waterfox-beta-bin
LOW
maintainer zoeyrae
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt binary from the official Waterfox CDN, which is a project-owned host;虽非白名单但来源可信，且为常规二进制分发，无代码执行或供应链替换风险。
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the official Waterfox CDN, which is a project-owned host;虽非白名单但来源可信，且为常规二进制分发，无代码执行或供应链替换风险。
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source=("https://cdn.waterfox.com/waterfox/releases/${_relver}/Linux_x86_64/waterfox-${_relver}.tar.bz2"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zoeyrae
2
# Contributor: zoeyrae <zoey.ronain at gmail dot com>
3
# Contributor: Envolution
4
# shellcheck shell=bash disable=SC2034,SC2154
5
6
pkgname=waterfox-beta-bin
7
pkgver=6.7.2
8
_relver=6.7.2
9
pkgrel=1
10
pkgdesc="Beta/modern generation of customizable privacy-conscious web browser."
11
arch=('x86_64')
12
url="https://www.waterfox.net"
13
license=('MPL-2.0')
14
depends=('gtk3' 'libxt' 'startup-notification' 'mime-types' 'dbus-glib' 'ffmpeg'
15
'ttf-font' 'hicolor-icon-theme')
16
optdepends=('networkmanager: Location detection via available WiFi networks'
17
'libnotify: Notification integration'
18
'pulseaudio: Audio support'
19
'alsa-lib: Audio support'
20
'speech-dispatcher: Text-to-Speech'
21
'hunspell-en_US: Spell checking, American English')
22
provides=("waterfox=${pkgver}")
23
source=("https://cdn.waterfox.com/waterfox/releases/${_relver}/Linux_x86_64/waterfox-${_relver}.tar.bz2"
24
"waterfox.desktop")
25
26
package() {
27
# Create the necessary directories.
28
install -d "${pkgdir}"/{usr/{bin,share/applications},opt}
29
30
# Install the desktop files.
31
install -m644 "${srcdir}"/waterfox.desktop "${pkgdir}"/usr/share/applications/
32
33
# Copy the extracted directory to /opt/.
34
cp -r waterfox "${pkgdir}"/opt/waterfox
35
36
# Install icons
37
for i in 16 32 48 64 128; do
38
install -d "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps"
39
ln -Ts /opt/waterfox/browser/chrome/icons/default/default$i.png \
40
"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/waterfox.png"
41
done
42
43
# Add additional useful settings
44
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/browser/defaults/preferences/vendor.js" <<END
45
// Disable default browser checking
46
pref("browser.shell.checkDefaultBrowser", false);
47
48
// Use LANG environment variable to choose locale
49
pref("intl.locale.requested", "");
50
51
// Automatic installation of updates won't work on root, so disable this
52
pref("app.update.auto", false);
53
54
// Use system-provided dictionaries
55
pref("spellchecker.dictionary_path", "/usr/share/hunspell");
56
END
57
58
# Disable automatic updates and update notifications and allow only for manual update checking
59
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/distribution/policies.json" <<END
60
{
61
"policies": {
62
"AppAutoUpdate": false,
63
"ManualAppUpdateOnly": true
64
}
65
}
66
END
67
68
# Symlink the binary to /usr/bin/.
69
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox
70
# Backward compatibility symlink
71
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g
72
}
73
74
sha512sums=('1f4c8c9a25597576da6c3e32c7298fade0ca577c3c92e9b0edc8231dc12b9f856bb39780a922a9871198f66180db5de7c1c001b9cf3ccbb2d4de98687dc7e9d4'
75
'd0ff0445021b975d52eee7dac27dfdc0d170da07f8a8dc1676ba53387c2006f0598c163b36b07abdbb411cfb61bf52b8222fc5882bdfa8dfcd13d99cb44c92b6')
76
# vim:set ts=2 sw=2 et:
77
Changes since previous scan
--- PKGBUILD @ 2026-09-10 00:22+++ PKGBUILD @ 2026-09-17 00:27@@ -4,8 +4,8 @@ # shellcheck shell=bash disable=SC2034,SC2154 pkgname=waterfox-beta-bin-pkgver=6.7.1.1-_relver=6.7.1.1+pkgver=6.7.2+_relver=6.7.2 pkgrel=1 pkgdesc="Beta/modern generation of customizable privacy-conscious web browser." arch=('x86_64')@@ -71,7 +71,7 @@ ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g } -sha512sums=('e50d899897f2f7ab38d0b1eb313d3d73df48b4f83018a0da9c52375da7dc81b092c1c364f4dc33bd68ac1e48dfdfba1ea0bb9c6c842909be9aee7a934a7e02e2'+sha512sums=('1f4c8c9a25597576da6c3e32c7298fade0ca577c3c92e9b0edc8231dc12b9f856bb39780a922a9871198f66180db5de7c1c001b9cf3ccbb2d4de98687dc7e9d4' 'd0ff0445021b975d52eee7dac27dfdc0d170da07f8a8dc1676ba53387c2006f0598c163b36b07abdbb411cfb61bf52b8222fc5882bdfa8dfcd13d99cb44c92b6') # vim:set ts=2 sw=2 et: Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 23:21:28 | Medium | 1 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 20:01:32 | Medium | 1 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |