| Git Clone URL: | https://aur.archlinux.org/mullvad-browser-bin.git (read-only, click to copy) |
|---|---|
| Package Base: | mullvad-browser-bin |
| Description: | Privacy-focused web browser developed by Mullvad VPN and the Tor Project |
| Upstream URL: | https://mullvad.net/en/browser |
| Keywords: | browser firefox mullvad privacy private |
| Licenses: | MPL-2.0, GPL-3.0-or-later |
| Conflicts: | mullvad-browser |
| Provides: | mullvad-browser |
| Submitter: | tarball |
| Maintainer: | tarball |
| Last Packager: | tarball |
| Votes: | 56 |
| Popularity: | 4.96 |
| First Submitted: | 2023-04-03 14:58 (UTC) |
| Last Updated: | 2025-04-01 16:44 (UTC) |
I had a problem with a missing public PGP key ; trying to import it failed. It was necessary to specify a server to import the key.
I was recommended the following line to be able to import it :
gpg --keyserver hkps://keys.openpgp.org --recv-keys E53D989A9E2D47BF ✔
gpg: key 4E2C6E8793298290: public key "Tor Browser Developers (signing key) torbrowser@torproject.org" imported
gpg: Total number processed: 1
gpg: imported: 1
@kaivai thank you, i fix that issue.
To anyone wanting to build a from-source source package, this is going to be a bit complicated but should be possible. You'll want to have a look at the tor-browser-build project on our gitlab, particularly the 'firefox' and 'browser' projects:
Mullvad-Browser is much closer to vanilla Firefox than Tor Browser is in terms of the amount of build customization, but there are still several things that we also package in the final firefox build including (and likely not limited to):
To verify any built package matches the official bins fingerprint, you can use TZP: https://github.com/arkenfox/TZP
The TZP maintainer (Thorin Oakenpants) will be working closely with us over the coming months to update the site with more fingerprinting vectors and official Mullvad Browser support.
NOTE: if the official release and the source calculated release fingers prints don't match, then you will be explicitly reducing the size of the fingerprinting bucket for users of the source package (ie: they will stand out as source-package Arch users to any malicious actors willing to check, making them easier to fingerprint and track).
We update our browsers (Mullvad and Tor Browser) monthly, so any source package will need an active maintainer lest it fall behind. Historical data suggests the majority of Tor Browser users are updated within about a 1 week window (based on update ping requests) so I would assume Mullvad Browser will follow the same approximate time frame. This means the Arch package will also need to update asap to avoid users falling behind on security updates and making themselves easier to track (again by virtue of being in a smaller fingerprint bucket as fingerprints can change between browser versions).
If this work sounds interesting to anyone out there, we'd be happy to help over in #tor-browser-dev on OFTC IRC, or you can find us on the tor-dev mailing list: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev/
We would also be happy to add whomever wishes to maintain this to a list of downstream contacts whom we ping when new updates/signed tags are available!
Posted to https://aur.archlinux.org/packages/mullvad-browser
It hasn't been tested much besides basic smoke tests, so I don't recommend it over mullvad-browser-bin.
Would it be possible for you to post a package to be built from source?
@tarball Hey, I'm the dev lead of Mullvad Browser over at the Tor Project. Can you send me/post your email so we can notify you of version updates or build changes that would affect your arch package? I can be reached at richard@torproject.org.
ZorinArch: I think that messages is saying that on your $PATH environment variable, there is an entry :./node_modules/.bin which find would like you to get rid of.
Another reason not to rename the source tarball is that it's signed and can be verified. See Verifying Mullvad Browser signature.
See my improved PKGBUILD
Please replace all instances of $_pkgbase with either ${pkgname%-bin} or mullvad-browser. Do not name anything in the package mullvad-browser-bin.
Install the contents of the Browser folder, don't install the folder itself.
The package can be stripped, there's no reason to disable it.
There's no reason to rename the source tarball, it already has the name and version in it.
EDIT: Sorry, somehow the comment posted twice. I deleted the duplicate.
Pinned Comments
tarball commented on 2025-03-12 18:00 (UTC)
Please discuss bugs here before reporting them upstream, especially if they can't be reproduced with the original tarballs. Some bugs are caused by packaging issues and need to be fixed here. We can always escalate upstream if necessary.
tarball commented on 2024-06-26 08:35 (UTC)
Make sure to fetch the developers' signing key before building the package.
The official instructions are here. The link is also mentioned in the
PKGBUILD.If the site is blocked in your region, you'll have to work around it or trust me that this is what it says:
which (as of 2024-06-26) should also show this fingerprint:
If your gpg says otherwise, you may have been fed garbage.