parcel-firefox

LOW

maintainer alexei 0 votes scanned 2026-08-22 13:17:31.911498

View on AUR

Why flagged

The package installs a prebuilt Firefox extension (XPI) from addons.mozilla.org, which is a legitimate source, but the download host is not whitelisted and the XPI is not built from source due to Mozilla's signing requirement; however, it is a common and expected practice for browser extensions, and the installed files are passive data bundles, not executable code run outside the browser sandbox.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt Firefox extension (XPI) from addons.mozilla.org, which is a legitimate source, but the download host is not whitelisted and the XPI is not built from source due to Mozilla's signing requirement; however, it is a common and expected practice for browser extensions, and the installed files are passive data bundles, not executable code run outside the browser sandbox.

PKGBUILD

      1# Maintainer: Alexei Colin <ac at alexeicolin dot com>
    
      2# Contributor: Maxim Baz <archlinux at maximbaz dot com>
    
      3
    
      4# ID copied from extension installed via Firefox add-on repository
    
      5_id=parcel@erayd.net
    
      6_name="parcel_pm"
    
      7
    
      8pkgname=parcel-firefox
    
      9pkgver=1.0.6
    
      10pkgrel=1
    
      11pkgdesc="Firefox browser extension for zx2c4's pass password manager"
    
      12arch=('any')
    
      13url="https://github.com/parcel-pm/parcel"
    
      14license=('ISC')
    
      15depends=('parcel')
    
      16makedepends=()
    
      17optdepends=("pass: password manager to manage the password store")
    
      18# Can't build the extension from source, because needs to be signed by Mozilla.
    
      19source=("https://addons.mozilla.org/firefox/downloads/file/4967434/${_name}-${pkgver}.xpi")
    
      20sha256sums=('903de04a99a39f871d4ad5e82ef23b5cc1f6b740421a37ef773e6b47cad1eaba')
    
      21validpgpkeys=('82ED663067C6017BAA4BC752EB670BF2B1131683'
    
      22              'B0908ED59A96C9882BED9A942A51761511A30253'
    
      23              '88FF14D6294AF4036B7F00FF676A3C09E2E47A72'
    
      24              '56C3E775E72B0C8B1C0C1BD0B5DB77409B11B601')
    
      25
    
      26package() {
    
      27    install -Dm644 "${_name}-${pkgver}.xpi" "${pkgdir}/usr/lib/firefox/browser/extensions/${_id}.xpi"
    
      28
    
      29    # Link to json manifest file installed by parcel package
    
      30    local _nmh_dir="/usr/lib/mozilla/native-messaging-hosts"
    
      31    install -dm755 "${pkgdir}${_nmh_dir}"
    
      32    ln -sf "/usr/lib/parcel/hosts/firefox/com.github.erayd.parcel.json" "${pkgdir}${_nmh_dir}"
    
      33}
    
      34
    
      35# vim:set ts=4 sw=4 et:
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-22 13:17:31	Low	2