waterfox-bin
LOW
maintainer Exorcism
61 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a prebuilt binary from the official Waterfox CDN, which is a standard and expected source for this package; the host is not whitelisted but is legitimate and specific to the project, and the checksum is provided, reducing supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt binary from the official Waterfox CDN, which is a standard and expected source for this package; the host is not whitelisted but is legitimate and specific to the project, and the checksum is provided, reducing supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source=("waterfox-${pkgver}-${pkgrel}.tar.bz2::https://cdn.waterfox.com/waterfox/releases/${pkgver}/Linux_x86_64/waterfox-${pkgver}.tar.bz2"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Exorcism, AutoUpdateBot
2
# Contributor: envolution
3
# Contributor: hawkeye116477 <hawkeye116477 at gmail dot com>
4
# shellcheck shell=bash disable=SC2034,SC2154
5
6
pkgname=waterfox-bin
7
epoch=1
8
pkgver=6.7.2
9
pkgrel=1
10
pkgdesc="Current/modern generation of customizable privacy-conscious web browser."
11
arch=('x86_64')
12
url="https://www.waterfox.net"
13
license=('MPL-2.0')
14
depends=('gtk3' 'libxt' 'startup-notification' 'mime-types' 'dbus-glib' 'ffmpeg'
15
'ttf-font' 'hicolor-icon-theme')
16
optdepends=('networkmanager: Location detection via available WiFi networks'
17
'libnotify: Notification integration'
18
'pulseaudio: Audio support'
19
'alsa-lib: Audio support'
20
'speech-dispatcher: Text-to-Speech'
21
'hunspell-en_US: Spell checking, American English')
22
provides=("waterfox=${pkgver}")
23
source=("waterfox-${pkgver}-${pkgrel}.tar.bz2::https://cdn.waterfox.com/waterfox/releases/${pkgver}/Linux_x86_64/waterfox-${pkgver}.tar.bz2"
24
"waterfox.desktop")
25
conflicts=('waterfox')
26
27
package() {
28
# Create the necessary directories.
29
install -d "${pkgdir}"/{usr/{bin,share/applications},opt}
30
31
# Install the desktop files.
32
install -m644 "${srcdir}"/waterfox.desktop "${pkgdir}"/usr/share/applications/
33
34
# Copy the extracted directory to /opt/.
35
cp -r waterfox "${pkgdir}"/opt/waterfox
36
37
# Install icons
38
for i in 16 32 48 64 128; do
39
install -d "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps"
40
ln -Ts /opt/waterfox/browser/chrome/icons/default/default$i.png \
41
"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/waterfox.png"
42
done
43
44
# Add additional useful settings
45
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/browser/defaults/preferences/vendor.js" <<END
46
// Disable default browser checking
47
pref("browser.shell.checkDefaultBrowser", false);
48
49
// Use LANG environment variable to choose locale
50
pref("intl.locale.requested", "");
51
52
// Automatic installation of updates won't work on root, so disable this
53
pref("app.update.auto", false);
54
55
// Use system-provided dictionaries
56
pref("spellchecker.dictionary_path", "/usr/share/hunspell");
57
END
58
59
# Disable automatic updates and update notifications and allow only for manual update checking
60
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/distribution/policies.json" <<END
61
{
62
"policies": {
63
"AppAutoUpdate": false,
64
"ManualAppUpdateOnly": true
65
}
66
}
67
END
68
69
# Symlink the binary to /usr/bin/.
70
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox
71
# Backward compatibility symlink
72
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g
73
}
74
75
sha512sums=('1f4c8c9a25597576da6c3e32c7298fade0ca577c3c92e9b0edc8231dc12b9f856bb39780a922a9871198f66180db5de7c1c001b9cf3ccbb2d4de98687dc7e9d4'
76
'd0237cffceb1f22bcef3479ee192360c069052534cbe6f452bf88e671ba26b7d8d04f6cdbb4f34647277b64136093d703b5f9ac8071fe0d3c80d70b1e1395a84')
77
# vim:set ts=2 sw=2 et:
78
Changes since previous scan
--- PKGBUILD @ 2026-09-09 00:04+++ PKGBUILD @ 2026-09-17 00:27@@ -5,7 +5,7 @@ pkgname=waterfox-bin epoch=1-pkgver=6.7.0+pkgver=6.7.2 pkgrel=1 pkgdesc="Current/modern generation of customizable privacy-conscious web browser." arch=('x86_64')@@ -72,7 +72,7 @@ ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g } -sha512sums=('ea3019f1d572d9ba309ef0a93bfda5f6c603488e054dccae04f5910a0d276e463ef6251fa13aa396f5758a5260df5624a3f4c26103ef90bea3a434ff10624440'+sha512sums=('1f4c8c9a25597576da6c3e32c7298fade0ca577c3c92e9b0edc8231dc12b9f856bb39780a922a9871198f66180db5de7c1c001b9cf3ccbb2d4de98687dc7e9d4' 'd0237cffceb1f22bcef3479ee192360c069052534cbe6f452bf88e671ba26b7d8d04f6cdbb4f34647277b64136093d703b5f9ac8071fe0d3c80d70b1e1395a84') # vim:set ts=2 sw=2 et: Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 13:14:45 | Medium | 1 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 13:19:49 | Medium | 1 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |