dripbox

LOW

maintainer marchos1as 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The binary tarball is downloaded from Dropbox's own official CDN (edge.dropboxstatic.com) and verified with Dropbox's official PGP signing key, making supply-chain substitution very difficult; the SKIP'd checksum on the tarball is acceptable given PGP verification. The package name 'dripbox' vs the actual Dropbox content is slightly suspicious (typosquatting concern) but the sources and signing key are legitimate Dropbox infrastructure.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The binary tarball is downloaded from Dropbox's own official CDN (edge.dropboxstatic.com) and verified with Dropbox's official PGP signing key, making supply-chain substitution very difficult; the SKIP'd checksum on the tarball is acceptable given PGP verification. The package name 'dripbox' vs the actual Dropbox content is slightly suspicious (typosquatting concern) but the sources and signing key are legitimate Dropbox infrastructure.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 "https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-$pkgver.tar.gz"{,.asc})

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Massimiliano Torromeo <massimiliano.torromeo@gmail.com>
    
      2# Contributor: Chih-Hsuan Yen <yan12125@gmail.com>
    
      3# Contributor: Tom < tomgparchaur at gmail dot com >
    
      4# Contributor: David Manouchehri <d@32t.ca>
    
      5
    
      6pkgname=dripbox
    
      7pkgver=272.4.3798
    
      8pkgrel=1
    
      9pkgdesc="A free service that lets you bring your photos, docs, and videos anywhere and share them easily."
    
      10arch=("x86_64")
    
      11url="https://www.dropbox.com"
    
      12license=(custom:Dropbox)
    
      13depends=("libsm" "libxslt" "libxmu" "libxdamage" "libxrender" "libxxf86vm" "libxcomposite" "fontconfig" "dbus")
    
      14makedepends=("gendesk")
    
      15optdepends=(
    
      16  'ufw-extras: ufw rules for dropbox'
    
      17  'perl-file-mimeinfo: opening dropbox folder on some desktop environments'
    
      18  'xdg-utils: for "Launch Dropbox Website" and file manager integration'
    
      19  'libappindicator-gtk3: make tray icons themed under some desktop environments like KDE plasma'
    
      20)
    
      21options=('!strip')
    
      22
    
      23# https://www.dropbox.com/scl/fo/0eu2dsn07fy5k0gt5fy74/AABbXqKHbY_mobVJhqgfOXYja/Glyph/Dropbox/SVG/DropboxGlyph_Blue.svg
    
      24source=("DropboxGlyph_Blue.svg"
    
      25        "terms.txt"
    
      26        "dropbox.service"
    
      27        "dropbox@.service"
    
      28        "https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-$pkgver.tar.gz"{,.asc})
    
      29
    
      30sha256sums=('9ba76205ec5838db85d822f23cfd7e2112fd2757e8031d8374709f102143c548'
    
      31            '1610ff57e8b20ee7a37682c3cc505da4ddc9cec2bd7234c90c0f2073657521d2'
    
      32            '6c67a9c8c95c08fafafd2f1d828074b13e3347b05d2e4f4bf4e62746115d7477'
    
      33            '98581e65a91ae1f19ed42edcdaaa52e102298b5da0d71b50089393d364474d3d'
    
      34            'bf0b0945ace2c02fe790189fece8a2fa9c3a9c7e9fef879eb34b01098a957a01'
    
      35            'SKIP')
    
      36# The PGP key fingerprint should match the one on https://www.dropbox.com/help/desktop-web/linux-commands
    
      37validpgpkeys=(
    
      38  '1C61A2656FB57B7E4DE0F4C1FC918B335044912E'  # Dropbox Automatic Signing Key <linux@dropbox.com>
    
      39)
    
      40
    
      41prepare() {
    
      42  gendesk --pkgname="$pkgname" --pkgdesc="$pkgdesc" --categories=Network -f PKGBUILD
    
      43}
    
      44
    
      45package() {
    
      46  install -d "$pkgdir"/opt
    
      47  cp -dr --no-preserve=ownership "$srcdir"/.dropbox-dist/dropbox-lnx.x86_64-$pkgver "$pkgdir"/opt/dropbox
    
      48  chmod 755 "$pkgdir"/opt/dropbox/*.so
    
      49
    
      50  install -d "$pkgdir"/usr/bin
    
      51  ln -s ../../opt/dropbox/dropbox "$pkgdir"/usr/bin/dropbox
    
      52
    
      53  install -Dm644 "$srcdir"/dropbox.desktop -t "$pkgdir"/usr/share/applications
    
      54  install -Dm644 "$srcdir"/DropboxGlyph_Blue.svg "$pkgdir"/usr/share/pixmaps/dropbox.svg
    
      55  install -Dm644 "$srcdir"/terms.txt -t "$pkgdir"/usr/share/licenses/$pkgname
    
      56  install -Dm644 "$srcdir"/dropbox.service -t "$pkgdir"/usr/lib/systemd/user
    
      57  install -Dm644 "$srcdir"/dropbox@.service -t "$pkgdir"/usr/lib/systemd/system
    
      58}
    
      59
    
      60pkgrel=2
    
      61install="$pkgname.install"
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 01:22:29	Low	3
2026-10-14 01:18:27	Medium	2