riptide-browser

LOW

maintainer joshzcold 0 votes scanned 2026-10-21 00:12:50.227280

View on AUR

Why flagged

The CEF binary tarball is downloaded from cef-builds.spotifycdn.com (Spotify's official CEF distribution CDN, a well-known legitimate source), has a SHA-1 checksum, and is used only as a build-time dependency to compile the project's own Rust source; the git source has SKIP'd checksum but is pinned to a specific tag from the project's own GitHub repo, which is normal AUR practice for git sources.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The CEF binary tarball is downloaded from cef-builds.spotifycdn.com (Spotify's official CEF distribution CDN, a well-known legitimate source), has a SHA-1 checksum, and is used only as a build-time dependency to compile the project's own Rust source; the git source has SKIP'd checksum but is pinned to a specific tag from the project's own GitHub repo, which is normal AUR practice for git sources.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://cef-builds.spotifycdn.com/cef_binary_${_cef}_linux64_minimal.tar.bz2")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Joshua Cold <joshzcold@gmail.com>
    
      2# riptide-browser: built from the release tag, against the CEF build its cef crate pins.
    
      3# The versions and checksum are updated at each release.
    
      4pkgname=riptide-browser
    
      5pkgver=0.4.0
    
      6pkgrel=1
    
      7_cef=154.0.33+ga03e714+chromium-154.0.8037.94
    
      8pkgdesc="Keyboard-driven web browser with vim-like bindings, built on CEF"
    
      9arch=('x86_64')
    
      10url="https://joshzcold.github.io/riptide/"
    
      11license=('GPL-3.0-or-later')
    
      12depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'gtk3' 'hicolor-icon-theme'
    
      13         'libcups' 'libdrm' 'libxcomposite' 'libxdamage' 'libxkbcommon' 'libxrandr' 'mesa'
    
      14         'nspr' 'nss' 'pango' 'systemd-libs')
    
      15makedepends=('cargo' 'cmake' 'git' 'ninja')
    
      16conflicts=('riptide-browser-bin' 'riptide' 'riptide-bin')
    
      17options=('!strip' '!debug' '!lto')
    
      18source=("riptide::git+https://github.com/joshzcold/riptide.git#tag=v${pkgver}"
    
      19        "https://cef-builds.spotifycdn.com/cef_binary_${_cef}_linux64_minimal.tar.bz2")
    
      20# The CEF index publishes SHA-1 checksums only.
    
      21sha1sums=('SKIP'
    
      22          '9794ecf85ccd4dfcca42bfaac7a7666004f051e8')
    
      23
    
      24prepare() {
    
      25    # Lay CEF out the way the cef-dll-sys build script expects it in CEF_PATH.
    
      26    local dist="cef_binary_${_cef}_linux64_minimal"
    
      27    rm -rf cef
    
      28    mkdir cef
    
      29    cp -a "$dist"/Release/. "$dist"/Resources/. cef/
    
      30    cp -a "$dist"/{CMakeLists.txt,cmake,include,libcef_dll,CREDITS.html} cef/
    
      31    printf '{"type":"minimal","name":"%s.tar.bz2","sha1":"%s"}\n' "$dist" "${sha1sums[1]}" > cef/archive.json
    
      32
    
      33    cd riptide
    
      34    export RUSTUP_TOOLCHAIN=stable
    
      35    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      36}
    
      37
    
      38build() {
    
      39    cd riptide
    
      40    export RUSTUP_TOOLCHAIN=stable
    
      41    export CARGO_TARGET_DIR=target
    
      42    export CEF_PATH="$srcdir/cef"
    
      43    cargo build --frozen --release --bin riptide
    
      44    # Stages the runtime files, as for the release tarball, and unpacks them.
    
      45    scripts/package-linux.sh "$pkgver"
    
      46    tar -xzf "dist/riptide-${pkgver}-linux-x86_64.tar.gz" -C "$srcdir"
    
      47}
    
      48
    
      49package() {
    
      50    cd "riptide-${pkgver}-linux-x86_64" || return 1
    
      51    install -d "$pkgdir/opt/riptide" "$pkgdir/usr/bin"
    
      52    cp -a . "$pkgdir/opt/riptide/"
    
      53    # The sandbox helper must be setuid root when the kernel doesn't allow
    
      54    # unprivileged user namespaces; Arch allows them, so this is a fallback.
    
      55    chmod 4755 "$pkgdir/opt/riptide/chrome-sandbox"
    
      56    ln -s /opt/riptide/riptide "$pkgdir/usr/bin/riptide"
    
      57    install -Dm644 riptide.desktop "$pkgdir/usr/share/applications/riptide.desktop"
    
      58    install -Dm644 riptide.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/riptide.svg"
    
      59    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 00:12:50	Low	3
2026-10-20 23:31:35	Low	3
2026-10-20 23:29:39	Medium	2