terminal-browser-bin

MEDIUM

maintainer lugas7 1 votes scanned 2026-08-20 15:13:39.569449

View on AUR

Why flagged

Prebuilt binary tarballs are downloaded from the project's own domain (terminal-browser.sh), which is a personal/project site rather than established infrastructure; checksums are provided so integrity is verifiable, but the host is a single-operator domain where tarballs could be silently swapped, and the package has few votes/is recently uploaded, making this a moderate supply-chain risk for a prebuilt executable.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("https://terminal-browser.sh/install/dl/stable/v${pkgver}/terminal-browser-linux-x64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt binary tarballs are downloaded from the project's own domain (terminal-browser.sh), which is a personal/project site rather than established infrastructure; checksums are provided so integrity is verifiable, but the host is a single-operator domain where tarballs could be silently swapped, and the package has few votes/is recently uploaded, making this a moderate supply-chain risk for a prebuilt executable.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lugas7
    
      2_pkgname=terminal-browser
    
      3pkgname=terminal-browser-bin
    
      4pkgver=0.5.8
    
      5pkgrel=1
    
      6pkgdesc="A browser that runs directly inside your existing terminal"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://terminal-browser.sh"
    
      9license=('MIT')
    
      10depends=('nss' 'gtk3' 'alsa-lib' 'mesa')
    
      11provides=("$_pkgname=$pkgver")
    
      12conflicts=("$_pkgname")
    
      13
    
      14source=("LICENSE-${pkgname}::https://raw.githubusercontent.com/zenbu-labs/terminal-browser/v${pkgver}/LICENSE")
    
      15sha256sums=('SKIP')
    
      16
    
      17source_x86_64=("https://terminal-browser.sh/install/dl/stable/v${pkgver}/terminal-browser-linux-x64.tar.gz")
    
      18sha256sums_x86_64=('c330be3341ef6f6cb106e4fb32c1d60754a08e1a7641143a7a6a4d9e9448f617')
    
      19
    
      20source_aarch64=("https://terminal-browser.sh/install/dl/stable/v${pkgver}/terminal-browser-linux-arm64.tar.gz")
    
      21sha256sums_aarch64=('9ffe7fc1f2a309ed0be48c2f35fba534f38163d64c22c0c7dc539949d4f19e71')
    
      22
    
      23noextract=("terminal-browser-linux-x64.tar.gz" "terminal-browser-linux-arm64.tar.gz")
    
      24
    
      25package() {
    
      26  install -Dm644 "${srcdir}/LICENSE-${pkgname}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      27
    
      28  install -d "${pkgdir}/opt/terminal-browser"
    
      29
    
      30  if [ "${CARCH}" = "x86_64" ]; then
    
      31    tar -xzf "${srcdir}/terminal-browser-linux-x64.tar.gz" -C "${pkgdir}/opt/terminal-browser" --strip-components 1
    
      32  elif [ "${CARCH}" = "aarch64" ]; then
    
      33    tar -xzf "${srcdir}/terminal-browser-linux-arm64.tar.gz" -C "${pkgdir}/opt/terminal-browser" --strip-components 1
    
      34  fi
    
      35
    
      36  install -d "${pkgdir}/usr/bin"
    
      37  cat >"${pkgdir}/usr/bin/terminal-browser" <<EOF
    
      38#!/bin/sh
    
      39exec /opt/terminal-browser/bin/terminal-browser "\$@"
    
      40EOF
    
      41  chmod 755 "${pkgdir}/usr/bin/terminal-browser"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 15:13:39	Medium	3
2026-08-20 15:11:35	Medium	2