Package Details: tor-browser-bin 15.0.24-1

Git Clone URL: https://aur.archlinux.org/tor-browser-bin.git (read-only, click to copy)
Package Base: tor-browser-bin
Description: Tor Browser Bundle: anonymous browsing using Firefox and Tor
Upstream URL: https://www.torproject.org/projects/torbrowser.html
Licenses: MPL-2.0
Conflicts: tor-browser
Provides: tor-browser
Submitter: FabioLolix
Maintainer: grufo (jugs)
Last Packager: jugs
Votes: 1309
Popularity: 5.11
First Submitted: 2023-09-24 17:45 (UTC)
Last Updated: 2026-09-30 13:30 (UTC)

Pinned Comments

grufo commented on 2019-08-15 02:22 (UTC)

Before running makepkg, you must do this (as normal user):

$ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

If you want to update tor-browser from AUR without AUR helpers you can run in a terminal:

$ tor-browser -u

Latest Comments

1 2 3 4 5 6 .. 79 Next › Last »

jvybihal commented on 2026-10-04 15:30 (UTC)

I am also done using this piece of obfuscated grabrage masking as "security". The GPG rotaion is also bullshit, and telling people just blidly "run this command to get the new key" is utter nonsense in terms of actual security.

ogghi commented on 2026-10-03 14:45 (UTC)

I actually removed this from my system as well. Will have a look at manually building it at this point!

lightdot commented on 2026-09-13 21:51 (UTC) (edited on 2026-09-13 21:53 (UTC) by lightdot)

This PKGBUILD deliberately circumvents proper checksum verification for the downloaded binaries, defeating its very purpose.

Circumventing it is not only against Arch Linux policies, it's simply bad security practice that greatly increases user exposure to sophisticated MITM attacks. The checksum verification is an important additional security layer in addition to the GPG signature. The latter does not replace it.

@grufo, @jugs, as current maintainers, this security issue has already been reported by @Maxr on 2026-02-14 20:40 (UTC). Please act upon it ASAP or, should you lack the time to address this, please consider disowning the package.

As is, I advise all users to stop using this PKGBUILD and the resulting binaries until the issue is resolved.

jugs commented on 2026-06-04 15:21 (UTC)

@medaminezghal,

Because this package treats /opt/tor-browser as the system-managed cache/source, not the runnable browser install. There's a number of reasons why we don't install there...

  1. Tor Browser expects a writable bundle - Tor Browser keeps some runtime/update/profile-ish state inside its own extracted tree. A normal user cannot write to /opt without root.
  2. Avoid running browser/updater as root - Making Tor Browser update or modify files under /opt would require root privileges, which is bad from a security perspective.
  3. Per-user isolation - Each Linux user gets their own Tor Browser copy and data under their home directory.
  4. Pacman ownership safety - If Tor Browser modifies files under /opt, those files would no longer cleanly match what pacman installed. Keeping the real mutable copy outside pacman-owned paths avoids package-manager conflicts.
  5. Updates are staged safely - On package upgrade, pacman replaces the tarball in /opt; the next normal user launch refreshes the user-local copy.

medaminezghal commented on 2026-05-14 11:50 (UTC)

@grufo Why don't you install tor-browser fully under /opt/tor-browser? Why it's under ~/.local/opt/tor-browser?

grufo commented on 2026-05-10 12:57 (UTC)

@ilovemikael: Alright. Grammar fixed.

ilovemikael commented on 2026-05-08 10:11 (UTC) (edited on 2026-05-08 10:13 (UTC) by ilovemikael)

@grufo - My mistake on the .desktop file, thanks for clarifying the spec (I was fixing it for the alpha package, and when I made it use the pkgver, it worked, but I think I confounded that as fixing the file when changing [Dsektop Entry] to [Desktop Entry] was the real fix, always the red herrings!).

  • For the typo, I mean that 'you do not have installed ${TB_PKGNAME} yet' is incorrect grammar; it should be 'you don't have ${TB_PKGNAME} installed yet' or something like that. The shell var is spelt fine :).

grufo commented on 2026-04-22 06:06 (UTC) (edited on 2026-04-22 06:06 (UTC) by grufo)

@ilovemikael:

  • The Version key in the .desktop file does refer to Tor Browser's version, but to “the version of the desktop entry specification to which this file conforms” (see the wiki)
  • What typo? The shell variable is called _TB_PKGNAME_.

ilovemikael commented on 2026-04-19 04:25 (UTC)

Hi, the value of Version in the desktop file (1.0) should be switched to @PACKAGE_VERSION@ to work with the _sed_subst function; also, although it is pestilentially petty to point out, considering that the words should be printed only if things go awry, my moral barometer nonetheless impels me to inform you that line 212 of the shell script has a typo ("you do not have installed ${TB_PKGNAME} yet"). Good day.

jugs commented on 2026-04-07 15:35 (UTC) (edited on 2026-04-07 15:35 (UTC) by jugs)

@zuzavo, I am seeing that the window is tiling by default in hyprland as well. I don't think that's a bug as the tor-browser package has nothing to do with your compositor/window manager. If you want to edit your hyprland config you can make it floating by default:

windowrule = float 1, match:class Tor Browser

1 2 3 4 5 6 .. 79 Next › Last »