seamonkey

LOW

maintainer Exorcism 9 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The package downloads Python 3.11.10 source from python.org, a legitimate and expected host for that dependency, despite the static analyzer flagging it as non-standard; this is a normal build dependency and not a supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads Python 3.11.10 source from python.org, a legitimate and expected host for that dependency, despite the static analyzer flagging it as non-standard; this is a normal build dependency and not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:69 "https://archive.seamonkey-project.org/releases/$pkgver/source/seamonkey-$pkgver.source.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Michał Wojdyła < micwoj9292 at gmail dot com >
    
      2# Contributor: Carl Smedstad <carl.smedstad at protonmail dot com>
    
      3# Contributor: Kyle Keen <keenerd@gmail.com>
    
      4
    
      5pkgname=seamonkey
    
      6pkgver=2.53.24
    
      7pkgrel=1
    
      8pkgdesc="Web-browser, advanced e-mail, newsgroup and feed client, IRC chat, and HTML editing made simple"
    
      9arch=(x86_64)
    
      10url="https://www.seamonkey-project.org"
    
      11license=(MPL-2.0)
    
      12depends=(
    
      13  at-spi2-core
    
      14  bash
    
      15  cairo
    
      16  dbus
    
      17  dbus-glib
    
      18  fontconfig
    
      19  freetype2
    
      20  gcc-libs
    
      21  gdk-pixbuf2
    
      22  glib2
    
      23  glibc
    
      24  gtk3
    
      25  hunspell
    
      26  libevent
    
      27  libffi
    
      28  libpulse
    
      29  libvpx
    
      30  libx11
    
      31  libxcb
    
      32  libxcomposite
    
      33  libxdamage
    
      34  libxext
    
      35  libxfixes
    
      36  libxrender
    
      37  libxt
    
      38  mime-types
    
      39  nspr
    
      40  nss
    
      41  pango
    
      42  pixman
    
      43  sqlite
    
      44  startup-notification
    
      45  zlib
    
      46)
    
      47makedepends=(
    
      48#  cargo
    
      49  rustup
    
      50  cbindgen
    
      51  clang
    
      52  imake
    
      53  llvm
    
      54  mesa
    
      55  nasm
    
      56#  python, fails with python 3.12
    
      57  unzip
    
      58  yasm
    
      59  zip
    
      60)
    
      61optdepends=(
    
      62  'libnotify: Notification integration'
    
      63  'networkmanager: Location detection via available WiFi networks'
    
      64  'pulseaudio: Audio support'
    
      65)
    
      66install="$pkgname.install"
    
      67options=(!lto)
    
      68source=(
    
      69  "https://archive.seamonkey-project.org/releases/$pkgver/source/seamonkey-$pkgver.source.tar.xz"
    
      70  "mozconfig"
    
      71  https://www.python.org/ftp/python/3.11.10/Python-3.11.10.tar.xz{,.asc}
    
      72)
    
      73validpgpkeys=('A035C8C19219BA821ECEA86B64E628F8D684696D')  # Pablo Galindo Salgado <pablogsal@gmail.com>
    
      74sha256sums=(
    
      75  '52907d9241643c0c0c1ab05ea261b063b37d9fc49f16181a6a038b8ec6e4b6bc'
    
      76  '2858ea3b53a79d5f7c18d301932ac2cd709b86255312fcdfe6c4935ca33f5823'
    
      77  '07a4356e912900e61a15cb0949a06c4a05012e213ecd6b4e84d0f67aabbee372'
    
      78  'SKIP'
    
      79)
    
      80
    
      81# Google API keys (see http://www.chromium.org/developers/how-tos/api-keys)
    
      82# Note: These are for Arch Linux use ONLY. For your own distribution, please
    
      83# get your own set of keys. Feel free to contact foutrelis@archlinux.org for
    
      84# more information.
    
      85_google_api_key=AIzaSyDwr302FpOSkGRpLlUpPThNTDPbXcIn_FM
    
      86
    
      87# Mozilla API keys (see https://location.services.mozilla.com/api)
    
      88# Note: These are for Arch Linux use ONLY. For your own distribution, please
    
      89# get your own set of keys. Feel free to contact heftig@archlinux.org for
    
      90# more information.
    
      91_mozilla_api_key=e05d56db0a694edc8b5aaebda3f2db6a
    
      92
    
      93_archive="$pkgname-$pkgver"
    
      94
    
      95prepare() {
    
      96  # packed_simd no longer builds with 1.78.0
    
      97  # https://github.com/rust-lang/packed_simd/issues/360
    
      98  rustup toolchain update --profile minimal 1.77.2
    
      99  rustup default 1.77.2
    
      100
    
      101  cd "$_archive"
    
      102
    
      103  cp "$srcdir/mozconfig" .mozconfig
    
      104
    
      105  echo -n "$_google_api_key" > google-api-key
    
      106  echo -n "$_mozilla_api_key" > mozilla-api-key
    
      107
    
      108  {
    
      109    echo "ac_add_options --with-google-location-service-api-keyfile=${PWD@Q}/google-api-key"
    
      110    echo "ac_add_options --with-google-safebrowsing-api-keyfile=${PWD@Q}/google-api-key"
    
      111    echo "ac_add_options --with-mozilla-api-keyfile=${PWD@Q}/mozilla-api-key"
    
      112  } >> .mozconfig
    
      113}
    
      114
    
      115build() {
    
      116  cd Python-3.11.10
    
      117  ./configure
    
      118  make
    
      119  make DESTDIR="$srcdir/pythoninstall" install
    
      120  cd ..
    
      121  PATH="$PWD/pythoninstall/usr/local/bin:$PATH"
    
      122
    
      123  cd "$_archive"
    
      124
    
      125  # Don't use mold - fails.
    
      126  LDFLAGS=$(printf '%s' "$LDFLAGS" | sed 's/-fuse-ld=[^[:space:]]*//')
    
      127  export LDFLAGS
    
      128  export MACH_USE_SYSTEM_PYTHON=1
    
      129  export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
    
      130  # Fix build on non utf-8 charsets
    
      131  LC_ALL=C.UTF-8 \
    
      132  ./mach build
    
      133}
    
      134
    
      135package() {
    
      136  cd "$_archive"
    
      137
    
      138  # shellcheck disable=SC1007
    
      139  LC_ALL=C.UTF-8 DESTDIR="$pkgdir" INSTALL_SDK= ./mach install
    
      140
    
      141  rm -rf "$pkgdir"/usr/lib/seamonkey/{dictionaries,hyphenation}
    
      142  ln -s /usr/share/hunspell "$pkgdir/usr/lib/seamonkey/dictionaries"
    
      143  ln -s /usr/share/hyphen "$pkgdir/usr/lib/seamonkey/hyphenation"
    
      144
    
      145  install -Dm644 comm/suite/branding/seamonkey/default128.png \
    
      146    "$pkgdir/usr/share/pixmaps/seamonkey.png"
    
      147
    
      148  install -Dm644 toolkit/mozapps/installer/linux/rpm/mozilla.desktop \
    
      149    "$pkgdir/usr/share/applications/seamonkey.desktop"
    
      150  sed -i 's/@MOZ_APP_DISPLAYNAME@/SeaMonkey internet suite/' \
    
      151    "$pkgdir/usr/share/applications/seamonkey.desktop"
    
      152  sed -i 's/@MOZ_APP_NAME@/seamonkey/' "$pkgdir/usr/share/applications/seamonkey.desktop"
    
      153}
    
      154

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2