thorium-browser-updated
maintainer brauliobo
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a git checkout from the maintainer's own GitHub fork of Thorium, a Chromium-based browser; building from source is normal for AUR packages, and the flagged non-standard host (github.com) is actually a standard forge, making the risk low despite skipped checksums.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git checkout from the maintainer's own GitHub fork of Thorium, a Chromium-based browser; building from source is normal for AUR packages, and the flagged non-standard host (github.com) is actually a standard forge, making the risk low despite skipped checksums.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:86
"depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Braulio Oliveira <brauliobo@gmail.com>
2
3
pkgname=thorium-browser-updated
4
pkgver=150.0.7871.124
5
pkgrel=1
6
pkgdesc="Chromium fork focused on high performance and security, built from source"
7
arch=('x86_64')
8
url="https://github.com/brauliobo/thorium"
9
license=('BSD-3-Clause')
10
depends=(
11
'alsa-lib'
12
'at-spi2-core'
13
'cairo'
14
'dbus'
15
'desktop-file-utils'
16
'expat'
17
'glib2'
18
'glibc'
19
'gtk3'
20
'hicolor-icon-theme'
21
'libcups'
22
'libffi'
23
'libgcc'
24
'libgcrypt'
25
'libnotify'
26
'libpulse'
27
'libstdc++'
28
'libva'
29
'libx11'
30
'libxcb'
31
'libxcomposite'
32
'libxdamage'
33
'libxext'
34
'libxfixes'
35
'libxkbcommon'
36
'libxrandr'
37
'libxss'
38
'mesa'
39
'nspr'
40
'nss'
41
'pango'
42
'pciutils'
43
'systemd'
44
'systemd-libs'
45
'ttf-liberation'
46
'xdg-utils'
47
'zlib'
48
)
49
makedepends=(
50
'clang'
51
'compiler-rt'
52
'git'
53
'gn'
54
'gperf'
55
'java-runtime-headless'
56
'lld'
57
'ninja'
58
'nodejs'
59
'npm'
60
'patchelf'
61
'pipewire'
62
'python'
63
'python-httplib2'
64
'python-pyparsing'
65
'python-six'
66
'qt6-base'
67
'rpm-tools'
68
'rsync'
69
'rust'
70
'rust-bindgen'
71
)
72
optdepends=(
73
'pipewire: WebRTC desktop sharing under Wayland'
74
'kdialog: support for native dialogs in Plasma'
75
'gtk4: for --gtk-version=4'
76
'qt6-base: Qt support'
77
'org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce'
78
'upower: Battery Status API support'
79
)
80
provides=('thorium-browser')
81
conflicts=('thorium-browser' 'thorium-browser-bin' 'thorium-browser-updated-bin')
82
options=('!lto' '!strip' '!debug')
83
install="${pkgname}.install"
84
source=(
85
"thorium::git+https://github.com/brauliobo/thorium.git#commit=1e989d9f4aa67070e40b10718062675e79e66f19"
86
"depot_tools::git+https://chromium.googlesource.com/chromium/tools/depot_tools.git"
87
)
88
sha256sums=('SKIP' 'SKIP')
89
90
_jobs=6
91
92
prepare() {
93
export CR_DIR="$srcdir/chromium/src"
94
export HOME="$srcdir/home"
95
export PATH="$srcdir/depot_tools:$PATH"
96
export DEPOT_TOOLS_UPDATE=0
97
98
mkdir -p "$HOME"
99
ln -sfn "$srcdir/depot_tools" "$HOME/depot_tools"
100
101
cd "$srcdir/thorium"
102
./trunk.sh
103
./version.sh
104
./setup.sh
105
106
cd "$CR_DIR"
107
gn gen out/thorium --args="$(
108
sed \
109
-e 's@^chrome_pgo_phase = .*@chrome_pgo_phase = 0@' \
110
-e 's@^pgo_data_path = .*@pgo_data_path = ""@' \
111
"$srcdir/thorium/args.gn"
112
)"
113
}
114
115
build() {
116
export CR_DIR="$srcdir/chromium/src"
117
export HOME="$srcdir/home"
118
export PATH="$srcdir/depot_tools:$PATH"
119
export DEPOT_TOOLS_UPDATE=0
120
export NINJA_SUMMARIZE_BUILD=1
121
export NINJA_STATUS="[%r processes, %f/%t @ %o/s | %e sec. ] "
122
123
cd "$CR_DIR"
124
nice -n 10 ionice -c2 -n7 autoninja -C out/thorium \
125
clear_key_cdm \
126
chromedriver \
127
chrome/installer/linux:strip_chrome_binary \
128
chrome/installer/linux:strip_chrome_sandbox \
129
chrome/installer/linux:strip_chrome_management_service \
130
-j"$_jobs"
131
132
if [[ -f out/thorium/chrome.stripped ]]; then
133
ln -f out/thorium/chrome.stripped out/thorium/thorium.stripped
134
elif [[ ! -f out/thorium/thorium.stripped ]]; then
135
echo "Missing stripped browser binary." >&2
136
return 1
137
fi
138
139
ln -f out/thorium/chrome_sandbox.stripped out/thorium/thorium_sandbox.stripped
140
patchelf --remove-rpath out/thorium/thorium.stripped 2>/dev/null || true
141
patchelf --remove-rpath out/thorium/chrome_management_service.stripped 2>/dev/null || true
142
143
cp -f "$srcdir/thorium/thorium_shell/thorium.svg" out/thorium/thorium.svg
144
cp -f "$srcdir/thorium/pak_src/binaries/pak" out/thorium/pak
145
cp -f "$srcdir/thorium/infra/initial_preferences" out/thorium/initial_preferences
146
chmod 755 out/thorium/pak
147
148
if [[ ! -x buildtools/third_party/eu-strip/bin/eu-strip ]] &&
149
command -v eu-strip >/dev/null; then
150
mkdir -p buildtools/third_party/eu-strip/bin
151
ln -sf "$(command -v eu-strip)" buildtools/third_party/eu-strip/bin/eu-strip
152
fi
153
154
nice -n 10 ionice -c2 -n7 autoninja -C out/thorium \
155
chrome/installer/linux:stable_rpm \
156
-j"$_jobs"
157
}
158
159
package() {
160
local rpm
161
rpm="$srcdir/chromium/src/out/thorium/thorium-browser_${pkgver}_AVX.rpm"
162
[[ -f "$rpm" ]] || {
163
echo "Unable to find built Thorium RPM" >&2
164
return 1
165
}
166
167
cd "$srcdir"
168
rpm2cpio "$rpm" | bsdtar -xf -
169
170
install -dm755 "$pkgdir/opt"
171
mv opt/chromium.org/thorium "$pkgdir/opt/thorium-browser"
172
cp -a usr "$pkgdir/"
173
cp -a etc "$pkgdir/" 2>/dev/null || true
174
175
rm -rf \
176
"$pkgdir/etc/cron.daily" \
177
"$pkgdir/opt/thorium-browser/cron" \
178
"$pkgdir/usr/share/doc" \
179
"$pkgdir/usr/share/menu"
180
181
rm -f \
182
"$pkgdir/opt/thorium-browser/thorium_shell" \
183
"$pkgdir/opt/thorium-browser/thorium_shell.png" \
184
"$pkgdir/usr/bin/thorium-browser" \
185
"$pkgdir/usr/bin/thorium-browser-stable" \
186
"$pkgdir/usr/bin/thorium-shell" \
187
"$pkgdir/usr/bin/pak" \
188
"$pkgdir/usr/share/applications/thorium-shell.desktop" \
189
"$pkgdir/usr/share/icons/hicolor/256x256/apps/thorium-shell.png" \
190
"$pkgdir/usr/share/man/man1/thorium-browser-stable.1" \
191
"$pkgdir/usr/share/man/man1/thorium-browser-stable.1.gz"
192
193
install -Dm755 /dev/stdin "$pkgdir/usr/bin/thorium-browser" <<'END'
194
#!/usr/bin/env bash
195
set -euo pipefail
196
197
name=thorium
198
flags_file="${XDG_CONFIG_HOME:-$HOME/.config}/${name}-flags.conf"
199
200
lines=()
201
if [[ -f "${flags_file}" ]]; then
202
mapfile -t lines < "${flags_file}"
203
fi
204
205
flags=()
206
for line in "${lines[@]}"; do
207
if [[ ! "${line}" =~ ^[[:space:]]*#.* ]] && [[ -n "${line}" ]]; then
208
flags+=("${line}")
209
fi
210
done
211
212
exec /opt/thorium-browser/thorium-browser "${flags[@]}" "$@"
213
END
214
215
find "$pkgdir/usr/share/applications" -name '*.desktop' -type f -exec \
216
sed -i 's@/usr/bin/thorium-browser-stable@/usr/bin/thorium-browser@g' {} +
217
218
if [[ -f "$pkgdir/usr/share/gnome-control-center/default-apps/thorium-browser.xml" ]]; then
219
sed -E -i 's@/opt/chromium.org/thorium/@/opt/thorium-browser/@g' \
220
"$pkgdir/usr/share/gnome-control-center/default-apps/thorium-browser.xml"
221
fi
222
223
chmod 4755 "$pkgdir/opt/thorium-browser/chrome-sandbox"
224
225
if [[ -f "$pkgdir/opt/thorium-browser/product_logo_256.png" ]]; then
226
install -Dm644 "$pkgdir/opt/thorium-browser/product_logo_256.png" \
227
"$pkgdir/usr/share/icons/hicolor/256x256/apps/thorium-browser.png"
228
fi
229
find "$pkgdir" -type d -exec chmod 755 {} +
230
}
231
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 09:48:24 | MEDIUM | 1 |