waterfox-bin
LOW
maintainer Exorcism
62 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a prebuilt binary from the official Waterfox CDN, which is a standard and expected source for this package; while the host is not on a typical whitelist, it is the project's own distribution infrastructure, and the checksums are provided and valid, minimizing supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt binary from the official Waterfox CDN, which is a standard and expected source for this package; while the host is not on a typical whitelist, it is the project's own distribution infrastructure, and the checksums are provided and valid, minimizing supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source=("waterfox-${pkgver}-${pkgrel}.tar.bz2::https://cdn.waterfox.com/waterfox/releases/${pkgver}/Linux_x86_64/waterfox-${pkgver}.tar.bz2"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Exorcism, AutoUpdateBot
2
# Contributor: envolution
3
# Contributor: hawkeye116477 <hawkeye116477 at gmail dot com>
4
# shellcheck shell=bash disable=SC2034,SC2154
5
6
pkgname=waterfox-bin
7
epoch=1
8
pkgver=6.7.7
9
pkgrel=1
10
pkgdesc="Current/modern generation of customizable privacy-conscious web browser."
11
arch=('x86_64')
12
url="https://www.waterfox.net"
13
license=('MPL-2.0')
14
depends=('gtk3' 'libxt' 'startup-notification' 'mime-types' 'dbus-glib' 'ffmpeg'
15
'ttf-font' 'hicolor-icon-theme')
16
optdepends=('networkmanager: Location detection via available WiFi networks'
17
'libnotify: Notification integration'
18
'pulseaudio: Audio support'
19
'alsa-lib: Audio support'
20
'speech-dispatcher: Text-to-Speech'
21
'hunspell-en_US: Spell checking, American English')
22
provides=("waterfox=${pkgver}")
23
source=("waterfox-${pkgver}-${pkgrel}.tar.bz2::https://cdn.waterfox.com/waterfox/releases/${pkgver}/Linux_x86_64/waterfox-${pkgver}.tar.bz2"
24
"waterfox.desktop")
25
conflicts=('waterfox')
26
27
package() {
28
# Create the necessary directories.
29
install -d "${pkgdir}"/{usr/{bin,share/applications},opt}
30
31
# Install the desktop files.
32
install -m644 "${srcdir}"/waterfox.desktop "${pkgdir}"/usr/share/applications/
33
34
# Copy the extracted directory to /opt/.
35
cp -r waterfox "${pkgdir}"/opt/waterfox
36
37
# Install icons
38
for i in 16 32 48 64 128; do
39
install -d "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps"
40
ln -Ts /opt/waterfox/browser/chrome/icons/default/default$i.png \
41
"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/waterfox.png"
42
done
43
44
# Add additional useful settings
45
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/browser/defaults/preferences/vendor.js" <<END
46
// Disable default browser checking
47
pref("browser.shell.checkDefaultBrowser", false);
48
49
// Use LANG environment variable to choose locale
50
pref("intl.locale.requested", "");
51
52
// Automatic installation of updates won't work on root, so disable this
53
pref("app.update.auto", false);
54
55
// Use system-provided dictionaries
56
pref("spellchecker.dictionary_path", "/usr/share/hunspell");
57
END
58
59
# Disable automatic updates and update notifications and allow only for manual update checking
60
install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/distribution/policies.json" <<END
61
{
62
"policies": {
63
"AppAutoUpdate": false,
64
"ManualAppUpdateOnly": true
65
}
66
}
67
END
68
69
# Symlink the binary to /usr/bin/.
70
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox
71
# Backward compatibility symlink
72
ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g
73
}
74
75
sha512sums=('3b443cdf784ac5625bfbe2e61b56a35352c7dae27816f0a289a05c5fd18f993e12062862a5ac09f84d41ca6ebebdac409c71e52b711bfd2b83881f6a63c4b99c'
76
'd0237cffceb1f22bcef3479ee192360c069052534cbe6f452bf88e671ba26b7d8d04f6cdbb4f34647277b64136093d703b5f9ac8071fe0d3c80d70b1e1395a84')
77
# vim:set ts=2 sw=2 et:
78
Changes since previous scan
--- PKGBUILD @ 2026-10-27 00:23+++ PKGBUILD @ 2026-11-01 00:21@@ -5,7 +5,7 @@ pkgname=waterfox-bin epoch=1-pkgver=6.7.6+pkgver=6.7.7 pkgrel=1 pkgdesc="Current/modern generation of customizable privacy-conscious web browser." arch=('x86_64')@@ -72,7 +72,7 @@ ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g } -sha512sums=('2a56a337a84bb0cd9dfa8818d1eeafa08756840e39b9687fa8f4554e9c983af47a220476b2b53f7ea7c6696477c528546bce4e30f6d4e720a0af690981837d0c'+sha512sums=('3b443cdf784ac5625bfbe2e61b56a35352c7dae27816f0a289a05c5fd18f993e12062862a5ac09f84d41ca6ebebdac409c71e52b711bfd2b83881f6a63c4b99c' 'd0237cffceb1f22bcef3479ee192360c069052534cbe6f452bf88e671ba26b7d8d04f6cdbb4f34647277b64136093d703b5f9ac8071fe0d3c80d70b1e1395a84') # vim:set ts=2 sw=2 et: Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 15:48:05 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |