waterfox-bin

maintainer Exorcism · 61 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from the official project's CDN, which is a standard practice for binary distributions; the host is not on the analyzer's whitelist but is legitimate for the project, and the download has a matching checksum, reducing supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the official project's CDN, which is a standard practice for binary distributions; the host is not on the analyzer's whitelist but is legitimate for the project, and the download has a matching checksum, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("waterfox-${pkgver}-${pkgrel}.tar.bz2::https://cdn.waterfox.com/waterfox/releases/${pkgver}/Linux_x86_64/waterfox-${pkgver}.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Exorcism, AutoUpdateBot
    
      2# Contributor: envolution
    
      3# Contributor: hawkeye116477 <hawkeye116477 at gmail dot com>
    
      4# shellcheck shell=bash disable=SC2034,SC2154
    
      5
    
      6pkgname=waterfox-bin
    
      7epoch=1
    
      8pkgver=6.6.16.1
    
      9pkgrel=1
    
      10pkgdesc="Current/modern generation of customizable privacy-conscious web browser."
    
      11arch=('x86_64')
    
      12url="https://www.waterfox.net"
    
      13license=('MPL-2.0')
    
      14depends=('gtk3' 'libxt' 'startup-notification' 'mime-types' 'dbus-glib' 'ffmpeg'
    
      15  'ttf-font' 'hicolor-icon-theme')
    
      16optdepends=('networkmanager: Location detection via available WiFi networks'
    
      17  'libnotify: Notification integration'
    
      18  'pulseaudio: Audio support'
    
      19  'alsa-lib: Audio support'
    
      20  'speech-dispatcher: Text-to-Speech'
    
      21  'hunspell-en_US: Spell checking, American English')
    
      22provides=("waterfox=${pkgver}")
    
      23source=("waterfox-${pkgver}-${pkgrel}.tar.bz2::https://cdn.waterfox.com/waterfox/releases/${pkgver}/Linux_x86_64/waterfox-${pkgver}.tar.bz2"
    
      24  "waterfox.desktop")
    
      25conflicts=('waterfox')
    
      26
    
      27package() {
    
      28  # Create the necessary directories.
    
      29  install -d "${pkgdir}"/{usr/{bin,share/applications},opt}
    
      30
    
      31  # Install the desktop files.
    
      32  install -m644 "${srcdir}"/waterfox.desktop "${pkgdir}"/usr/share/applications/
    
      33
    
      34  # Copy the extracted directory to /opt/.
    
      35  cp -r waterfox "${pkgdir}"/opt/waterfox
    
      36
    
      37  # Install icons
    
      38  for i in 16 32 48 64 128; do
    
      39    install -d "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps"
    
      40    ln -Ts /opt/waterfox/browser/chrome/icons/default/default$i.png \
    
      41      "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/waterfox.png"
    
      42  done
    
      43
    
      44  # Add additional useful settings
    
      45  install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/browser/defaults/preferences/vendor.js" <<END
    
      46// Disable default browser checking
    
      47pref("browser.shell.checkDefaultBrowser", false);
    
      48
    
      49// Use LANG environment variable to choose locale
    
      50pref("intl.locale.requested", "");
    
      51
    
      52// Automatic installation of updates won't work on root, so disable this
    
      53pref("app.update.auto", false);
    
      54
    
      55// Use system-provided dictionaries
    
      56pref("spellchecker.dictionary_path", "/usr/share/hunspell");
    
      57END
    
      58
    
      59  # Disable automatic updates and update notifications and allow only for manual update checking
    
      60  install -Dm644 /dev/stdin "$pkgdir/opt/waterfox/distribution/policies.json" <<END
    
      61{
    
      62    "policies": {
    
      63        "AppAutoUpdate": false,
    
      64        "ManualAppUpdateOnly": true
    
      65    }
    
      66}
    
      67END
    
      68
    
      69  # Symlink the binary to /usr/bin/.
    
      70  ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox
    
      71  # Backward compatibility symlink
    
      72  ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g
    
      73}
    
      74
    
      75sha512sums=('316dea8a9867fdbe5cc6aca2d732484126beef4bccbde5ae24bc71c370aa3d0fa5f5605bd849b9c8407d2ee460d102a837bf748a979de9b8a74a6bc72d68f8c5'
    
      76            'd0237cffceb1f22bcef3479ee192360c069052534cbe6f452bf88e671ba26b7d8d04f6cdbb4f34647277b64136093d703b5f9ac8071fe0d3c80d70b1e1395a84')
    
      77# vim:set ts=2 sw=2 et:
    
      78

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,7 +5,7 @@
 
 pkgname=waterfox-bin
 epoch=1
-pkgver=6.6.16
+pkgver=6.6.16.1
 pkgrel=1
 pkgdesc="Current/modern generation of customizable privacy-conscious web browser."
 arch=('x86_64')
@@ -72,7 +72,7 @@
   ln -s /opt/waterfox/waterfox "${pkgdir}"/usr/bin/waterfox-g
 }
 
-sha512sums=('dbfbf2e1068c6be705fd02b0734a16d870752924e257ca6b776028a4b661e7d7adc463aa027bb4f78d3476072f999dccfe9e710bae8934b96b1c3d3f71a61c93'
+sha512sums=('316dea8a9867fdbe5cc6aca2d732484126beef4bccbde5ae24bc71c370aa3d0fa5f5605bd849b9c8407d2ee460d102a837bf748a979de9b8a74a6bc72d68f8c5'
             'd0237cffceb1f22bcef3479ee192360c069052534cbe6f452bf88e671ba26b7d8d04f6cdbb4f34647277b64136093d703b5f9ac8071fe0d3c80d70b1e1395a84')
 # vim:set ts=2 sw=2 et:
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 11:20:06	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2