vibrancy-colors

maintainer oberon2007 · 57 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads an icon theme tarball (pure data: SVG/PNG icons) from Dropbox. While Dropbox is a personal/unofficial host and not ideal for packaging, the content being installed is only icon theme files placed under /usr/share/icons — no compiled code, no executed binaries, no scripts. The sha1sum provides integrity verification against accidental or opportunistic substitution. The risk is that the Dropbox link could be swapped by the account owner, but this is a supply-chain hygiene issue rather than an active threat. Icon themes are pure data and cannot execute code on installation. This is sloppy packaging (should use an official release host) but not a meaningful security risk, making it low rather than medium.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 72%): The package downloads an icon theme tarball (pure data: SVG/PNG icons) from Dropbox. While Dropbox is a personal/unofficial host and not ideal for packaging, the content being installed is only icon theme files placed under /usr/share/icons — no compiled code, no executed binaries, no scripts. The sha1sum provides integrity verification against accidental or opportunistic substitution. The risk is that the Dropbox link could be swapped by the account owner, but this is a supply-chain hygiene issue rather than an active threat. Icon themes are pure data and cannot execute code on installation. This is sloppy packaging (should use an official release host) but not a meaningful security risk, making it low rather than medium.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("v$pkgver.tar.gz::https://www.dropbox.com/s/sealvky0fzusfix/Vibrancy-Colors-GTK-Icon-Theme-v-2-7.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Bernhard Landauer <oberon@manjaro.org>
    
      2
    
      3pkgname=vibrancy-colors
    
      4pkgver=2.7
    
      5pkgrel=2
    
      6pkgdesc="Modern, clean and customizable flat icon theme"
    
      7arch=('any')
    
      8url="http://www.ravefinity.com/p/vibrancy-colors-gtk-icon-theme.html"
    
      9license=('CCPL:by-sa' 'GPL2')
    
      10options=('!strip')
    
      11source=("v$pkgver.tar.gz::https://www.dropbox.com/s/sealvky0fzusfix/Vibrancy-Colors-GTK-Icon-Theme-v-2-7.tar.gz")
    
      12sha1sums=('0a42fb74af7463215f126e9aff9f1ba4fb50d258')
    
      13
    
      14package() {
    
      15  install -d $pkgdir/usr/share/icons
    
      16  cp -r * $pkgdir/usr/share/icons
    
      17  rm $pkgdir/usr/share/icons/v$pkgver.tar.gz
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2