orion-beta
LOW
maintainer nvidiahater
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The base64-decoded GPG key is used to verify Flatpak repository integrity via ostree, a standard and safe practice; no obfuscated payload or remote code execution occurs.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The base64-decoded GPG key is used to verify Flatpak repository integrity via ostree, a standard and safe practice; no obfuscated payload or remote code execution occurs.
-
PKGBUILD:37
_gpg_key='mDMEamlrPhYJKwYBBAHaRw8BAQdANemX0KA6cJmoaM6thz/NxXp2Sk4pmPSNQ0qqgFnnggy0LE9yaW9uIEJ1aWxkIFNpZ25pbmcgPGFkbWluQG9yaW9uYnJvd3Nlci5jb20+iJMEExYKADsWIQTQVPD7wkF2gvzpj+lP9wc8h8uRqgUCamlrPgIbAwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRBP9wc8h8uRqnJSAQDjw2IwmD9Z/3EeWCjT9Wl43YXpK30mFC5cjFOLkRWWeAEAnBlLdTZFkaiuDSYy0ZMDyXFaMSnALyxiH09uX5167QG4OARqaWs+EgorBgEEAZdVAQUBAQdAF1JbWnW9U+TeeInPoMyybh7Mx59GdRZw93zQ33craR4DAQgHiHgEGBYKACAWIQTQVPD7wkF2gvzpj+lP9wc8h8uRqgUCamlrPgIbDAAKCRBP9wc8h8uRqovDAQC3LZfMfxsQ6zLrBVK0JCr7lxVhRqEtdS2fjZ8aOpiHEwD+NA7VEQcmDK42BSNRvtKYibPXJwmI6o2NYKoye3Soqgs='
PKGBUILD
1 offending line(s) highlighted
1
pkgname=orion-beta
2
pkgver=0.4.2
3
pkgrel=1
4
pkgdesc="Orion Beta web browser using native Arch Linux libraries"
5
arch=('x86_64')
6
url="https://kagi.com/orion/"
7
license=('LicenseRef-proprietary')
8
depends=(
9
'bzip2'
10
'cairo'
11
'curl'
12
'gcc-libs'
13
'gdk-pixbuf2'
14
'glib2'
15
'glibc'
16
'graphene'
17
'gtk4'
18
'harfbuzz'
19
'libadwaita'
20
'libsecret'
21
'libsoup3'
22
'openssl'
23
'pango'
24
'vulkan-icd-loader'
25
'webkitgtk-6.0'
26
'xz'
27
)
28
makedepends=('ostree' 'patchelf')
29
provides=("orion-browser=${pkgver}")
30
options=('!debug')
31
source=(
32
'LICENSE'
33
)
34
sha256sums=('18fd7c419da08efe8ef55acb05f411704ee6b4622879a98209416eb4b9f49e40')
35
36
_repo_url='https://flatpak.orionbrowser.com/repo/beta/'
37
_gpg_key='mDMEamlrPhYJKwYBBAHaRw8BAQdANemX0KA6cJmoaM6thz/NxXp2Sk4pmPSNQ0qqgFnnggy0LE9yaW9uIEJ1aWxkIFNpZ25pbmcgPGFkbWluQG9yaW9uYnJvd3Nlci5jb20+iJMEExYKADsWIQTQVPD7wkF2gvzpj+lP9wc8h8uRqgUCamlrPgIbAwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRBP9wc8h8uRqnJSAQDjw2IwmD9Z/3EeWCjT9Wl43YXpK30mFC5cjFOLkRWWeAEAnBlLdTZFkaiuDSYy0ZMDyXFaMSnALyxiH09uX5167QG4OARqaWs+EgorBgEEAZdVAQUBAQdAF1JbWnW9U+TeeInPoMyybh7Mx59GdRZw93zQ33craR4DAQgHiHgEGBYKACAWIQTQVPD7wkF2gvzpj+lP9wc8h8uRqgUCamlrPgIbDAAKCRBP9wc8h8uRqovDAQC3LZfMfxsQ6zLrBVK0JCr7lxVhRqEtdS2fjZ8aOpiHEwD+NA7VEQcmDK42BSNRvtKYibPXJwmI6o2NYKoye3Soqgs='
38
39
prepare() {
40
local repo="${srcdir}/orion-repo"
41
42
ostree --repo="${repo}" init --mode=bare-user-only
43
ostree --repo="${repo}" remote add --if-not-exists orion-beta "${_repo_url}"
44
printf '%s' "${_gpg_key}" | base64 --decode | \
45
ostree --repo="${repo}" remote gpg-import --stdin orion-beta
46
ostree --repo="${repo}" pull orion-beta app/com.kagi.Orion/x86_64/beta
47
ostree --repo="${repo}" checkout --user-mode --union \
48
orion-beta:app/com.kagi.Orion/x86_64/beta orion-flatpak
49
}
50
51
check() {
52
local appdir="${srcdir}/orion-flatpak/files"
53
local libdir="${srcdir}/orion-native-libs"
54
55
mkdir -p "${libdir}"
56
local lib
57
for lib in liborion_common.so liborion_core.so liborion_net.so liborion_sync.so; do
58
ln -sf "${appdir}/lib64/${lib}" "${libdir}/${lib}"
59
done
60
61
LD_LIBRARY_PATH="${libdir}" ldd -r "${appdir}/bin/oriongtk" > orion-ldd.log
62
if grep -Eq 'not found|undefined symbol' orion-ldd.log; then
63
cat orion-ldd.log
64
return 1
65
fi
66
if ! grep -q 'libwebkitgtk-6.0.so.4 => /usr/lib/' orion-ldd.log || ! grep -q 'libjavascriptcoregtk-6.0.so.1 => /usr/lib/' orion-ldd.log; then
67
cat orion-ldd.log
68
error "Orion did not resolve against Arch's native WebKitGTK libraries"
69
return 1
70
fi
71
}
72
73
package() {
74
local appdir="${srcdir}/orion-flatpak/files"
75
local lib
76
local size
77
78
install -Dm755 "${appdir}/bin/oriongtk" "${pkgdir}/usr/bin/orion-beta"
79
for lib in liborion_common.so liborion_core.so liborion_net.so liborion_sync.so; do
80
install -Dm755 "${appdir}/lib64/${lib}" "${pkgdir}/usr/lib/orion-beta/${lib}"
81
done
82
patchelf --set-rpath '$ORIGIN/../lib/orion-beta' "${pkgdir}/usr/bin/orion-beta"
83
for lib in liborion_common.so liborion_core.so liborion_net.so liborion_sync.so; do
84
patchelf --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/orion-beta/${lib}"
85
done
86
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
87
88
install -Dm644 "${appdir}/share/applications/com.kagi.Orion.desktop" "${pkgdir}/usr/share/applications/com.kagi.Orion.desktop"
89
sed -i 's/^Exec=.*/Exec=orion-beta/' "${pkgdir}/usr/share/applications/com.kagi.Orion.desktop"
90
91
install -Dm644 "${appdir}/share/metainfo/com.kagi.Orion.metainfo.xml" "${pkgdir}/usr/share/metainfo/com.kagi.Orion.metainfo.xml"
92
sed -i \
93
-e 's#<project_license>Commercial - Third party EULA</project_license>#<project_license>LicenseRef-proprietary</project_license>#' \
94
-e '/^ <ul>$/d' \
95
-e '/^ <\/ul>$/d' \
96
"${pkgdir}/usr/share/metainfo/com.kagi.Orion.metainfo.xml"
97
98
for size in 16 32 64 128 256; do
99
install -Dm644 "${appdir}/share/icons/hicolor/${size}x${size}/apps/com.kagi.Orion.png" "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/com.kagi.Orion.png"
100
done
101
}
102
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 1 |
| 2026-09-16 00:03:17 | Low | 1 |
| 2026-09-15 00:25:31 | Low | 1 |
| 2026-09-14 00:27:57 | Low | 1 |
| 2026-09-13 00:19:54 | Low | 1 |
| 2026-09-12 00:25:17 | Low | 1 |
| 2026-09-11 00:19:22 | Low | 1 |
| 2026-09-10 00:22:44 | Low | 1 |
| 2026-09-09 00:04:09 | Low | 1 |
| 2026-09-08 00:18:08 | Low | 1 |
| 2026-09-07 00:30:15 | Low | 1 |
| 2026-09-06 00:17:06 | Low | 1 |
| 2026-09-05 05:59:21 | Low | 1 |
| 2026-09-05 00:16:27 | Low | 1 |
| 2026-09-04 00:03:13 | Low | 1 |
| 2026-09-03 00:15:47 | Low | 1 |
| 2026-09-02 00:02:31 | Low | 1 |
| 2026-09-01 00:11:19 | Low | 1 |
| 2026-08-31 00:19:57 | Low | 1 |
| 2026-08-30 00:04:14 | Low | 1 |