zen-browser-git

maintainer paivikahkonen · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own git repository and Mozilla's official archive, applies patches, and downloads source tarballs over HTTPS; no untrusted prebuilt binaries or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own git repository and Mozilla's official archive, applies patches, and downloads source tarballs over HTTPS; no untrusted prebuilt binaries or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Sasha Marie te Rehorst <sasha.marieterehorst@gmail.com>
    
      2pkgbase=zen-browser-git
    
      3pkgname=("$pkgbase")
    
      4pkgver=1.18.2b.r6297.g4de01a9bc
    
      5pkgrel=1
    
      6pkgdesc='Zen Browser Twilight (Git version)'
    
      7url='https://zen-browser.app/'
    
      8arch=('x86_64')
    
      9license=(MPL-2.0)
    
      10replaces=(
    
      11  'zen-browser-git-i18n-ar'
    
      12  'zen-browser-git-i18n-de'
    
      13  'zen-browser-git-i18n-es-es'
    
      14  'zen-browser-git-i18n-fr'
    
      15  'zen-browser-git-i18n-it'
    
      16  'zen-browser-git-i18n-ja'
    
      17  'zen-browser-git-i18n-ko'
    
      18  'zen-browser-git-i18n-nl'
    
      19  'zen-browser-git-i18n-pl'
    
      20  'zen-browser-git-i18n-pt-pt'
    
      21  'zen-browser-git-i18n-ru'
    
      22  'zen-browser-git-i18n-tr'
    
      23  'zen-browser-git-i18n-uk'
    
      24  'zen-browser-git-i18n-zh-cn'
    
      25  'zen-browser-git-i18n-zh-tw'
    
      26)
    
      27depends=(
    
      28  alsa-lib at-spi2-core bash cairo dbus ffmpeg fontconfig freetype2 gcc-libs
    
      29  gdk-pixbuf2 glib2 glibc gtk3 hicolor-icon-theme libpulse libx11 libxcb
    
      30  libxcomposite libxdamage libxext libxfixes libxrandr libxss libxt mime-types
    
      31  nspr nss pango ttf-font adwaita-icon-theme libnotify)
    
      32makedepends=(
    
      33  git pnpm rsync cbindgen clang diffutils imake lld llvm mesa nasm nodejs
    
      34  python rust unzip wasi-compiler-rt wasi-libc wasi-libc++ wasi-libc++abi
    
      35  xorg-server-xvfb yasm zip mold jq wget)
    
      36options=(!emptydirs !makeflags !debug !lto)
    
      37
    
      38_repo='https://github.com/zen-browser/desktop'
    
      39source=(
    
      40  "git+$_repo.git"
    
      41  "firefox-l10n::git+https://github.com/mozilla-l10n/firefox-l10n"
    
      42  zen-browser.desktop
    
      43  0001-bootstrap-without-vcs.firefox.patch
    
      44  0001-fix-desktop.zen.patch
    
      45  0003-do-not-disable-system-extensions.zen.patch
    
      46  0004-fix-package-json.zen.patch
    
      47  0005-source-firefox-language-packs.patch)
    
      48sha256sums=('SKIP'
    
      49            'SKIP'
    
      50            'b16a9e39033e6172d6593b832aed747c50e3264326c50d04f47a168ed3f63c76'
    
      51            '9157eb9b3509a1046bc25ed85b20864f1ff952184f4e1c61c2d43707653f7ff6'
    
      52            'f55ed69dc6f90f898f91d24966b203cb7fb10211ce62405e3ccb8b3069014990'
    
      53            '36bff2af04da55da0cc71f960d921889ccf21c11fcd8343087c144dfcc50f10a'
    
      54            '803c3f456abfc1acd963b594cf684aed2453534e7ab951abc38efa0351b648a1'
    
      55            '7702c197f5509e4ec7e744f74105cc8339b631e37f7a0b41bf3070bf3ccc92a7')
    
      56
    
      57pkgver() {
    
      58  cd desktop
    
      59  local _tag=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")
    
      60  local _safe_ver="${_tag//-/.}"
    
      61  printf "%s.r%s.g%s" "$_safe_ver" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      62}
    
      63
    
      64_OBJ_DIR=obj
    
      65
    
      66prepare() {
    
      67  cd desktop
    
      68  git checkout .
    
      69  git clean -fdx
    
      70
    
      71  _zen_engine_version=$(jq -r '.version.version' surfer.json)
    
      72  if [ "$_zen_engine_version" == "null" ] || [ -z "$_zen_engine_version" ]; then return 1; fi
    
      73
    
      74  local _ff_tarball="firefox-${_zen_engine_version}.source.tar.xz"
    
      75  local _ff_url="https://archive.mozilla.org/pub/firefox/releases/${_zen_engine_version}/source/${_ff_tarball}"
    
      76  
    
      77  if ! curl --output /dev/null --silent --head --fail "$_ff_url"; then
    
      78      _ff_url="https://archive.mozilla.org/pub/firefox/candidates/${_zen_engine_version}-candidates/build1/source/${_ff_tarball}"
    
      79  fi
    
      80  if [ ! -f "$srcdir/$_ff_tarball" ]; then
    
      81      wget -O "$srcdir/$_ff_tarball" "$_ff_url"
    
      82  fi
    
      83
    
      84  git submodule init
    
      85  git config submodule.l10n.url "$srcdir/l10n"
    
      86  git -c protocol.file.allow=always submodule update
    
      87
    
      88  git apply -3 "$srcdir"/0003-do-not-disable-system-extensions.zen.patch || true
    
      89  patch -Np1 -i ../0005-source-firefox-language-packs.patch || true
    
      90
    
      91  jq '(.pnpm.onlyBuiltDependencies += ["sharp"]) | del(.devDependencies["eslint-plugin-spidermonkey-js"])' package.json > temp.json && mv temp.json package.json
    
      92
    
      93  pnpm config set store-dir "$srcdir"/pnpm-store
    
      94  pnpm install --no-frozen-lockfile
    
      95
    
      96  pnpm surfer ci --brand release --display-version "$_zen_engine_version"
    
      97  install -Dvm644 "$srcdir/$_ff_tarball" -t "./.surfer/engine"
    
      98  pnpm surfer download
    
      99  env SURFER_COMPAT="$CARCH" pnpm surfer import
    
      100
    
      101  srcdir="$srcdir" sh scripts/download-language-packs.sh
    
      102
    
      103  cat >mozconfig <<END
    
      104mk_add_options MOZ_OBJDIR=${srcdir}/$_OBJ_DIR
    
      105ac_add_options --prefix=/usr
    
      106ac_add_options --enable-optimize
    
      107ac_add_options --enable-rust-simd
    
      108ac_add_options --disable-debug
    
      109ac_add_options --disable-tests
    
      110ac_add_options --enable-linker=mold
    
      111ac_add_options --enable-lto
    
      112ac_add_options --disable-frame-pointers
    
      113ac_add_options --disable-bootstrap
    
      114ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
    
      115ac_add_options --allow-addon-sideload
    
      116export MOZ_APP_REMOTINGNAME=$pkgbase
    
      117ac_add_options --with-system-nspr
    
      118ac_add_options --with-system-nss
    
      119ac_add_options --disable-crashreporter
    
      120ac_add_options --disable-updater
    
      121ac_add_options --target=x86_64-pc-linux-gnu
    
      122END
    
      123}
    
      124
    
      125_mach() {
    
      126  "$srcdir/desktop/engine/mach" "$@"
    
      127}
    
      128
    
      129build() {
    
      130  export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=pip
    
      131  export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
    
      132  MOZ_BUILD_DATE="$(date -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH} +%Y%m%d%H%M%S)"
    
      133  export MOZ_BUILD_DATE
    
      134  export MOZ_NOSPAM=1
    
      135  export CC=clang
    
      136  export CXX=clang++
    
      137  export AR=llvm-ar
    
      138  export NM=llvm-nm
    
      139  export RANLIB=llvm-ranlib
    
      140
    
      141  CFLAGS="${CFLAGS/-fexceptions/}"
    
      142  CXXFLAGS="${CXXFLAGS/-fexceptions/}"
    
      143
    
      144  ulimit -n 4096
    
      145  unset MOZ_PGO
    
      146  
    
      147  (
    
      148    cd "$srcdir/desktop"
    
      149    if [ -f "./engine/build/clang-plugin/moz.build" ]; then
    
      150        sed -i 's/clangASTMatchers/clang-cpp/g' ./engine/build/clang-plugin/moz.build
    
      151    fi
    
      152
    
      153    pnpm run ffprefs
    
      154    
    
      155    env SURFER_COMPAT="$CARCH" SURFER_PLATFORM=linux ZEN_RELEASE_BRANCH=release ZEN_RELEASE=1 \
    
      156    dbus-run-session xvfb-run -s "-screen 0 1920x1080x24 -nolisten local" \
    
      157    pnpm surfer build --skip-patch-check
    
      158  )
    
      159
    
      160  local _l10n_dir="$srcdir/l10n"
    
      161  if [ -d "$_l10n_dir" ]; then
    
      162    for _lang_dir in "$_l10n_dir"/*; do
    
      163      if [ -d "$_lang_dir" ]; then
    
      164        _lang=$(basename "$_lang_dir")
    
      165        if [[ "$_lang" != "en-US" && "$_lang" != ".git" ]]; then
    
      166          _mach build "merge-$_lang" || true
    
      167          _mach build "langpack-$_lang" || true
    
      168        fi
    
      169      fi
    
      170    done
    
      171  fi
    
      172}
    
      173
    
      174package_zen-browser-git() {
    
      175  provides=("zen-browser=$pkgver" "zen-browser")
    
      176  conflicts=("zen-browser" "zen-browser-bin")
    
      177  DESTDIR="$pkgdir" _mach install
    
      178  
    
      179  local _appdir="$pkgdir/usr/lib/$pkgbase"
    
      180  rm -rf "$_appdir"
    
      181  if [ -d "$pkgdir/usr/lib/zen" ]; then mv "$pkgdir/usr/lib/zen" "$_appdir"; fi
    
      182
    
      183  ln -srvf "$_appdir"/zen "$_appdir/zen-bin"
    
      184  ln -srvf "$_appdir"/zen "$pkgdir"/usr/bin/zen-git
    
      185
    
      186  install -Dvm644 "$srcdir"/desktop/build/AppDir/distribution/*.json -t "$_appdir/distribution" || true
    
      187  
    
      188  local _vendorjs="$_appdir/browser/defaults/preferences/vendor.js"
    
      189  mkdir -p "$(dirname "$_vendorjs")"
    
      190  echo 'pref("spellchecker.dictionary_path", "/usr/share/hunspell");' >> "$_vendorjs"
    
      191  echo 'pref("intl.locale.requested", "");' >> "$_vendorjs"
    
      192
    
      193  local _dist_dir="$srcdir/obj/dist"
    
      194  find "$_dist_dir" -name "*.langpack.xpi" -exec install -Dvm644 {} "$pkgdir/usr/lib/$pkgbase/browser/extensions/" \;
    
      195
    
      196  install -Dvm644 "$srcdir"/zen-browser.desktop "$pkgdir/usr/share/applications/$pkgbase.desktop"
    
      197
    
      198  for i in 16 32 48 64 128; do
    
      199    install -d "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps"
    
      200    ln -srvf \
    
      201      "$_appdir/browser/chrome/icons/default/default${i}.png" \
    
      202      "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$pkgbase.png"
    
      203  done
    
      204  
    
      205  local _svg_icon="$srcdir/desktop/docs/assets/zen-black.svg"
    
      206  if [ -f "$_svg_icon" ]; then
    
      207      install -Dvm644 "$_svg_icon" "$pkgdir/usr/share/icons/hicolor/scalable/apps/$pkgbase.svg"
    
      208  fi
    
      209
    
      210  sed -i "s|Icon=.*|Icon=$pkgbase|g" "$pkgdir/usr/share/applications/$pkgbase.desktop"
    
      211  sed -i "s|Exec=.*|Exec=/usr/lib/zen-browser-git/zen %u|g" "$pkgdir/usr/share/applications/$pkgbase.desktop"
    
      212  
    
      213  echo "StartupWMClass=zen-alpha" >> "$pkgdir/usr/share/applications/$pkgbase.desktop"
    
      214  echo "StartupWMClass=zen" >> "$pkgdir/usr/share/applications/$pkgbase.desktop"
    
      215  echo "StartupWMClass=Zen Browser" >> "$pkgdir/usr/share/applications/$pkgbase.desktop"
    
      216}
    
      217

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0