Package Details: mullvad-browser-bin 13.0.14-1

Git Clone URL: https://aur.archlinux.org/mullvad-browser-bin.git (read-only, click to copy)
Package Base: mullvad-browser-bin
Description: Privacy-focused web browser developed by Mullvad VPN and the Tor Project
Upstream URL: https://mullvad.net/en/browser
Keywords: browser firefox mullvad privacy private
Licenses: MPL-2.0, GPL-3.0-or-later
Conflicts: mullvad-browser
Provides: mullvad-browser
Submitter: tarball
Maintainer: tarball
Last Packager: tarball
Votes: 28
Popularity: 3.72
First Submitted: 2023-04-03 14:58 (UTC)
Last Updated: 2024-04-16 17:48 (UTC)

Dependencies (14)

Required by (0)

Sources (4)

Latest Comments

« First ‹ Previous 1 2 3 Next › Last »

pospeselr commented on 2023-04-23 11:30 (UTC) (edited on 2023-04-23 11:32 (UTC) by pospeselr)

To anyone wanting to build a from-source source package, this is going to be a bit complicated but should be possible. You'll want to have a look at the tor-browser-build project on our gitlab, particularly the 'firefox' and 'browser' projects:

Mullvad-Browser is much closer to vanilla Firefox than Tor Browser is in terms of the amount of build customization, but there are still several things that we also package in the final firefox build including (and likely not limited to):

  • the allow-listed fonts
  • ublock origin
  • noscript
  • mullvad privacy companion

To verify any built package matches the official bins fingerprint, you can use TZP: https://github.com/arkenfox/TZP

The TZP maintainer (Thorin Oakenpants) will be working closely with us over the coming months to update the site with more fingerprinting vectors and official Mullvad Browser support.

NOTE: if the official release and the source calculated release fingers prints don't match, then you will be explicitly reducing the size of the fingerprinting bucket for users of the source package (ie: they will stand out as source-package Arch users to any malicious actors willing to check, making them easier to fingerprint and track).

We update our browsers (Mullvad and Tor Browser) monthly, so any source package will need an active maintainer lest it fall behind. Historical data suggests the majority of Tor Browser users are updated within about a 1 week window (based on update ping requests) so I would assume Mullvad Browser will follow the same approximate time frame. This means the Arch package will also need to update asap to avoid users falling behind on security updates and making themselves easier to track (again by virtue of being in a smaller fingerprint bucket as fingerprints can change between browser versions).

If this work sounds interesting to anyone out there, we'd be happy to help over in #tor-browser-dev on OFTC IRC, or you can find us on the tor-dev mailing list: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev/

We would also be happy to add whomever wishes to maintain this to a list of downstream contacts whom we ping when new updates/signed tags are available!

tarball commented on 2023-04-23 11:26 (UTC)

Posted to https://aur.archlinux.org/packages/mullvad-browser

It hasn't been tested much besides basic smoke tests, so I don't recommend it over mullvad-browser-bin.

<deleted-account> commented on 2023-04-22 15:43 (UTC)

Would it be possible for you to post a package to be built from source?

pospeselr commented on 2023-04-06 12:46 (UTC)

@tarball Hey, I'm the dev lead of Mullvad Browser over at the Tor Project. Can you send me/post your email so we can notify you of version updates or build changes that would affect your arch package? I can be reached at richard@torproject.org.

kaivai commented on 2023-04-06 02:41 (UTC)

ZorinArch: I think that messages is saying that on your $PATH environment variable, there is an entry :./node_modules/.bin which find would like you to get rid of.

yochananmarqos commented on 2023-04-04 00:02 (UTC)

Another reason not to rename the source tarball is that it's signed and can be verified. See Verifying Mullvad Browser signature.

See my improved PKGBUILD

yochananmarqos commented on 2023-04-03 21:56 (UTC) (edited on 2023-04-03 21:57 (UTC) by yochananmarqos)

Please replace all instances of $_pkgbase with either ${pkgname%-bin} or mullvad-browser. Do not name anything in the package mullvad-browser-bin.

Install the contents of the Browser folder, don't install the folder itself.

The package can be stripped, there's no reason to disable it.

There's no reason to rename the source tarball, it already has the name and version in it.

EDIT: Sorry, somehow the comment posted twice. I deleted the duplicate.

tarball commented on 2023-04-03 16:24 (UTC) (edited on 2023-04-04 07:46 (UTC) by tarball)

Yeah, sorry about that. It worked fine until I wiped everything locally and reinstalled from AUR.

ZorinArch commented on 2023-04-03 16:12 (UTC)

i got this error:

find: The relative path ‘./node_modules/.bin’ is included in the PATH environment variable, which is insecure in combination with the -execdir action of find.  Please remove that entry from $PATH

« First ‹ Previous 1 2 3 Next › Last »