opera-developer

LOW

maintainer MojArch 91 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs a setuid binary (opera_sandbox) as part of Opera's normal sandboxing mechanism, which is expected behavior for the browser and not inherently malicious.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a setuid binary (opera_sandbox) as part of Opera's normal sandboxing mechanism, which is expected behavior for the browser and not inherently malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:172 chmod 4755 \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: MojArch
    
      2
    
      3pkgname=opera-developer
    
      4pkgver=137.0.6015.0
    
      5pkgrel=1
    
      6pkgdesc='Fast, secure, easy-to-use web browser (Developer Stream)'
    
      7arch=('x86_64')
    
      8url='https://www.opera.com/computer'
    
      9license=('LicenseRef-opera')
    
      10options=(!strip !debug !zipman)
    
      11backup=('etc/opera-developer/default')
    
      12provides=(
    
      13    'opera-developer-browser'
    
      14)
    
      15conflicts=(
    
      16    'opera-developer-ffmpeg-codecs-bin'
    
      17)
    
      18replaces=(
    
      19    'opera-developer-ffmpeg-codecs-bin'
    
      20)
    
      21
    
      22depends=(
    
      23    'alsa-lib'
    
      24    'at-spi2-core'
    
      25    'cairo'
    
      26    'cups'
    
      27    'curl'
    
      28    'dbus'
    
      29    'expat'
    
      30    'gcc-libs'
    
      31    'glib2'
    
      32    'glibc'
    
      33    'gtk3'
    
      34    'hicolor-icon-theme'
    
      35    'libnotify'
    
      36    'libx11'
    
      37    'libxcb'
    
      38    'libxcomposite'
    
      39    'libxdamage'
    
      40    'libxext'
    
      41    'libxfixes'
    
      42    'libxkbcommon'
    
      43    'libxrandr'
    
      44    'libxss'
    
      45    'mesa'
    
      46    'nspr'
    
      47    'nss'
    
      48    'pango'
    
      49    'systemd-libs'
    
      50    'ttf-font'
    
      51    'xdg-utils'
    
      52)
    
      53
    
      54optdepends=(
    
      55    'qt5-base: Qt5 integration'
    
      56    'qt6-base: Qt6 integration'
    
      57    'egl-gbm'
    
      58    'upower'
    
      59)
    
      60
    
      61_nwjs_ffmpeg_version=0.115.0
    
      62_upstream_deb_pkg='opera-developer'
    
      63_debfile="${_upstream_deb_pkg}_${pkgver}_amd64.deb"
    
      64_deburl="https://get.opera.com/pub/opera-developer/${pkgver}/linux/${_debfile}"
    
      65_ffmpeg_zip="${_nwjs_ffmpeg_version}-linux-x64.zip"
    
      66
    
      67source=(
    
      68    "${_deburl}"
    
      69    "opera"
    
      70    "default"
    
      71    "nwjs-ffmpeg-${_ffmpeg_zip}::https://github.com/nwjs-ffmpeg-prebuilt/nwjs-ffmpeg-prebuilt/releases/download/${_nwjs_ffmpeg_version}/${_ffmpeg_zip}"
    
      72)
    
      73
    
      74sha256sums=('238ea996dc3ed283ffbd390022dd22c840aa1e0a871b172bc94f55f78e6b026f'
    
      75            '508512464e24126fddfb2c41a1e2e86624bdb0c0748084b6a922573b6cf6b9c5'
    
      76            '99fc0d2822edd14e234d451995db47148125e4580221a292598959421d131231'
    
      77            '589fc1fa3f9905fe336990a2c8e16a9107c1aabdb42031b69eaf812331e5fb4a')
    
      78
    
      79prepare() {
    
      80    sed -e 's|%pkgname%|opera-developer|g' \
    
      81        -e 's|%operabin%|opera-developer/opera-developer|g' \
    
      82        -i "$srcdir/opera"
    
      83
    
      84    sed -e 's|%pkgname%|opera-developer|g' \
    
      85        -i "$srcdir/default"
    
      86}
    
      87
    
      88package() {
    
      89    cd "$srcdir"
    
      90
    
      91# Extract upstream package
    
      92
    
      93    bsdtar -xf "$_debfile"
    
      94
    
      95    # Debian packages may use xz, zstd, or another supported compressor for
    
      96    # their data member. Do not assume the historical data.tar.xz name.
    
      97    local data_archive
    
      98    data_archive="$(find "$srcdir" \
    
      99        -maxdepth 1 \
    
      100        -type f \
    
      101        -name 'data.tar.*' \
    
      102        -print -quit)"
    
      103
    
      104    if [[ -z "$data_archive" ]]; then
    
      105        echo "ERROR: data archive not found in $_debfile"
    
      106        return 1
    
      107    fi
    
      108
    
      109    bsdtar -xf "$data_archive" \
    
      110        --exclude='usr/share/lintian' \
    
      111        --exclude='usr/share/menu' \
    
      112        -C "$pkgdir"
    
      113
    
      114# Normalize multiarch library layout
    
      115
    
      116    local libroot="$pkgdir/usr/lib"
    
      117
    
      118    local multiarch_dir
    
      119    multiarch_dir="$(find "$libroot" \
    
      120        -mindepth 1 \
    
      121        -maxdepth 1 \
    
      122        -type d \
    
      123        -name '*-linux-gnu' \
    
      124        | head -n1)"
    
      125
    
      126    if [[ -z "$multiarch_dir" ]]; then
    
      127        echo 'ERROR: multiarch library directory not found'
    
      128        return 1
    
      129    fi
    
      130
    
      131    local upstream_libdir
    
      132    upstream_libdir="$(find "$multiarch_dir" \
    
      133        -mindepth 1 \
    
      134        -maxdepth 1 \
    
      135        -type d \
    
      136        -name 'opera-developer' \
    
      137        | head -n1)"
    
      138
    
      139    if [[ -z "$upstream_libdir" ]]; then
    
      140        echo 'ERROR: upstream Opera payload directory not found'
    
      141        return 1
    
      142    fi
    
      143
    
      144    rm -rf "$libroot/opera-developer"
    
      145    mv "$upstream_libdir" \
    
      146        "$libroot/opera-developer"
    
      147    rm -rf "$multiarch_dir"
    
      148
    
      149# Replace FFmpeg
    
      150
    
      151    bsdtar -xf "nwjs-ffmpeg-${_ffmpeg_zip}"
    
      152
    
      153    local ffmpeg_so
    
      154    ffmpeg_so="$(find "$srcdir" \
    
      155        -type f \
    
      156        -name 'libffmpeg.so' \
    
      157        | head -n1)"
    
      158
    
      159    if [[ -z "$ffmpeg_so" ]]; then
    
      160        echo "ERROR: libffmpeg.so not found in $_ffmpeg_zip"
    
      161        return 1
    
      162    fi
    
      163
    
      164    rm -f "$pkgdir/usr/lib/opera-developer/libffmpeg.so"
    
      165
    
      166    install -Dm755 "$ffmpeg_so" \
    
      167        "$pkgdir/usr/lib/opera-developer/libffmpeg.so"
    
      168
    
      169# Sandbox
    
      170
    
      171    if [[ -f "$pkgdir/usr/lib/opera-developer/opera_sandbox" ]]; then
    
      172        chmod 4755 \
    
      173            "$pkgdir/usr/lib/opera-developer/opera_sandbox"
    
      174    fi
    
      175
    
      176# Defaults
    
      177
    
      178    install -Dm644 "$srcdir/default" \
    
      179        "$pkgdir/etc/opera-developer/default"
    
      180
    
      181# Launcher
    
      182
    
      183    local upstream_binary
    
      184
    
      185    upstream_binary="$(find "$pkgdir/usr/lib/opera-developer" \
    
      186        -maxdepth 1 \
    
      187        -type f \
    
      188        \( -name 'opera-developer' -o -name 'opera' \) \
    
      189        | head -n1)"
    
      190
    
      191    if [[ -z "$upstream_binary" ]]; then
    
      192        echo 'ERROR: upstream Opera executable not found'
    
      193        return 1
    
      194    fi
    
      195
    
      196    rm -f "$pkgdir/usr/bin/opera-developer"
    
      197
    
      198    install -Dm755 "$srcdir/opera" \
    
      199        "$pkgdir/usr/bin/opera-developer"
    
      200
    
      201# Desktop entries
    
      202
    
      203    local desktop_dir="$pkgdir/usr/share/applications"
    
      204
    
      205    if [[ -d "$desktop_dir" ]]; then
    
      206        find "$desktop_dir" \
    
      207            -maxdepth 1 \
    
      208            -type f \
    
      209            -name '*.desktop' \
    
      210            -print0 |
    
      211        while IFS= read -r -d '' desktop_file; do
    
      212            if grep -qi 'opera' "$desktop_file"; then
    
      213                sed -i \
    
      214                    -e 's|^Exec=.*|Exec=opera-developer %U|' \
    
      215                    -e 's|^TryExec=.*|TryExec=opera-developer|' \
    
      216                    "$desktop_file"
    
      217            fi
    
      218        done
    
      219    fi
    
      220
    
      221
    
      222# License
    
      223
    
      224    local copyright_file
    
      225
    
      226    copyright_file="$(find "$pkgdir/usr/share/doc" \
    
      227        -type f \
    
      228        -name copyright \
    
      229        | head -n1)"
    
      230
    
      231    if [[ -n "$copyright_file" ]]; then
    
      232        install -Dm644 "$copyright_file" \
    
      233            "$pkgdir/usr/share/licenses/$pkgname/copyright"
    
      234    fi
    
      235}
    
      236

Changes since previous scan

--- PKGBUILD @ 2026-09-12 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Maintainer: MojArch
 
 pkgname=opera-developer
-pkgver=137.0.6010.1
+pkgver=137.0.6015.0
 pkgrel=1
 pkgdesc='Fast, secure, easy-to-use web browser (Developer Stream)'
 arch=('x86_64')
@@ -71,7 +71,7 @@
     "nwjs-ffmpeg-${_ffmpeg_zip}::https://github.com/nwjs-ffmpeg-prebuilt/nwjs-ffmpeg-prebuilt/releases/download/${_nwjs_ffmpeg_version}/${_ffmpeg_zip}"
 )
 
-sha256sums=('06739eac180d730f67c715fb6c1b575c29c0cede04dbae47c1865414733fd6f0'
+sha256sums=('238ea996dc3ed283ffbd390022dd22c840aa1e0a871b172bc94f55f78e6b026f'
             '508512464e24126fddfb2c41a1e2e86624bdb0c0748084b6a922573b6cf6b9c5'
             '99fc0d2822edd14e234d451995db47148125e4580221a292598959421d131231'
             '589fc1fa3f9905fe336990a2c8e16a9107c1aabdb42031b69eaf812331e5fb4a')

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 05:10:45	Medium	1
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 11:14:32	Medium	1
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2