naiveproxy

maintainer bgme · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code and build dependencies (PGO profile, Clang toolchain) from Google's infrastructure (storage.googleapis.com, commondatastorage.googleapis.com), which are legitimate and expected for Chromium-based builds; these are not executable payloads but build artifacts, and the final binary is compiled from source, making the risk low despite the non-standard host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and build dependencies (PGO profile, Clang toolchain) from Google's infrastructure (storage.googleapis.com, commondatastorage.googleapis.com), which are legitimate and expected for Chromium-based builds; these are not executable payloads but build artifacts, and the final binary is compiled from source, making the risk low despite the non-standard host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "${_PGO_PATH}::https://storage.googleapis.com/chromium-optimization-profiles/pgo_profiles/${_PGO_PATH}"
PKGBUILD:25 "${_clang_path}::https://commondatastorage.googleapis.com/chromium-browser-clang/Linux_x64/${_clang_path}"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: bgme <i@bgme.me>
    
      2# Contributor: navigaid <navigaid@gmail.com>
    
      3
    
      4pkgname=naiveproxy
    
      5pkgdesc="A Proxy using Chrome's network stack to camouflage traffic with strong censorship resistence and low detectablility."
    
      6pkgver=150.0.7871.63_1
    
      7pkgrel=1
    
      8_pkgver=150.0.7871.63
    
      9_pkgrel=1
    
      10arch=('x86_64')
    
      11url='https://github.com/klzgrad/naiveproxy'
    
      12license=('BSD-3-Clause')
    
      13depends=("gcc-libs" "glibc")
    
      14makedepends=("ninja" "gn" "ccache" "python")
    
      15checkdepends=("python" "openssl")
    
      16
    
      17_PGO_PATH='chrome-linux-7871-1782236690-ee033e4bf26c147ed0557fd905d416dc66bc7545-3d4da56162112271e9a86f91f4696c964516a649.profdata'
    
      18_clang_path='clang-llvmorg-23-init-10931-g20b6ec66-11.tar.xz'
    
      19
    
      20source=(
    
      21  "naiveproxy.service"
    
      22  "naiveproxy@.service"
    
      23  "${pkgname}-${_pkgver}-${_pkgrel}.tar.gz::https://github.com/klzgrad/naiveproxy/archive/refs/tags/v${_pkgver}-${_pkgrel}.tar.gz"
    
      24  "${_PGO_PATH}::https://storage.googleapis.com/chromium-optimization-profiles/pgo_profiles/${_PGO_PATH}"
    
      25  "${_clang_path}::https://commondatastorage.googleapis.com/chromium-browser-clang/Linux_x64/${_clang_path}"
    
      26)
    
      27
    
      28noextract=(
    
      29  "${_clang_path}"
    
      30)
    
      31
    
      32sha1sums=('f959ceed9d451e3344d99b2a1572ca27416a5675'
    
      33          '278983a6edd5477e8f6f0557ea206f236fdc51dc'
    
      34          'd3a76215018c1d18b42002d07f51bb2f0b624b2b'
    
      35          'ee033e4bf26c147ed0557fd905d416dc66bc7545'
    
      36          '5b60dac1119b64878996f18cb9eaca843581d076')
    
      37sha256sums=('8b56b5a401cb7f77b50376ec27e40445f4bdbe85890ab717327de187ded92c53'
    
      38            'dd8f8e154832d49795be417557db9cc408976cc324452715f5d796b40e5a752d'
    
      39            '05f7808b91fe07d2acfdac1a041ad93b6d5a13799b1429952b0c82bd1edbf8d1'
    
      40            '63118ef73e3d7fe033ef94c8b3d1751174504c32ee8fdecc081e4a17491926da'
    
      41            'de584381536aa5ba2403033c4f8b70f3c39c2e5d7fa87c953b7fd8bfbba0ee2a')
    
      42
    
      43backup=('etc/naiveproxy/config.json')
    
      44provides=('naiveproxy')
    
      45conflicts=('naiveproxy')
    
      46
    
      47prepare() {
    
      48  SRC_DIR="${srcdir}/${pkgname}-${_pkgver}-${_pkgrel}/src"
    
      49
    
      50  mkdir -p "${SRC_DIR}/chrome/build/pgo_profiles"
    
      51  cp ${_PGO_PATH} "${SRC_DIR}/chrome/build/pgo_profiles/"
    
      52
    
      53  mkdir -p "${SRC_DIR}/third_party/llvm-build/Release+Asserts"
    
      54  tar xJf ${_clang_path} -C "${SRC_DIR}/third_party/llvm-build/Release+Asserts/"
    
      55}
    
      56
    
      57build() {
    
      58  SRC_DIR="${srcdir}/${pkgname}-${_pkgver}-${_pkgrel}/src"
    
      59
    
      60  cd "${SRC_DIR}"
    
      61
    
      62  export TMPDIR="$PWD/tmp"
    
      63  rm -rf "$TMPDIR"
    
      64  mkdir -p "$TMPDIR"
    
      65
    
      66  out=out/Release
    
      67  flags="
    
      68    is_official_build=true
    
      69    exclude_unwind_tables=true
    
      70    enable_resource_allowlist_generation=false
    
      71    chrome_pgo_phase=2
    
      72    symbol_level=0"
    
      73
    
      74  export CCACHE_SLOPPINESS=time_macros
    
      75  export CCACHE_BASEDIR="$PWD"
    
      76  export CCACHE_CPP2=yes
    
      77  CCACHE=ccache
    
      78
    
      79  flags="$flags
    
      80    cc_wrapper=\"$CCACHE\""
    
      81
    
      82  flags="$flags"'
    
      83    is_clang=true
    
      84    use_sysroot=false
    
      85
    
      86    fatal_linker_warnings=false
    
      87    treat_warnings_as_errors=false
    
      88
    
      89    is_cronet_build=true
    
      90
    
      91    use_udev=false
    
      92    use_aura=false
    
      93    use_ozone=false
    
      94    use_gio=false
    
      95    use_platform_icu_alternatives=true
    
      96    use_glib=false
    
      97    is_perfetto_embedder=true
    
      98
    
      99    disable_file_support=true
    
      100    enable_websockets=false
    
      101    use_kerberos=false
    
      102    disable_file_support=true
    
      103    disable_zstd_filter=false
    
      104    enable_mdns=false
    
      105    enable_reporting=false
    
      106    include_transport_security_state_preload_list=false
    
      107    enable_device_bound_sessions=false
    
      108    enable_bracketed_proxy_uris=true
    
      109    enable_quic_proxy_support=true
    
      110    enable_disk_cache_sql_backend=false
    
      111
    
      112    use_nss_certs=false
    
      113
    
      114    enable_backup_ref_ptr_support=false
    
      115    enable_dangling_raw_ptr_checks=false
    
      116  '
    
      117
    
      118  # Disable CFI icall for linux x64
    
      119  # See https://github.com/llvm/llvm-project/issues/86430
    
      120  flags="$flags"'
    
      121    use_cfi_icall=false'
    
      122
    
      123  rm -rf "./$out"
    
      124  mkdir -p out
    
      125
    
      126  export DEPOT_TOOLS_WIN_TOOLCHAIN=0
    
      127
    
      128  gn gen "$out" "--args=$flags $EXTRA_FLAGS"
    
      129
    
      130  ninja -C "$out" naive
    
      131}
    
      132
    
      133check() {
    
      134  SRC_DIR="${srcdir}/${pkgname}-${_pkgver}-${_pkgrel}"
    
      135  script_dir="${SRC_DIR}/tests"
    
      136  naive="${SRC_DIR}/src/out/Release/naive"
    
      137
    
      138  cd /tmp
    
      139  python "${script_dir}/basic.py" --naive="$naive"
    
      140}
    
      141
    
      142package() {
    
      143  pushd "${srcdir}"
    
      144  install -Dm644 naiveproxy.service "${pkgdir}/usr/lib/systemd/system/naiveproxy.service"
    
      145  install -Dm644 naiveproxy@.service "${pkgdir}/usr/lib/systemd/system/naiveproxy@.service"
    
      146  popd
    
      147
    
      148  pushd "${srcdir}/${pkgname}-${_pkgver}-${_pkgrel}"
    
      149  install -d -m750 "${pkgdir}/etc/naiveproxy"
    
      150  install -Dm644 src/config.json "${pkgdir}/etc/naiveproxy/config.json"
    
      151  install -Dm755 src/out/Release/naive "${pkgdir}/usr/bin/naiveproxy"
    
      152  install -Dm644 README.md "${pkgdir}/usr/share/doc/naiveproxy/README.md"
    
      153  install -Dm644 USAGE.txt "${pkgdir}/usr/share/doc/naiveproxy/USAGE.txt"
    
      154  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/naiveproxy/LICENSE"
    
      155  popd
    
      156}
    
      157

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2