drops-cursor-theme

LOW

maintainer gaougalos 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads theme files from gnome-look.org, a plausible project host, and installs them as cursor themes; these are non-executable data files, so even if the source were compromised, the worst-case impact is limited to visual or cosmetic changes.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads theme files from gnome-look.org, a plausible project host, and installs them as cursor themes; these are non-executable data files, so even if the source were compromised, the worst-case impact is limited to visual or cosmetic changes.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 active_files=$(curl -Lsf "https://www.gnome-look.org/p/${_pkgid}/loadFiles" | \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gaou Piou <i.am.piou@gmail.com>
    
      2
    
      3pkgname=drops-cursor-theme
    
      4pkgver=2026.06.05.200310
    
      5pkgrel=2
    
      6_pkgid=2330173
    
      7pkgdesc="HDPI cursor theme drawn from scratch, available in 32/48/64/96px sizes"
    
      8arch=('any')
    
      9url="https://www.gnome-look.org/p/${_pkgid}"
    
      10license=('GPL-3.0-or-later')
    
      11depends=()
    
      12makedepends=('curl' 'jq' 'perl' 'python' 'unzip')
    
      13options=('!strip' '!docs' '!debug')
    
      14install=drops-cursor-theme.install
    
      15source=('xcursor-to-scalable.py')
    
      16sha256sums=('94b535771dcfe40ec606295f5929cbbcb9cd309dff4c1e4d7c9a7c4babf20798')
    
      17
    
      18pkgver() {
    
      19  local json timestamp
    
      20  json=$(curl -sL "https://www.gnome-look.org/p/${_pkgid}/loadFiles")
    
      21  timestamp=$(echo "$json" | jq -r '[.files[]] | sort_by(.updated_timestamp) | last | .updated_timestamp')
    
      22  date -d"$timestamp" +%Y.%m.%d.%H%M%S
    
      23}
    
      24
    
      25prepare() {
    
      26  local active_files sorted_files download_url filename
    
      27  active_files=$(curl -Lsf "https://www.gnome-look.org/p/${_pkgid}/loadFiles" | \
    
      28    jq -r '.files[] | select(.active == "1")')
    
      29  sorted_files=$(echo "$active_files" | jq -s 'sort_by(.updated_timestamp)')
    
      30
    
      31  while IFS= read -r file; do
    
      32    download_url=$(echo "$file" | perl -pe 's/\%(\w\w)/chr hex $1/ge')
    
      33    filename=$(basename "$download_url")
    
      34    if [[ -f "$filename" ]]; then
    
      35      echo "$filename already downloaded"
    
      36      continue
    
      37    fi
    
      38    echo "downloading $filename"
    
      39    if ! curl -Lsf "$download_url" -o "$filename"; then
    
      40      echo "failed to download $filename, retrying in 7 minutes..."
    
      41      sleep 420
    
      42      curl -Lf "$download_url" -o "$filename"
    
      43    fi
    
      44    sleep 10
    
      45  done < <(echo "$sorted_files" | jq -r '.[].url')
    
      46}
    
      47
    
      48build() {
    
      49  for f in *.zip; do
    
      50    [[ -f "$f" ]] || continue
    
      51    unzip -o "$f"
    
      52  done
    
      53  rm -f ./*.zip
    
      54
    
      55  # GNOME Shell 50+ only loads cursors_scalable/ (SVG); Xcursor-only themes fall back to Adwaita
    
      56  find "$srcdir" -mindepth 2 -maxdepth 2 -type d -exec test -d {}/cursors \; -print0 |
    
      57    xargs -0 python3 -I "$srcdir/xcursor-to-scalable.py"
    
      58}
    
      59
    
      60package() {
    
      61  install -dm755 "$pkgdir/usr/share/icons"
    
      62  find "$srcdir" -mindepth 2 -maxdepth 2 -type d \
    
      63    -exec cp -dr --no-preserve=ownership {} "$pkgdir/usr/share/icons/" \;
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2