moga-neon-cursor-theme

maintainer gaougalos · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged This PKGBUILD downloads cursor theme ZIP files (pure data/assets, not compiled binaries or executed code) from gnome-look.org, which is the legitimate upstream host for this type of content. The files are icon/cursor themes that get installed to /usr/share/icons — they are not executed. The lack of checksums in source=() is a real integrity concern (no pinned hashes), but the content being downloaded is passive data (cursor images), not executables or libraries. The dynamic URL resolution via the gnome-look.org API is unconventional but gnome-look.org is the canonical distribution platform for this content. The risk is sloppy/non-standard packaging rather than a genuine supply-chain code-execution threat. Rating: low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 72%): This PKGBUILD downloads cursor theme ZIP files (pure data/assets, not compiled binaries or executed code) from gnome-look.org, which is the legitimate upstream host for this type of content. The files are icon/cursor themes that get installed to /usr/share/icons — they are not executed. The lack of checksums in source=() is a real integrity concern (no pinned hashes), but the content being downloaded is passive data (cursor images), not executables or libraries. The dynamic URL resolution via the gnome-look.org API is unconventional but gnome-look.org is the canonical distribution platform for this content. The risk is sloppy/non-standard packaging rather than a genuine supply-chain code-execution threat. Rating: low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 active_files=$(curl -Lsf "https://www.gnome-look.org/p/${_pkgid}/loadFiles" | \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gaou Piou <i.am.piou@gmail.com>
    
      2
    
      3pkgname=moga-neon-cursor-theme
    
      4pkgver=2026.05.11.063410
    
      5pkgrel=1
    
      6_pkgid=2302110
    
      7pkgdesc="Neon cursor theme with multiple color variants (Blue, Cyan, Green, Magenta, Orange, Purple, Red, Rose, Sandy, Sky, Water, Yellow, Butter, Olieve)"
    
      8arch=('any')
    
      9url="https://www.gnome-look.org/p/${_pkgid}"
    
      10license=('GPL-3.0-or-later')
    
      11depends=()
    
      12makedepends=('curl' 'jq' 'perl' 'unzip')
    
      13options=('!strip' '!docs' '!debug')
    
      14install=moga-neon-cursor-theme.install
    
      15source=()
    
      16sha256sums=()
    
      17
    
      18pkgver() {
    
      19  local json timestamp
    
      20  json=$(curl -sL "https://www.gnome-look.org/p/${_pkgid}/loadFiles")
    
      21  timestamp=$(echo "$json" | jq -r '[.files[]] | sort_by(.updated_timestamp) | last | .updated_timestamp')
    
      22  date -d"$timestamp" +%Y.%m.%d.%H%M%S
    
      23}
    
      24
    
      25prepare() {
    
      26  local active_files sorted_files download_url filename
    
      27  active_files=$(curl -Lsf "https://www.gnome-look.org/p/${_pkgid}/loadFiles" | \
    
      28    jq -r '.files[] | select(.active == "1")')
    
      29  sorted_files=$(echo "$active_files" | jq -s 'sort_by(.updated_timestamp)')
    
      30
    
      31  while IFS= read -r file; do
    
      32    download_url=$(echo "$file" | perl -pe 's/\%(\w\w)/chr hex $1/ge')
    
      33    filename=$(basename "$download_url")
    
      34    if [[ -f "$filename" ]]; then
    
      35      echo "$filename already downloaded"
    
      36      continue
    
      37    fi
    
      38    echo "downloading $filename"
    
      39    if ! curl -Lsf "$download_url" -o "$filename"; then
    
      40      echo "failed to download $filename, retrying in 7 minutes..."
    
      41      sleep 420
    
      42      curl -Lf "$download_url" -o "$filename"
    
      43    fi
    
      44    sleep 10
    
      45  done < <(echo "$sorted_files" | jq -r '.[].url')
    
      46}
    
      47
    
      48build() {
    
      49  for f in *.zip; do
    
      50    [[ -f "$f" ]] || continue
    
      51    unzip -o "$f"
    
      52  done
    
      53  rm -f ./*.zip
    
      54}
    
      55
    
      56package() {
    
      57  install -dm755 "$pkgdir/usr/share/icons"
    
      58  find "$srcdir" -mindepth 2 -maxdepth 2 -type d \
    
      59    -exec cp -dr --no-preserve=ownership {} "$pkgdir/usr/share/icons/" \;
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2