waterfox-beta-bin
maintainer zoeyrae
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a prebuilt binary from Waterfox's official CDN, which is a non-whitelisted but project-owned host; the binary is not executed during build, and the rest of the package consists of standard installation and configuration steps with no malicious behavior.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from Waterfox's official CDN, which is a non-whitelisted but project-owned host; the binary is not executed during build, and the rest of the package consists of standard installation and configuration steps with no malicious behavior.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source=("https://cdn.waterfox.com/waterfox/releases/${_relver}/Linux_x86_64/waterfox-${_relver}.tar.bz2"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zoeyrae
2
# Contributor: zoeyrae <zoey.ronain at gmail dot com>
3
# Contributor: Envolution
4
# shellcheck shell=bash disable=SC2034,SC2154
5
6
pkgname=waterfox-beta-bin
7
pkgver=6.7.0.b2
8
_relver=6.7.0-beta.2
9
pkgrel=1
10
pkgdesc="Beta/modern generation of customizable privacy-conscious web browser."
11
arch=('x86_64')
12
url="https://www.waterfox.net"
13
license=('MPL-2.0')
14
depends=('gtk3' 'libxt' 'startup-notification' 'mime-types' 'dbus-glib' 'ffmpeg'
15
'ttf-font' 'hicolor-icon-theme')
16
optdepends=('networkmanager: Location detection via available WiFi networks'
17
'libnotify: Notification integration'
18
'pulseaudio: Audio support'
19
'alsa-lib: Audio support'
20
'speech-dispatcher: Text-to-Speech'
21
'hunspell-en_US: Spell checking, American English')
22
provides=("waterfox=${pkgver}")
23
source=("https://cdn.waterfox.com/waterfox/releases/${_relver}/Linux_x86_64/waterfox-${_relver}.tar.bz2"
24
"waterfox.desktop")
25
26
package() {
27
# Create the necessary directories.
28
install -d "${pkgdir}"/{usr/{bin,share/applications},opt}
29
30
# Install the desktop files.
31
install -m644 "${srcdir}"/waterfox.desktop "${pkgdir}"/usr/share/applications/
32
33
# Copy the extracted directory to /opt/.
34
cp -r waterfox "${pkgdir}"/opt/waterfox
35
36
# Install icons
37
for i in 16 32 48 64 128; do
38
install -d "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps"
39
ln -Ts /opt/waterfox/browser/chrome/icons/default/default$i.png \
40
"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/waterfox.png"
41
done
42
43
# Add additional useful settings
44
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/browser/defaults/preferences/vendor.js" <<END
45
// Disable default browser checking
46
pref("browser.shell.checkDefaultBrowser", false);
47
48
// Use LANG environment variable to choose locale
49
pref("intl.locale.requested", "");
50
51
// Automatic installation of updates won't work on root, so disable this
52
pref("app.update.auto", false);
53
54
// Use system-provided dictionaries
55
pref("spellchecker.dictionary_path", "/usr/share/hunspell");
56
END
57
58
# Disable automatic updates and update notifications and allow only for manual update checking
59
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/distribution/policies.json" <<END
60
{
61
"policies": {
62
"AppAutoUpdate": false,
63
"ManualAppUpdateOnly": true
64
}
65
}
66
END
67
68
# Symlink the binary to /usr/bin/.
69
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox
70
# Backward compatibility symlink
71
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g
72
}
73
74
sha512sums=('70b13df9c056a9e35d7a1f381ad7a788f6ecea7d7ef553cac171d56228ceda2190e5ef4ca7b0653374b456c30ca124634f45585c67313b31c1a2afb515e00d4e'
75
'd0ff0445021b975d52eee7dac27dfdc0d170da07f8a8dc1676ba53387c2006f0598c163b36b07abdbb411cfb61bf52b8222fc5882bdfa8dfcd13d99cb44c92b6')
76
# vim:set ts=2 sw=2 et:
77
Changes since previous scan
--- PKGBUILD @ 2026-07-21 00:24+++ PKGBUILD @ 2026-08-03 00:08@@ -4,8 +4,8 @@ # shellcheck shell=bash disable=SC2034,SC2154 pkgname=waterfox-beta-bin-pkgver=6.7.0.b1-_relver=6.7.0-beta.1+pkgver=6.7.0.b2+_relver=6.7.0-beta.2 pkgrel=1 pkgdesc="Beta/modern generation of customizable privacy-conscious web browser." arch=('x86_64')@@ -71,7 +71,7 @@ ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g } -sha512sums=('cc6c973cf65784641b432b43311d6ad1bed48a0e8a551e3dad1a12c4ee589840258333a64cd10bf533ddc6e1a2f059cb62a8ea6ace45845a49e261c03b2677c6'+sha512sums=('70b13df9c056a9e35d7a1f381ad7a788f6ecea7d7ef553cac171d56228ceda2190e5ef4ca7b0653374b456c30ca124634f45585c67313b31c1a2afb515e00d4e' 'd0ff0445021b975d52eee7dac27dfdc0d170da07f8a8dc1676ba53387c2006f0598c163b36b07abdbb411cfb61bf52b8222fc5882bdfa8dfcd13d99cb44c92b6') # vim:set ts=2 sw=2 et: Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 19:17:41 | MEDIUM | 1 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |