pkgver=154.0.8037.49_5
    
      7pkgrel=1
    
      8_pkgver=154.0.8037.49
    
      9_pkgrel=5
    
      10arch=('x86_64')
    
      11url='https://github.com/klzgrad/naiveproxy'
    
      12license=('BSD-3-Clause')
    
      13depends=("gcc-libs" "glibc")
    
      14makedepends=("ninja" "gn" "ccache" "python")
    
      15checkdepends=("python" "openssl")
    
      16
    
      17_PGO_PATH='chrome-linux-8037-1789495081-7feb9cdd3829d739633f8ac2c1a41d6c0f693bd3-9272cb3a6934b0e4510fb1cde78ca7e9d7859922.profdata'
    
      18_clang_path='clang-llvmorg-24-init-3796-g20e97c4b-27.tar.xz'
    
      19
    
      20source=(
    
      21  "naiveproxy.service"
    
      22  "naiveproxy@.service"
    
      23  "${pkgname}-${_pkgver}-${_pkgrel}.tar.gz::https://github.com/klzgrad/naiveproxy/archive/refs/tags/v${_pkgver}-${_pkgrel}.tar.gz"
    
      24  "${_PGO_PATH}::https://storage.googleapis.com/chromium-optimization-profiles/pgo_profiles/${_PGO_PATH}"
    
      25  "${_clang_path}::https://commondatastorage.googleapis.com/chromium-browser-clang/Linux_x64/${_clang_path}"
    
      26)
    
      27
    
      28noextract=(
    
      29  "${_clang_path}"
    
      30)
    
      31
    
      32sha1sums=('f959ceed9d451e3344d99b2a1572ca27416a5675'
    
      33          '278983a6edd5477e8f6f0557ea206f236fdc51dc'
    
      34          'f67d7b2b3f44130aea51217bdd0fdb6ced51735b'
    
      35          '7feb9cdd3829d739633f8ac2c1a41d6c0f693bd3'
    
      36          '7c09622b89a571d061e8429d0570193a6fca21fb')
    
      37sha256sums=('8b56b5a401cb7f77b50376ec27e40445f4bdbe85890ab717327de187ded92c53'
    
      38            'dd8f8e154832d49795be417557db9cc408976cc324452715f5d796b40e5a752d'
    
      39            '945e89a43e38e15baf16a5d8489c55c47c325b5c9a86f2ee082ce688d0cee4eb'
    
      40            '1e1f79dc4b6de72bccfbc2e67498e75ce60c4b53c10bceb0559c358596cd71a2'
    
      41            '968195fa0b49958e066695df2c7c985d169a20fa06eedb8fcef900a6030edcb0')
    
      42
    
      43backup=('etc/naiveproxy/config.json')
    
      44provides=('naiveproxy')
    
      45conflicts=('naiveproxy')
    
      46
    
      47prepare() {
    
      48  SRC_DIR="${srcdir}/${pkgname}-${_pkgver}-${_pkgrel}/src"
    
      49
    
      50  mkdir -p "${SRC_DIR}/chrome/build/pgo_profiles"
    
      51  cp ${_PGO_PATH} "${SRC_DIR}/chrome/build/pgo_profiles/"
    
      52
    
      53  mkdir -p "${SRC_DIR}/third_party/llvm-build/Release+Asserts"
    
      54  tar xJf ${_clang_path} -C "${SRC_DIR}/third_party/llvm-build/Release+Asserts/"
    
      55}
    
      56
    
      57build() {
    
      58  SRC_DIR="${srcdir}/${pkgname}-${_pkgver}-${_pkgrel}/src"
    
      59
    
      60  cd "${SRC_DIR}"
    
      61
    
      62  export TMPDIR="$PWD/tmp"
    
      63  rm -rf "$TMPDIR"
    
      64  mkdir -p "$TMPDIR"
    
      65
    
      66  out=out/Release
    
      67  flags="
    
      68    is_official_build=true
    
      69    exclude_unwind_tables=true
    
      70    enable_resource_allowlist_generation=false
    
      71    chrome_pgo_phase=2
    
      72    symbol_level=0"
    
      73
    
      74  export CCACHE_SLOPPINESS=time_macros
    
      75  export CCACHE_BASEDIR="$PWD"
    
      76  export CCACHE_CPP2=yes
    
      77  CCACHE=ccache
    
      78
    
      79  flags="$flags
    
      80    cc_wrapper=\"$CCACHE\""
    
      81
    
      82  flags="$flags"'
    
      83    is_clang=true
    
      84    use_sysroot=false
    
      85
    
      86    fatal_linker_warnings=false
    
      87    treat_warnings_as_errors=false
    
      88
    
      89    is_cronet_build=true
    
      90
    
      91    use_udev=false
    
      92    use_aura=false
    
      93    use_ozone=false
    
      94    use_gio=false
    
      95    use_platform_icu_alternatives=true
    
      96    use_glib=false
    
      97    is_perfetto_embedder=true
    
      98
    
      99    disable_file_support=true
    
      100    enable_websockets=false
    
      101    use_kerberos=false
    
      102    disable_file_support=true
    
      103    disable_zstd_filter=false
    
      104    enable_mdns=false
    
      105    enable_reporting=false
    
      106    include_transport_security_state_preload_list=false
    
      107    enable_device_bound_sessions=false
    
      108    enable_bracketed_proxy_uris=true
    
      109    enable_quic_proxy_support=true
    
      110    enable_disk_cache_sql_backend=false
    
      111
    
      112    use_nss_certs=false
    
      113
    
      114    enable_backup_ref_ptr_support=false
    
      115    enable_dangling_raw_ptr_checks=false
    
      116  '
    
      117
    
      118  # Disable CFI icall for linux x64
    
      119  # See https://github.com/llvm/llvm-project/issues/86430
    
      120  flags="$flags"'
    
      121    use_cfi_icall=false'
    
      122
    
      123  rm -rf "./$out"
    
      124  mkdir -p out
    
      125
    
      126  export DEPOT_TOOLS_WIN_TOOLCHAIN=0
    
      127
    
      128  gn gen "$out" "--args=$flags $EXTRA_FLAGS"
    
      129
    
      130  ninja -C "$out" naive
    
      131}
    
      132
    
      133check() {
    
      134  SRC_DIR="${srcdir}/${pkgname}-${_pkgver}-${_pkgrel}"
    
      135  script_dir="${SRC_DIR}/tests"
    
      136  naive="${SRC_DIR}/src/out/Release/naive"
    
      137
    
      138  cd /tmp
    
      139  python "${script_dir}/basic.py" --naive="$naive"
    
      140}
    
      141
    
      142package() {
    
      143  pushd "${srcdir}"
    
      144  install -Dm644 naiveproxy.service "${pkgdir}/usr/lib/systemd/system/naiveproxy.service"
    
      145  install -Dm644 naiveproxy@.service "${pkgdir}/usr/lib/systemd/system/naiveproxy@.service"
    
      146  popd
    
      147
    
      148  pushd "${srcdir}/${pkgname}-${_pkgver}-${_pkgrel}"
    
      149  install -d -m750 "${pkgdir}/etc/naiveproxy"
    
      150  install -Dm644 src/config.json "${pkgdir}/etc/naiveproxy/config.json"
    
      151  install -Dm755 src/out/Release/naive "${pkgdir}/usr/bin/naiveproxy"
    
      152  install -Dm644 README.md "${pkgdir}/usr/share/doc/naiveproxy/README.md"
    
      153  install -Dm644 USAGE.txt "${pkgdir}/usr/share/doc/naiveproxy/USAGE.txt"
    
      154  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/naiveproxy/LICENSE"
    
      155  popd
    
      156}
    
      157

Changes since previous scan

--- PKGBUILD @ 2026-10-22 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -3,10 +3,10 @@
 
 pkgname=naiveproxy
 pkgdesc="A Proxy using Chrome's network stack to camouflage traffic with strong censorship resistence and low detectablility."
-pkgver=154.0.8037.49_4
+pkgver=154.0.8037.49_5
 pkgrel=1
 _pkgver=154.0.8037.49
-_pkgrel=4
+_pkgrel=5
 arch=('x86_64')
 url='https://github.com/klzgrad/naiveproxy'
 license=('BSD-3-Clause')
@@ -31,12 +31,12 @@
 
 sha1sums=('f959ceed9d451e3344d99b2a1572ca27416a5675'
           '278983a6edd5477e8f6f0557ea206f236fdc51dc'
-          'd20eaaa195f40be548fa16a889d9d8165895fdb5'
+          'f67d7b2b3f44130aea51217bdd0fdb6ced51735b'
           '7feb9cdd3829d739633f8ac2c1a41d6c0f693bd3'
           '7c09622b89a571d061e8429d0570193a6fca21fb')
 sha256sums=('8b56b5a401cb7f77b50376ec27e40445f4bdbe85890ab717327de187ded92c53'
             'dd8f8e154832d49795be417557db9cc408976cc324452715f5d796b40e5a752d'
-            '11b4dd5642b9f41087e95ca099c50879d72f40c3f0db56a9fa3228eb3c06e104'
+            '945e89a43e38e15baf16a5d8489c55c47c325b5c9a86f2ee082ce688d0cee4eb'
             '1e1f79dc4b6de72bccfbc2e67498e75ce60c4b53c10bceb0559c358596cd71a2'
             '968195fa0b49958e066695df2c7c985d169a20fa06eedb8fcef900a6030edcb0')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 23:36:19	Medium	1
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2