thorium-browser-updated

LOW
maintainer brauliobo 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The source is a git checkout from the maintainer's own GitHub fork of Thorium, a Chromium-based browser; building from source is normal for AUR packages, and the flagged non-standard host (github.com) is actually a standard forge, making the risk low despite skipped checksums.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git checkout from the maintainer's own GitHub fork of Thorium, a Chromium-based browser; building from source is normal for AUR packages, and the flagged non-standard host (github.com) is actually a standard forge, making the risk low despite skipped checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:86 "depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Braulio Oliveira <brauliobo@gmail.com>
2
3pkgname=thorium-browser-updated
4pkgver=150.0.7871.124
5pkgrel=1
6pkgdesc="Chromium fork focused on high performance and security, built from source"
7arch=('x86_64')
8url="https://github.com/brauliobo/thorium"
9license=('BSD-3-Clause')
10depends=(
11 'alsa-lib'
12 'at-spi2-core'
13 'cairo'
14 'dbus'
15 'desktop-file-utils'
16 'expat'
17 'glib2'
18 'glibc'
19 'gtk3'
20 'hicolor-icon-theme'
21 'libcups'
22 'libffi'
23 'libgcc'
24 'libgcrypt'
25 'libnotify'
26 'libpulse'
27 'libstdc++'
28 'libva'
29 'libx11'
30 'libxcb'
31 'libxcomposite'
32 'libxdamage'
33 'libxext'
34 'libxfixes'
35 'libxkbcommon'
36 'libxrandr'
37 'libxss'
38 'mesa'
39 'nspr'
40 'nss'
41 'pango'
42 'pciutils'
43 'systemd'
44 'systemd-libs'
45 'ttf-liberation'
46 'xdg-utils'
47 'zlib'
48)
49makedepends=(
50 'clang'
51 'compiler-rt'
52 'git'
53 'gn'
54 'gperf'
55 'java-runtime-headless'
56 'lld'
57 'ninja'
58 'nodejs'
59 'npm'
60 'patchelf'
61 'pipewire'
62 'python'
63 'python-httplib2'
64 'python-pyparsing'
65 'python-six'
66 'qt6-base'
67 'rpm-tools'
68 'rsync'
69 'rust'
70 'rust-bindgen'
71)
72optdepends=(
73 'pipewire: WebRTC desktop sharing under Wayland'
74 'kdialog: support for native dialogs in Plasma'
75 'gtk4: for --gtk-version=4'
76 'qt6-base: Qt support'
77 'org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce'
78 'upower: Battery Status API support'
79)
80provides=('thorium-browser')
81conflicts=('thorium-browser' 'thorium-browser-bin' 'thorium-browser-updated-bin')
82options=('!lto' '!strip' '!debug')
83install="${pkgname}.install"
84source=(
85 "thorium::git+https://github.com/brauliobo/thorium.git#commit=1e989d9f4aa67070e40b10718062675e79e66f19"
86 "depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git"
87)
88sha256sums=('SKIP' 'SKIP')
89
90_jobs=6
91
92prepare() {
93 export CR_DIR="$srcdir/chromium/src"
94 export HOME="$srcdir/home"
95 export PATH="$srcdir/depot_tools:$PATH"
96 export DEPOT_TOOLS_UPDATE=0
97
98 mkdir -p "$HOME"
99 ln -sfn "$srcdir/depot_tools" "$HOME/depot_tools"
100
101 cd "$srcdir/thorium"
102 ./trunk.sh
103 ./version.sh
104 ./setup.sh
105
106 cd "$CR_DIR"
107 gn gen out/thorium --args="$(
108 sed \
109 -e 's@^chrome_pgo_phase = .*@chrome_pgo_phase = 0@' \
110 -e 's@^pgo_data_path = .*@pgo_data_path = ""@' \
111 "$srcdir/thorium/args.gn"
112 )"
113}
114
115build() {
116 export CR_DIR="$srcdir/chromium/src"
117 export HOME="$srcdir/home"
118 export PATH="$srcdir/depot_tools:$PATH"
119 export DEPOT_TOOLS_UPDATE=0
120 export NINJA_SUMMARIZE_BUILD=1
121 export NINJA_STATUS="[%r processes, %f/%t @ %o/s | %e sec. ] "
122
123 cd "$CR_DIR"
124 nice -n 10 ionice -c2 -n7 autoninja -C out/thorium \
125 clear_key_cdm \
126 chromedriver \
127 chrome/installer/linux:strip_chrome_binary \
128 chrome/installer/linux:strip_chrome_sandbox \
129 chrome/installer/linux:strip_chrome_management_service \
130 -j"$_jobs"
131
132 if [[ -f out/thorium/chrome.stripped ]]; then
133 ln -f out/thorium/chrome.stripped out/thorium/thorium.stripped
134 elif [[ ! -f out/thorium/thorium.stripped ]]; then
135 echo "Missing stripped browser binary." >&2
136 return 1
137 fi
138
139 ln -f out/thorium/chrome_sandbox.stripped out/thorium/thorium_sandbox.stripped
140 patchelf --remove-rpath out/thorium/thorium.stripped 2>/dev/null || true
141 patchelf --remove-rpath out/thorium/chrome_management_service.stripped 2>/dev/null || true
142
143 cp -f "$srcdir/thorium/thorium_shell/thorium.svg" out/thorium/thorium.svg
144 cp -f "$srcdir/thorium/pak_src/binaries/pak" out/thorium/pak
145 cp -f "$srcdir/thorium/infra/initial_preferences" out/thorium/initial_preferences
146 chmod 755 out/thorium/pak
147
148 if [[ ! -x buildtools/third_party/eu-strip/bin/eu-strip ]] &&
149 command -v eu-strip >/dev/null; then
150 mkdir -p buildtools/third_party/eu-strip/bin
151 ln -sf "$(command -v eu-strip)" buildtools/third_party/eu-strip/bin/eu-strip
152 fi
153
154 nice -n 10 ionice -c2 -n7 autoninja -C out/thorium \
155 chrome/installer/linux:stable_rpm \
156 -j"$_jobs"
157}
158
159package() {
160 local rpm
161 rpm="$srcdir/chromium/src/out/thorium/thorium-browser_${pkgver}_AVX.rpm"
162 [[ -f "$rpm" ]] || {
163 echo "Unable to find built Thorium RPM" >&2
164 return 1
165 }
166
167 cd "$srcdir"
168 rpm2cpio "$rpm" | bsdtar -xf -
169
170 install -dm755 "$pkgdir/opt"
171 mv opt/chromium.org/thorium "$pkgdir/opt/thorium-browser"
172 cp -a usr "$pkgdir/"
173 cp -a etc "$pkgdir/" 2>/dev/null || true
174
175 rm -rf \
176 "$pkgdir/etc/cron.daily" \
177 "$pkgdir/opt/thorium-browser/cron" \
178 "$pkgdir/usr/share/doc" \
179 "$pkgdir/usr/share/menu"
180
181 rm -f \
182 "$pkgdir/opt/thorium-browser/thorium_shell" \
183 "$pkgdir/opt/thorium-browser/thorium_shell.png" \
184 "$pkgdir/usr/bin/thorium-browser" \
185 "$pkgdir/usr/bin/thorium-browser-stable" \
186 "$pkgdir/usr/bin/thorium-shell" \
187 "$pkgdir/usr/bin/pak" \
188 "$pkgdir/usr/share/applications/thorium-shell.desktop" \
189 "$pkgdir/usr/share/icons/hicolor/256x256/apps/thorium-shell.png" \
190 "$pkgdir/usr/share/man/man1/thorium-browser-stable.1" \
191 "$pkgdir/usr/share/man/man1/thorium-browser-stable.1.gz"
192
193 install -Dm755 /dev/stdin "$pkgdir/usr/bin/thorium-browser" <<'END'
194#!/usr/bin/env bash
195set -euo pipefail
196
197name=thorium
198flags_file="${XDG_CONFIG_HOME:-$HOME/.config}/${name}-flags.conf"
199
200lines=()
201if [[ -f "${flags_file}" ]]; then
202 mapfile -t lines < "${flags_file}"
203fi
204
205flags=()
206for line in "${lines[@]}"; do
207 if [[ ! "${line}" =~ ^[[:space:]]*#.* ]] && [[ -n "${line}" ]]; then
208 flags+=("${line}")
209 fi
210done
211
212exec /opt/thorium-browser/thorium-browser "${flags[@]}" "$@"
213END
214
215 find "$pkgdir/usr/share/applications" -name '*.desktop' -type f -exec \
216 sed -i 's@/usr/bin/thorium-browser-stable@/usr/bin/thorium-browser@g' {} +
217
218 if [[ -f "$pkgdir/usr/share/gnome-control-center/default-apps/thorium-browser.xml" ]]; then
219 sed -E -i 's@/opt/chromium.org/thorium/@/opt/thorium-browser/@g' \
220 "$pkgdir/usr/share/gnome-control-center/default-apps/thorium-browser.xml"
221 fi
222
223 chmod 4755 "$pkgdir/opt/thorium-browser/chrome-sandbox"
224
225 if [[ -f "$pkgdir/opt/thorium-browser/product_logo_256.png" ]]; then
226 install -Dm644 "$pkgdir/opt/thorium-browser/product_logo_256.png" \
227 "$pkgdir/usr/share/icons/hicolor/256x256/apps/thorium-browser.png"
228 fi
229 find "$pkgdir" -type d -exec chmod 755 {} +
230}
231

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion