dm-fotowelt
maintainer danieltetraquark
· 2 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a source tarball from a non-whitelisted but plausibly official domain (dls.photoprintit.com) used by the vendor for distribution; it builds and installs the vendor's own client software without executing unreviewed remote code or installing unverifiable binaries.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from a non-whitelisted but plausibly official domain (dls.photoprintit.com) used by the vendor for distribution; it builds and installs the vendor's own client software without executing unreviewed remote code or installing unverifiable binaries.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
source=("https://dls.photoprintit.com/download/Data/$_keyaccount-$_lang/hps/setup_${_productUrname// /_}.tgz")
PKGBUILD
1 offending line(s) highlighted
1
# Contributor: Jozef Riha <jose1711 at gmail dot com>
2
# Updated by Manuel Conzelmann, changed to non-branded software
3
# for dm Fotowelt: based on PKGBUILD of https://aur.archlinux.org/packages/cewe-fotobuch/
4
5
_keyaccount=1320
6
_productUrname='dm Foto by CEWE'
7
_productRename='dm Foto by CEWE'
8
_lang='de_DE'
9
10
pkgname=dm-fotowelt
11
pkgdesc='an offline client for creating photobooks, greeting cards, posters and more, uploading and ordering them at foto.dm.de, previously known as fotoparadies.de'
12
sha256sums=('542e350be7a9df788e2ed7f4e1633e7b192f413efeef394d739222815ff13be2')
13
pkgver=8.1.3
14
pkgrel=2
15
url="https://www.fotoparadies.de/"
16
license=("custom:eula")
17
depends=('libx11' 'libjpeg.so' 'curl' 'wget' 'snappy' 'libxcrypt-compat')
18
conflicts=(cewe-fotowelt cewe-fotobuch cewe-fotoservice cewe-monlivrephoto-fnac cewe-monlivrephoto-fr)
19
makedepends=('p7zip' 'xdg-utils')
20
arch=('i686' 'x86_64')
21
# https://dls.photoprintit.com/api/getClient/1320-de_DE/hps/x_x_x_x_24441_x_24441-0yELEgWuBDCUV/linux
22
source=("https://dls.photoprintit.com/download/Data/$_keyaccount-$_lang/hps/setup_${_productUrname// /_}.tgz")
23
install=$pkgname.install
24
options=(!strip)
25
26
_installDir=/usr/share/$pkgname
27
28
pkgver() {
29
grep 'my $HPS_VER' $srcdir/install.pl | grep -Po '[[:digit:]\.]+'
30
}
31
32
package() {
33
# put icons and mimetype in the right place
34
export XDG_UTILS_INSTALL_MODE=system
35
export XDG_DATA_DIRS="$pkgdir/usr/share:"
36
37
_installDir=$pkgdir$_installDir
38
mkdir -p $_installDir $pkgdir/usr/{bin,share/icons/hicolor,share/mime/packages,share/applications}
39
40
cd $srcdir
41
# don't clear screen, fail to update system mime database, install broken desktop file, or burble
42
sed -i 's/^\s*\(system("clear"\|system("update-mime-database \|createDesktopShortcuts(\|printf(\$TRANSLATABLE\).*;//' install.pl
43
44
# don't show EULA/ask for confirmation (EULA is addressed in install script)
45
update='--update'
46
# keep packages unless updating from within application
47
[[ -z "$_UPDATING" ]] && keepPackages='-k' || update='--upgrade'
48
49
./install.pl $update $keepPackages --installDir=$_installDir -v
50
install -D -m644 $srcdir/EULA.txt $pkgdir/usr/share/licenses/$pkgname/EULA.txt
51
52
# create startup script and desktop file
53
cat > $pkgdir/usr/bin/$pkgname <<-EOF
54
#!/usr/bin/bash
55
cd ${_installDir#$pkgdir}
56
# nouveau bug with QT web engine: https://bugreports.qt.io/browse/QTBUG-41242
57
lsmod | grep nouveau && export QT_XCB_FORCE_SOFTWARE_OPENGL=1
58
exec ./"${_productUrname}" "\$@"
59
EOF
60
cat > $pkgdir/usr/share/applications/$pkgname.desktop <<-EOF
61
[Desktop Entry]
62
Type=Application
63
Name=$_productRename
64
Comment=Offline client for fotoparadies.de service
65
Exec=$pkgname
66
Icon=hps-$_keyaccount-$pkgver
67
StartupNotify=true
68
Categories=Graphics;Photography;
69
MimeType=application/x-hps-mcf
70
EOF
71
chmod 755 $pkgdir/usr/bin/$pkgname $pkgdir/usr/share/applications/$pkgname.desktop $(find $_installDir -type d)
72
73
# adjust product name in mimetype comment
74
sed -i "s/$_productUrname/$_productRename/" $pkgdir/usr/share/mime/packages/*
75
# remove unneeded mime cache files and installation logs
76
rm -d $pkgdir/usr/share/mime/application/* $pkgdir/usr/share/mime/* \
77
$_installDir/.log/* $_installDir/.log &> /dev/null || true
78
echo
79
}
80
# template end;
81
82
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |