dm-fotovilag

maintainer grgergo · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from a non-whitelisted host, but it is part of the official software distribution infrastructure for the application and not an obfuscated or malicious payload; the worst case of a compromised source would be code execution, but the context suggests it is a legitimate vendor-hosted binary.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from a non-whitelisted host, but it is part of the official software distribution infrastructure for the application and not an obfuscated or malicious payload; the worst case of a compromised source would be code execution, but the context suggests it is a legitimate vendor-hosted binary.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://dls.photoprintit.com/api/getClient/2376-hu_HU/hps/x_x_x_x_2376_x_02376-f6gF3NpI9Vy8O/linux")

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Jozef Riha <jose1711 at gmail dot com>
    
      2# Updated by Manuel Conzelmann, changed to non-branded software
    
      3# for dm Fotóvilág: based on PKGBUILD of https://aur.archlinux.org/packages/dm-fotowelt/
    
      4
    
      5_keyaccount=2376
    
      6_productUrname='dm Fotóvilág'
    
      7_productRename='dm Fotóvilág'
    
      8
    
      9pkgname=dm-fotovilag
    
      10pkgdesc='an offline client for creating photobooks, greeting cards, posters and more, uploading and ordering them at dm-digifoto.hu'
    
      11sha256sums=('SKIP')
    
      12pkgver=8.0.5
    
      13pkgrel=1
    
      14url="https://www.dm-digifoto.hu/"
    
      15license=("custom:eula")
    
      16depends=('libx11' 'libjpeg' 'curl' 'wget' 'snappy' 'libxcrypt-compat')
    
      17conflicts=(cewe-fotowelt cewe-fotobuch cewe-fotoservice cewe-monlivrephoto-fnac cewe-monlivrephoto-fr dm-fotowelt)
    
      18makedepends=('p7zip' 'xdg-utils')
    
      19arch=('i686' 'x86_64')
    
      20# https://dls.photoprintit.com/api/getClient/1320-de_DE/hps/x_x_x_x_24441_x_24441-0yELEgWuBDCUV/linux
    
      21# https://dls.photoprintit.com/api/getClient/2376-hu_HU/hps/x_x_x_x_2376_x_02376-f6gF3NpI9Vy8O/linux
    
      22source=("https://dls.photoprintit.com/api/getClient/2376-hu_HU/hps/x_x_x_x_2376_x_02376-f6gF3NpI9Vy8O/linux")
    
      23install=$pkgname.install
    
      24options=(!strip)
    
      25
    
      26_installDir=/usr/share/$pkgname
    
      27
    
      28pkgver() {
    
      29	grep 'my $HPS_VER' $srcdir/install.pl | grep -Po '[[:digit:]\.]+'
    
      30}
    
      31
    
      32package() {
    
      33	# put icons and mimetype in the right place
    
      34	export XDG_UTILS_INSTALL_MODE=system
    
      35	export XDG_DATA_DIRS="$pkgdir/usr/share:"
    
      36
    
      37	_installDir=$pkgdir$_installDir
    
      38	mkdir -p $_installDir $pkgdir/usr/{bin,share/icons/hicolor,share/mime/packages,share/applications}
    
      39
    
      40	cd $srcdir
    
      41	# don't clear screen, fail to update system mime database, install broken desktop file, or burble
    
      42	sed -i 's/^\s*\(system("clear"\|system("update-mime-database \|createDesktopShortcuts(\|printf(\$TRANSLATABLE\).*;//' install.pl
    
      43
    
      44	# don't show EULA/ask for confirmation (EULA is addressed in install script)
    
      45	update='--update'
    
      46	# keep packages unless updating from within application
    
      47	[[ -z "$_UPDATING" ]] && keepPackages='-k' || update='--upgrade'
    
      48
    
      49	./install.pl $update $keepPackages --installDir=$_installDir -v
    
      50	install -D -m644 $srcdir/EULA.txt $pkgdir/usr/share/licenses/$pkgname/EULA.txt
    
      51
    
      52	# create startup script and desktop file
    
      53	cat > $pkgdir/usr/bin/$pkgname <<-EOF
    
      54		#!/usr/bin/bash
    
      55		cd ${_installDir#$pkgdir}
    
      56		# nouveau bug with QT web engine: https://bugreports.qt.io/browse/QTBUG-41242
    
      57		lsmod | grep nouveau && export QT_XCB_FORCE_SOFTWARE_OPENGL=1
    
      58		exec ./"${_productUrname}" "\$@"
    
      59	EOF
    
      60	cat > $pkgdir/usr/share/applications/$pkgname.desktop <<-EOF
    
      61		[Desktop Entry]
    
      62		Type=Application
    
      63		Name=$_productRename
    
      64		Comment=Offline client for dm-digifoto.hu service
    
      65		Exec=$pkgname
    
      66		Icon=hps-$_keyaccount-$pkgver
    
      67		StartupNotify=true
    
      68		Categories=Graphics;Photography;
    
      69		MimeType=application/x-hps-mcf
    
      70	EOF
    
      71	chmod 755 $pkgdir/usr/bin/$pkgname $pkgdir/usr/share/applications/$pkgname.desktop $(find $_installDir -type d)
    
      72
    
      73	# adjust product name in mimetype comment
    
      74	sed -i "s/$_productUrname/$_productRename/" $pkgdir/usr/share/mime/packages/*
    
      75	# remove unneeded mime cache files and installation logs
    
      76	rm -d $pkgdir/usr/share/mime/application/* $pkgdir/usr/share/mime/* \
    
      77		$_installDir/.log/* $_installDir/.log &> /dev/null || true
    
      78	echo
    
      79}
    
      80# template end;
    
      81
    
      82

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2