lightdm-slick-greeter-mint-theme

maintainer Santi-Burgos · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a wallpaper from an untrusted external host (bing.com) during package build using wget, which is not listed in source=() and has no checksum verification, creating a potential supply-chain risk if the endpoint were compromised.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:69 wget -O slick-greeter.png "http://www.bing.com/$(wget -q -O- https://binged.it/2ZButYc | sed -e 's/<[^>]*>//g' | cut -d / -f2 | cut -d \& -f1)"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The PKGBUILD downloads a wallpaper from an untrusted external host (bing.com) during package build using wget, which is not listed in source=() and has no checksum verification, creating a potential supply-chain risk if the endpoint were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Santiago Burgos <santiago.burgos1089@gmail.com>
    
      2
    
      3pkgname=lightdm-slick-greeter-mint-theme
    
      4_pkgname=slick-greeter
    
      5pkgver=2.2.7
    
      6pkgrel=1
    
      7pkgdesc="A slick-looking LightDM greeter. With additional options enabled"
    
      8arch=('x86_64')
    
      9url="https://github.com/linuxmint/${_pkgname}"
    
      10license=('GPL3')
    
      11depends=(
    
      12    'cairo'
    
      13    'freetype2'
    
      14    'gtk3'
    
      15    'libcanberra'
    
      16    'libxext'
    
      17    'lightdm-guest'
    
      18    'mint-themes'
    
      19    'pixman'
    
      20    'python-gobject'
    
      21    'xapp'
    
      22    'xorg-server'
    
      23)
    
      24optdepends=(
    
      25    'cinnamon-styles-artwork: enable full artwork theme in Cinnamon'
    
      26    'lightdm-settings: allow configuration of slick-greeter'
    
      27    'mint-l-theme: enable additional Mint themes'
    
      28    'numlockx: enable numerical keypad on supported keyboard'
    
      29)
    
      30makedepends=(
    
      31    'meson'
    
      32    'vala'
    
      33)
    
      34provides=(
    
      35    'lightdm-slick-greeter'
    
      36)
    
      37conflicts=(
    
      38    'lightdm-slick-greeter'
    
      39)
    
      40backup=("etc/lightdm/${_pkgname}.conf")
    
      41install="${_pkgname}.install"
    
      42source=(
    
      43    "${_pkgname}-$pkgver.tar.gz::${url}/archive/${pkgver}.tar.gz"
    
      44    "${_pkgname}.conf"
    
      45)
    
      46sha256sums=(
    
      47    'f685da6ca9d97329b4b200077d12db0ad4f9964d4515479e6c00bba721ab0626'
    
      48    '6ce9dda9e5f343e142926e7ed7aa127137214b823362653745cfe1f9d56c4492'
    
      49)
    
      50
    
      51build() {
    
      52    arch-meson "${_pkgname}-${pkgver}" build
    
      53    meson compile -C build
    
      54}
    
      55
    
      56package() {
    
      57    meson install -C build --no-rebuild --destdir "$pkgdir"
    
      58
    
      59    # adjust launcher name
    
      60    mv "${pkgdir}/usr/share/xgreeters/${_pkgname}.desktop" \
    
      61        "${pkgdir}/usr/share/xgreeters/lightdm-slick-greeter.desktop"
    
      62
    
      63    # Install default conf
    
      64    install -Dm644 "${srcdir}/${_pkgname}.conf" -t "${pkgdir}/etc/lightdm/"
    
      65
    
      66    # Download latest Bing wallpaper from internet
    
      67    # Credits to https://forum.linuxconfig.org/t/how-to-download-bing-wallpaper-with-bash-shell-one-liner/3457
    
      68    cd "${srcdir}"
    
      69    wget -O slick-greeter.png "http://www.bing.com/$(wget -q -O- https://binged.it/2ZButYc | sed -e 's/<[^>]*>//g' | cut -d / -f2 | cut -d \& -f1)"
    
      70
    
      71    # Installing downloaded Bing wallpaper as slick-greeter wallpaper
    
      72    install -Dm644 "${srcdir}/${_pkgname}.png" -t "${pkgdir}/usr/share/${_pkgname}/"
    
      73}
    
      74
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 21:49:43	MEDIUM	2