waterfox-beta-bin
LOW
maintainer zoeyrae
0 votes
scanned 2026-11-02 00:26:00.633185
Why flagged
The package downloads a prebuilt binary from the project's official CDN (cdn.waterfox.com), which is plausibly controlled by the project; while the host is not on a standard whitelist, it is specific to Waterfox and the binary is not executed during build, making the risk low.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the project's official CDN (cdn.waterfox.com), which is plausibly controlled by the project; while the host is not on a standard whitelist, it is specific to Waterfox and the binary is not executed during build, making the risk low.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source=("https://cdn.waterfox.com/waterfox/releases/${_relver}/Linux_x86_64/waterfox-${_relver}.tar.bz2"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zoeyrae
2
# Contributor: zoeyrae <zoey.ronain at gmail dot com>
3
# Contributor: Envolution
4
# shellcheck shell=bash disable=SC2034,SC2154
5
6
pkgname=waterfox-beta-bin
7
pkgver=6.7.7
8
_relver=6.7.7
9
pkgrel=1
10
pkgdesc="Beta/modern generation of customizable privacy-conscious web browser."
11
arch=('x86_64')
12
url="https://www.waterfox.net"
13
license=('MPL-2.0')
14
depends=('gtk3' 'libxt' 'startup-notification' 'mime-types' 'dbus-glib' 'ffmpeg'
15
'ttf-font' 'hicolor-icon-theme')
16
optdepends=('networkmanager: Location detection via available WiFi networks'
17
'libnotify: Notification integration'
18
'pulseaudio: Audio support'
19
'alsa-lib: Audio support'
20
'speech-dispatcher: Text-to-Speech'
21
'hunspell-en_US: Spell checking, American English')
22
provides=("waterfox=${pkgver}")
23
source=("https://cdn.waterfox.com/waterfox/releases/${_relver}/Linux_x86_64/waterfox-${_relver}.tar.bz2"
24
"waterfox.desktop")
25
26
package() {
27
# Create the necessary directories.
28
install -d "${pkgdir}"/{usr/{bin,share/applications},opt}
29
30
# Install the desktop files.
31
install -m644 "${srcdir}"/waterfox.desktop "${pkgdir}"/usr/share/applications/
32
33
# Copy the extracted directory to /opt/.
34
cp -r waterfox "${pkgdir}"/opt/waterfox
35
36
# Install icons
37
for i in 16 32 48 64 128; do
38
install -d "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps"
39
ln -Ts /opt/waterfox/browser/chrome/icons/default/default$i.png \
40
"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/waterfox.png"
41
done
42
43
# Add additional useful settings
44
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/browser/defaults/preferences/vendor.js" <<END
45
// Disable default browser checking
46
pref("browser.shell.checkDefaultBrowser", false);
47
48
// Use LANG environment variable to choose locale
49
pref("intl.locale.requested", "");
50
51
// Automatic installation of updates won't work on root, so disable this
52
pref("app.update.auto", false);
53
54
// Use system-provided dictionaries
55
pref("spellchecker.dictionary_path", "/usr/share/hunspell");
56
END
57
58
# Disable automatic updates and update notifications and allow only for manual update checking
59
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/distribution/policies.json" <<END
60
{
61
"policies": {
62
"AppAutoUpdate": false,
63
"ManualAppUpdateOnly": true
64
}
65
}
66
END
67
68
# Symlink the binary to /usr/bin/.
69
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox
70
# Backward compatibility symlink
71
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g
72
}
73
74
sha512sums=('3b443cdf784ac5625bfbe2e61b56a35352c7dae27816f0a289a05c5fd18f993e12062862a5ac09f84d41ca6ebebdac409c71e52b711bfd2b83881f6a63c4b99c'
75
'd0ff0445021b975d52eee7dac27dfdc0d170da07f8a8dc1676ba53387c2006f0598c163b36b07abdbb411cfb61bf52b8222fc5882bdfa8dfcd13d99cb44c92b6')
76
# vim:set ts=2 sw=2 et:
77
Changes since previous scan
--- PKGBUILD @ 2026-10-27 00:23+++ PKGBUILD @ 2026-11-02 00:26@@ -4,8 +4,8 @@ # shellcheck shell=bash disable=SC2034,SC2154 pkgname=waterfox-beta-bin-pkgver=6.7.6-_relver=6.7.6+pkgver=6.7.7+_relver=6.7.7 pkgrel=1 pkgdesc="Beta/modern generation of customizable privacy-conscious web browser." arch=('x86_64')@@ -71,7 +71,7 @@ ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g } -sha512sums=('2a56a337a84bb0cd9dfa8818d1eeafa08756840e39b9687fa8f4554e9c983af47a220476b2b53f7ea7c6696477c528546bce4e30f6d4e720a0af690981837d0c'+sha512sums=('3b443cdf784ac5625bfbe2e61b56a35352c7dae27816f0a289a05c5fd18f993e12062862a5ac09f84d41ca6ebebdac409c71e52b711bfd2b83881f6a63c4b99c' 'd0ff0445021b975d52eee7dac27dfdc0d170da07f8a8dc1676ba53387c2006f0598c163b36b07abdbb411cfb61bf52b8222fc5882bdfa8dfcd13d99cb44c92b6') # vim:set ts=2 sw=2 et: Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-02 00:26:00 | Low | 2 |
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 19:48:35 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 23:13:54 | Medium | 1 |