palemoon-gtk3-bin
LOW
maintainer xiota
6 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt binary from the project's official release infrastructure (palemoon.org), which is a trusted source; the non-standard host is part of the project's own domain, and the binary is verified via PGP signature, making this a standard and safe AUR packaging practice.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the project's official release infrastructure (palemoon.org), which is a trusted source; the non-standard host is part of the project's own domain, and the binary is verified via PGP signature, making this a standard and safe AUR packaging practice.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:31
"palemoon-$pkgver.desktop"::"https://repo.palemoon.org/MoonchildProductions/Pale-Moon/raw/tag/${pkgver}_Release/palemoon/branding/official/palemoon.desktop" -
PKGBUILD:32
"https://rm-eu.palemoon.org/release/palemoon-${pkgver}.linux-x86_64-gtk3.tar.xz"{,.sig}
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: aur.chaotic.cx
2
# Contributor: Michal Wojdyla < micwoj9292 at gmail dot com >
3
# Contributor: Bernhard Landauer <oberon@manjaro.org>
4
# Contributor: WorMzy Tykashi <wormzy.tykashi@gmail.com>
5
# Contributor: korrode <korrode at gmail>
6
# Contributor: sumt <sumt at sci dot fi>
7
8
_pkgname="palemoon"
9
pkgname="$_pkgname-gtk3-bin"
10
epoch=1
11
pkgver=35.0.3
12
pkgrel=1
13
pkgdesc="Open source web browser based on Firefox focusing on efficiency"
14
url="https://www.palemoon.org/"
15
license=('MPL-2.0')
16
arch=('x86_64')
17
18
depends=(
19
'gtk3'
20
)
21
optdepends=(
22
'ffmpeg: record, convert, and stream audio and video'
23
)
24
25
provides=("$_pkgname")
26
conflicts=("$_pkgname")
27
28
options=('!strip')
29
30
source=(
31
"palemoon-$pkgver.desktop"::"https://repo.palemoon.org/MoonchildProductions/Pale-Moon/raw/tag/${pkgver}_Release/palemoon/branding/official/palemoon.desktop"
32
"https://rm-eu.palemoon.org/release/palemoon-${pkgver}.linux-x86_64-gtk3.tar.xz"{,.sig}
33
)
34
sha256sums=('b3803b30b5e6b9589387b7162cd24247da242fe77c0aed0d09bc51338d36d7d8'
35
'3bc53225ee934a59bc3b6817fa20f4b1b87506275aa656ae15b2222e42de7ea4'
36
'SKIP')
37
validpgpkeys=(
38
'439F46F42C6AE3D23CF52E70865E6C87C65285EC' # T. Wine
39
'3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC' # Moonchild, see https://forum.palemoon.org/viewtopic.php?f=1&t=7176
40
)
41
42
package() {
43
mkdir -pm755 "$pkgdir"/usr/{bin,lib}
44
cp -r palemoon/ "$pkgdir/usr/lib/palemoon"
45
ln -s ../lib/palemoon/palemoon "$pkgdir/usr/bin/palemoon"
46
47
install -Dm644 "palemoon-$pkgver.desktop" "$pkgdir/usr/share/applications/palemoon.desktop"
48
49
local _hicolor="$pkgdir/usr/share/icons/hicolor"
50
install -Dm644 palemoon/browser/chrome/icons/default/default16.png "$_hicolor/16x16/apps/palemoon.png"
51
install -Dm644 palemoon/browser/chrome/icons/default/default32.png "$_hicolor/32x32/apps/palemoon.png"
52
install -Dm644 palemoon/browser/chrome/icons/default/default48.png "$_hicolor/48x48/apps/palemoon.png"
53
install -Dm644 palemoon/browser/icons/mozicon128.png "$_hicolor/128x128/apps/palemoon.png"
54
}
55
Changes since previous scan
--- PKGBUILD @ 2026-10-27 00:23+++ PKGBUILD @ 2026-11-01 00:21@@ -8,7 +8,7 @@ _pkgname="palemoon" pkgname="$_pkgname-gtk3-bin" epoch=1-pkgver=35.0.2+pkgver=35.0.3 pkgrel=1 pkgdesc="Open source web browser based on Firefox focusing on efficiency" url="https://www.palemoon.org/"@@ -31,11 +31,9 @@ "palemoon-$pkgver.desktop"::"https://repo.palemoon.org/MoonchildProductions/Pale-Moon/raw/tag/${pkgver}_Release/palemoon/branding/official/palemoon.desktop" "https://rm-eu.palemoon.org/release/palemoon-${pkgver}.linux-x86_64-gtk3.tar.xz"{,.sig} )-sha256sums=(- 'b3803b30b5e6b9589387b7162cd24247da242fe77c0aed0d09bc51338d36d7d8'- '3136ee8ecde1c1f865d45c3f5015f07e27e590ae0b43c22f1811f65633547adb'- 'SKIP'-)+sha256sums=('b3803b30b5e6b9589387b7162cd24247da242fe77c0aed0d09bc51338d36d7d8'+ '3bc53225ee934a59bc3b6817fa20f4b1b87506275aa656ae15b2222e42de7ea4'+ 'SKIP') validpgpkeys=( '439F46F42C6AE3D23CF52E70865E6C87C65285EC' # T. Wine '3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC' # Moonchild, see https://forum.palemoon.org/viewtopic.php?f=1&t=7176Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 15:48:05 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 23:21:11 | Medium | 1 |