orion-beta

maintainer nvidiahater · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Downloads and installs a prebuilt proprietary binary (flatpak containing oriongtk executable and private shared libraries) from orionbrowser.com, which while plausibly the project's official domain is not a well-established vendor infrastructure; the binary is executed directly after extraction with patchelf rpath manipulation, and the package has few votes/is recently uploaded, making supply-chain substitution a realistic concern — though the sha256 checksum does provide some integrity guarantee.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "oriongtk.${pkgver}.flatpak::https://orionbrowser.com/download/oriongtk.${pkgver}.flatpak"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and installs a prebuilt proprietary binary (flatpak containing oriongtk executable and private shared libraries) from orionbrowser.com, which while plausibly the project's official domain is not a well-established vendor infrastructure; the binary is executed directly after extraction with patchelf rpath manipulation, and the package has few votes/is recently uploaded, making supply-chain substitution a realistic concern — though the sha256 checksum does provide some integrity guarantee.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=orion-beta
    
      2pkgver=0.3.0
    
      3pkgrel=1
    
      4pkgdesc="Orion Beta web browser using native Arch Linux libraries"
    
      5arch=('x86_64')
    
      6url="https://kagi.com/orion/"
    
      7license=('LicenseRef-proprietary')
    
      8depends=(
    
      9  'bzip2'
    
      10  'cairo'
    
      11  'curl'
    
      12  'gcc-libs'
    
      13  'gdk-pixbuf2'
    
      14  'glib2'
    
      15  'glibc'
    
      16  'graphene'
    
      17  'gtk4'
    
      18  'harfbuzz'
    
      19  'libadwaita'
    
      20  'libsecret'
    
      21  'libsoup3'
    
      22  'pango'
    
      23  'vulkan-icd-loader'
    
      24  'webkitgtk-6.0'
    
      25  'xz'
    
      26)
    
      27makedepends=('ostree' 'patchelf')
    
      28provides=("orion-browser=${pkgver}")
    
      29options=('!debug')
    
      30source=(
    
      31  "oriongtk.${pkgver}.flatpak::https://orionbrowser.com/download/oriongtk.${pkgver}.flatpak"
    
      32  'LICENSE'
    
      33)
    
      34noextract=("oriongtk.${pkgver}.flatpak")
    
      35sha256sums=(
    
      36  'd0d3963d2d98bf93699d3c6ab2232fb211c5c93c83a2d3e2f7ae3fda883f6c2c'
    
      37  '18fd7c419da08efe8ef55acb05f411704ee6b4622879a98209416eb4b9f49e40'
    
      38)
    
      39
    
      40_commit='e75518d4754e0b72d3e99906cb00b8eb8d2d8d7177e587c1c19250bc421beb5c'
    
      41
    
      42prepare() {
    
      43  ostree --repo=orion-repo init --mode=bare-user-only
    
      44  ostree --repo=orion-repo static-delta apply-offline "oriongtk.${pkgver}.flatpak"
    
      45  ostree --repo=orion-repo checkout --user-mode --union "${_commit}" orion-flatpak
    
      46}
    
      47
    
      48check() {
    
      49  local appdir="${srcdir}/orion-flatpak/files"
    
      50  local libdir="${srcdir}/orion-native-libs"
    
      51
    
      52  mkdir -p "${libdir}"
    
      53  ln -sf "${appdir}/lib64/liborion_common.so" "${libdir}/liborion_common.so"
    
      54  ln -sf "${appdir}/lib64/liborion_core.so" "${libdir}/liborion_core.so"
    
      55  ln -sf "${appdir}/lib64/liborion_sync.so" "${libdir}/liborion_sync.so"
    
      56
    
      57  LD_LIBRARY_PATH="${libdir}" ldd -r "${appdir}/bin/oriongtk" > orion-ldd.log
    
      58  if grep -Eq 'not found|undefined symbol' orion-ldd.log; then
    
      59    cat orion-ldd.log
    
      60    return 1
    
      61  fi
    
      62  if ! grep -q 'libwebkitgtk-6.0.so.4 => /usr/lib/' orion-ldd.log || ! grep -q 'libjavascriptcoregtk-6.0.so.1 => /usr/lib/' orion-ldd.log; then
    
      63    cat orion-ldd.log
    
      64    error "Orion did not resolve against Arch's native WebKitGTK libraries"
    
      65    return 1
    
      66  fi
    
      67}
    
      68
    
      69package() {
    
      70  local appdir="${srcdir}/orion-flatpak/files"
    
      71  local lib
    
      72  local size
    
      73
    
      74  install -Dm755 "${appdir}/bin/oriongtk" "${pkgdir}/usr/bin/orion-beta"
    
      75  for lib in liborion_common.so liborion_core.so liborion_sync.so; do
    
      76    install -Dm755 "${appdir}/lib64/${lib}" "${pkgdir}/usr/lib/orion-beta/${lib}"
    
      77  done
    
      78  patchelf --set-rpath '$ORIGIN/../lib/orion-beta' "${pkgdir}/usr/bin/orion-beta"
    
      79  for lib in liborion_common.so liborion_core.so liborion_sync.so; do
    
      80    patchelf --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/orion-beta/${lib}"
    
      81  done
    
      82  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      83
    
      84  install -Dm644 "${appdir}/share/applications/com.kagi.OrionGtk.desktop" "${pkgdir}/usr/share/applications/com.kagi.OrionGtk.desktop"
    
      85  sed -i 's/^Exec=.*/Exec=orion-beta/' "${pkgdir}/usr/share/applications/com.kagi.OrionGtk.desktop"
    
      86
    
      87  install -Dm644 "${appdir}/share/metainfo/com.kagi.OrionGtk.metainfo.xml" "${pkgdir}/usr/share/metainfo/com.kagi.OrionGtk.metainfo.xml"
    
      88  sed -i -e 's#<project_license>Commercial - Third party EULA</project_license>#<project_license>LicenseRef-proprietary</project_license>#' -e '0,/<screenshot>/{s/<screenshot>/<screenshot type="default">/}' "${pkgdir}/usr/share/metainfo/com.kagi.OrionGtk.metainfo.xml"
    
      89
    
      90  for size in 16 32 64 128 256; do
    
      91    install -Dm644 "${appdir}/share/icons/hicolor/${size}x${size}/apps/com.kagi.OrionGtk.png" "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/com.kagi.OrionGtk.png"
    
      92  done
    
      93}
    
      94

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 15:35:22	MEDIUM	3
2026-07-26 15:32:35	MEDIUM	3