parcel-chromium

LOW

maintainer alexei 0 votes scanned 2026-08-22 13:17:31.911498

View on AUR

Why flagged

The package installs a prebuilt .crx extension from the project's own GitHub releases, which is normal for browser extensions requiring Google signing; it includes PGP verification and only affects Chromium's extension system, posing low risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt .crx extension from the project's own GitHub releases, which is normal for browser extensions requiring Google signing; it includes PGP verification and only affects Chromium's extension system, posing low risk.

PKGBUILD

      1# Maintainer: Alexei Colin <ac at alexeicolin dot com>
    
      2# Contributor: Maxim Baz <archlinux at maximbaz dot com>
    
      3
    
      4# ID copied from URL of the extension in the Chrome Web Store
    
      5_id=ciifpadakeohfnnneflckhojbldkkllp
    
      6
    
      7pkgname=parcel-chromium
    
      8pkgver=1.0.6
    
      9pkgrel=1
    
      10pkgdesc="Chromium browser extension for zx2c4's pass (password manager)"
    
      11arch=('any')
    
      12url="https://github.com/parcel-pm/parcel"
    
      13license=('ISC')
    
      14depends=('parcel')
    
      15# Can't build the extension from source, because needs to be signed by Google.
    
      16source=("${pkgname}-${pkgver}.crx::${url}/releases/download/v${pkgver}/parcel-chrome-${pkgver}.crx"
    
      17        "${pkgname}-${pkgver}.crx.asc::${url}/releases/download/v${pkgver}/parcel-chrome-${pkgver}.crx.asc")
    
      18noextract=("${pkgname}-${pkgver}.crx")
    
      19sha256sums=('267c6e3a50a8cea9add8caf9006e38b0e3ec847cdf52e4e58d60d772318df8d3'
    
      20            'SKIP')
    
      21validpgpkeys=('82ED663067C6017BAA4BC752EB670BF2B1131683'
    
      22              'B0908ED59A96C9882BED9A942A51761511A30253'
    
      23              '88FF14D6294AF4036B7F00FF676A3C09E2E47A72'
    
      24              '56C3E775E72B0C8B1C0C1BD0B5DB77409B11B601')
    
      25
    
      26prepare() {
    
      27    # Create extension json
    
      28    cat << EOF > "${_id}".json
    
      29{
    
      30    "external_crx": "/usr/lib/${pkgname}/${pkgname}-${pkgver}.crx",
    
      31    "external_version": "${pkgver}"
    
      32}
    
      33EOF
    
      34}
    
      35
    
      36package() {
    
      37    install -Dm644 -t "${pkgdir}/usr/share/chromium/extensions/" "${_id}.json"
    
      38    install -Dm644 -t "${pkgdir}/usr/lib/${pkgname}/" "${pkgname}-${pkgver}.crx"
    
      39
    
      40    # Link to json manifest file installed by parcel package
    
      41    local _nmh_dir="/etc/chromium/native-messaging-hosts"
    
      42    install -dm755 "${pkgdir}${_nmh_dir}"
    
      43    ln -sf "/usr/lib/parcel/hosts/chrome/com.github.erayd.parcel.json" "${pkgdir}${_nmh_dir}"
    
      44}
    
      45
    
      46# vim:set ts=4 sw=4 et:
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-22 13:17:31	Low	2