dm-fotovilag
LOW
maintainer grgergo
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt binary from a non-whitelisted host, but it is part of the official software distribution infrastructure for the application and not an obfuscated or malicious payload; the worst case of a compromised source would be code execution, but the context suggests it is a legitimate vendor-hosted binary.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from a non-whitelisted host, but it is part of the official software distribution infrastructure for the application and not an obfuscated or malicious payload; the worst case of a compromised source would be code execution, but the context suggests it is a legitimate vendor-hosted binary.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
source=("https://dls.photoprintit.com/api/getClient/2376-hu_HU/hps/x_x_x_x_2376_x_02376-f6gF3NpI9Vy8O/linux")
PKGBUILD
1 offending line(s) highlighted
1
# Contributor: Jozef Riha <jose1711 at gmail dot com>
2
# Updated by Manuel Conzelmann, changed to non-branded software
3
# for dm Fotóvilág: based on PKGBUILD of https://aur.archlinux.org/packages/dm-fotowelt/
4
5
_keyaccount=2376
6
_productUrname='dm Fotóvilág'
7
_productRename='dm Fotóvilág'
8
9
pkgname=dm-fotovilag
10
pkgdesc='an offline client for creating photobooks, greeting cards, posters and more, uploading and ordering them at dm-digifoto.hu'
11
sha256sums=('SKIP')
12
pkgver=8.0.5
13
pkgrel=1
14
url="https://www.dm-digifoto.hu/"
15
license=("custom:eula")
16
depends=('libx11' 'libjpeg' 'curl' 'wget' 'snappy' 'libxcrypt-compat')
17
conflicts=(cewe-fotowelt cewe-fotobuch cewe-fotoservice cewe-monlivrephoto-fnac cewe-monlivrephoto-fr dm-fotowelt)
18
makedepends=('p7zip' 'xdg-utils')
19
arch=('i686' 'x86_64')
20
# https://dls.photoprintit.com/api/getClient/1320-de_DE/hps/x_x_x_x_24441_x_24441-0yELEgWuBDCUV/linux
21
# https://dls.photoprintit.com/api/getClient/2376-hu_HU/hps/x_x_x_x_2376_x_02376-f6gF3NpI9Vy8O/linux
22
source=("https://dls.photoprintit.com/api/getClient/2376-hu_HU/hps/x_x_x_x_2376_x_02376-f6gF3NpI9Vy8O/linux")
23
install=$pkgname.install
24
options=(!strip)
25
26
_installDir=/usr/share/$pkgname
27
28
pkgver() {
29
grep 'my $HPS_VER' $srcdir/install.pl | grep -Po '[[:digit:]\.]+'
30
}
31
32
package() {
33
# put icons and mimetype in the right place
34
export XDG_UTILS_INSTALL_MODE=system
35
export XDG_DATA_DIRS="$pkgdir/usr/share:"
36
37
_installDir=$pkgdir$_installDir
38
mkdir -p $_installDir $pkgdir/usr/{bin,share/icons/hicolor,share/mime/packages,share/applications}
39
40
cd $srcdir
41
# don't clear screen, fail to update system mime database, install broken desktop file, or burble
42
sed -i 's/^\s*\(system("clear"\|system("update-mime-database \|createDesktopShortcuts(\|printf(\$TRANSLATABLE\).*;//' install.pl
43
44
# don't show EULA/ask for confirmation (EULA is addressed in install script)
45
update='--update'
46
# keep packages unless updating from within application
47
[[ -z "$_UPDATING" ]] && keepPackages='-k' || update='--upgrade'
48
49
./install.pl $update $keepPackages --installDir=$_installDir -v
50
install -D -m644 $srcdir/EULA.txt $pkgdir/usr/share/licenses/$pkgname/EULA.txt
51
52
# create startup script and desktop file
53
cat > $pkgdir/usr/bin/$pkgname <<-EOF
54
#!/usr/bin/bash
55
cd ${_installDir#$pkgdir}
56
# nouveau bug with QT web engine: https://bugreports.qt.io/browse/QTBUG-41242
57
lsmod | grep nouveau && export QT_XCB_FORCE_SOFTWARE_OPENGL=1
58
exec ./"${_productUrname}" "\$@"
59
EOF
60
cat > $pkgdir/usr/share/applications/$pkgname.desktop <<-EOF
61
[Desktop Entry]
62
Type=Application
63
Name=$_productRename
64
Comment=Offline client for dm-digifoto.hu service
65
Exec=$pkgname
66
Icon=hps-$_keyaccount-$pkgver
67
StartupNotify=true
68
Categories=Graphics;Photography;
69
MimeType=application/x-hps-mcf
70
EOF
71
chmod 755 $pkgdir/usr/bin/$pkgname $pkgdir/usr/share/applications/$pkgname.desktop $(find $_installDir -type d)
72
73
# adjust product name in mimetype comment
74
sed -i "s/$_productUrname/$_productRename/" $pkgdir/usr/share/mime/packages/*
75
# remove unneeded mime cache files and installation logs
76
rm -d $pkgdir/usr/share/mime/application/* $pkgdir/usr/share/mime/* \
77
$_installDir/.log/* $_installDir/.log &> /dev/null || true
78
echo
79
}
80
# template end;
81
82
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |