dalbum

maintainer lauramasseron · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from the project's official domain, which is not on a standard code host but is the project's own website; the source is a PHP web application, not a prebuilt executable, and the build process is a normal extraction and install, so the risk is low despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from the project's official domain, which is not on a standard code host but is the project's own website; the source is a PHP web application, not a prebuilt executable, and the build process is a normal extraction and install, so the risk is low despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("http://www.dalbum.org/${pkgname}${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Phillip Smith <pkgbuild@phs.id.au>
    
      2# http://github.com/fukawi2/aur-packages
    
      3
    
      4### I AM ONLY THE PACKAGER, NOT THE DEVELOPER
    
      5### Please ask support questions about this software in one of:
    
      6###   1) The AUR comments; OR
    
      7###   2) Upstream forums/maillist etc; OR
    
      8###   3) The ArchLinux forums
    
      9### I do not always know enough about the software itself, or don't have the
    
      10### time to promptly respond to direct emails.
    
      11### If you have found a problem with the package/PKGBUILD (as opposed to
    
      12### the software) then please do email me or post an AUR comment.
    
      13
    
      14pkgname=dalbum
    
      15pkgver=144_177
    
      16pkgrel=1
    
      17pkgdesc="A free PHP photo album. It is small, easy to install and highly customizable at the same time. Features include slide shows, image comments, support for video and PDF files and many more."
    
      18arch=('any')
    
      19url="http://www.dalbum.org/"
    
      20license=('GPL')
    
      21depends=('imagemagick' 'php>=4.1')
    
      22backup=("etc/webapps/$pkgname/config.php")
    
      23source=("http://www.dalbum.org/${pkgname}${pkgver}.tar.gz")
    
      24md5sums=('a30a45fe606d9dbe15104cbbc409df10')
    
      25
    
      26package() {
    
      27  _CONF_DIR="etc/webapps/$pkgname"
    
      28  _INST_DIR="usr/share/webapps/$pkgname"
    
      29
    
      30  # Install webroot files
    
      31	install -dm755 "$pkgdir"/$_INST_DIR
    
      32	cp -r "$srcdir"/* "$pkgdir"/$_INST_DIR
    
      33	
    
      34  # Fix permissions
    
      35  chmod -R u=rwX,go=rX "$pkgdir/$_INST_DIR"
    
      36
    
      37  # Move config file to /etc and symlink
    
      38  mkdir -p "$pkgdir"/$_CONF_DIR
    
      39  mv "$pkgdir"/$_INST_DIR/config/{*,.??*} "$pkgdir"/$_CONF_DIR
    
      40  rmdir "$pkgdir"/$_INST_DIR/config
    
      41  ln -sf $_CONF_DIR "$pkgdir"/$_INST_DIR/config
    
      42}
    
      43
    
      44# vim:set ts=2 sw=2 et:
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2