dolibarr

LOW

maintainer lapsus 18 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged download in latestver() is only used for version checking and not included in the build; the actual source is securely fetched from SourceForge with verified checksums.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged download in latestver() is only used for version checking and not included in the build; the actual source is securely fetched from SourceForge with verified checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 curl -fsSL "https://www.dolibarr.org/downloads/" |

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: HLFH <gaspard@dhautefeuille.eu>
    
      2pkgname=dolibarr
    
      3pkgver=24.0.1
    
      4pkgrel=1
    
      5pkgdesc="Dolibarr ERP CRM: modern software package to manage your company"
    
      6arch=('any')
    
      7url="https://dolibarr.org/"
    
      8license=('GPL-3.0-or-later')
    
      9depends=('php-legacy' 'php-legacy-gd')
    
      10optdepends=('mariadb-clients: MariaDB backend'
    
      11            'postgresql: PostgreSQL backend'
    
      12            'php-legacy-xsl: xlsx export'
    
      13            'php-tcpdf: pdf export')
    
      14options=('!strip' 'emptydirs')
    
      15backup=("etc/$pkgname/conf.php")
    
      16install=dolibarr.install
    
      17source=("https://downloads.sourceforge.net/project/$pkgname/Dolibarr%20ERP-CRM/$pkgver/$pkgname-$pkgver.tgz"
    
      18        dolibarr.conf
    
      19        nginx.conf.example
    
      20        apache.conf.example)
    
      21b2sums=('4b05f7c00e1cd8ab215eca8c733ad71b4fae6ade52de77e10a46835df2612e5c32a3ce75e4c1365f464048a3e19ff01725d5e0f99bbde730ba1d2fe470bae075'
    
      22        'e78f127924e37c9d5910ec3081cf0b13d79c58e6350f499261380cffd0ee0023e2488e20e24d0463c01548694c80e45e79b27efc9a81a3458e96c050dce7211d'
    
      23        '6ab4f2b86e9db40c91a0db181421594b78deccaac8d45c851f8d61a2999bdd14b84ac11018356728d1ec6ec0215094a6658ab5b74960f37a67e1d089c4ed61ac'
    
      24        '8bb3823afee0515931cfbd4ddc8714ccab29f3d46fa249554670cce9d5ed79b8645515cc758edf3293c40bd9a7917bc1ae8664e3bd6b6a2a1502379b4257f499')
    
      25
    
      26latestver() {
    
      27	curl -fsSL "https://www.dolibarr.org/downloads/" |
    
      28		perl -0ne 'print "$1\n" if /Last version\s*<.*?>\s*([0-9]+(?:\.[0-9]+)*)/s'
    
      29}
    
      30
    
      31prepare() {
    
      32	sed -e "3,5d" \
    
      33		-e "s|example for ||g" \
    
      34		-e "s|main_document_root=''|main_document_root='/usr/share/$pkgname/htdocs'|g" \
    
      35		-e "s|main_data_root=''|main_data_root='/var/lib/$pkgname'|g" \
    
      36		"$pkgname-$pkgver/htdocs/conf/conf.php.example" >"$pkgname-$pkgver/htdocs/conf/conf.php"
    
      37}
    
      38
    
      39package() {
    
      40	mkdir -p "$pkgdir/usr/share/$pkgname"
    
      41	mkdir -p "$pkgdir/etc/$pkgname/contrib"
    
      42	mkdir -p "$pkgdir/var/lib/$pkgname"
    
      43	mkdir -p "$pkgdir/usr/share/licenses/$pkgname"
    
      44	mkdir -p "$pkgdir/usr/share/doc/$pkgname"
    
      45        mkdir -p "$pkgdir/etc/systemd/system/php-fpm-legacy.service.d"
    
      46	cp *.conf.example "$pkgdir/etc/$pkgname/contrib/"
    
      47        cp dolibarr.conf "$pkgdir/etc/systemd/system/php-fpm-legacy.service.d/"
    
      48
    
      49	cd "$pkgname-$pkgver"
    
      50	cp -ra htdocs "$pkgdir/usr/share/$pkgname/"
    
      51	cp -ra scripts "$pkgdir/usr/share/$pkgname/"
    
      52	cp COPYING "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
    
      53	cp -ra doc/* "$pkgdir/usr/share/doc/$pkgname/"
    
      54	cp htdocs/conf/conf.php "$pkgdir/etc/$pkgname/conf.php"
    
      55	rm "$pkgdir/usr/share/$pkgname/htdocs/conf/conf.php"
    
      56	ln -s /etc/$pkgname/conf.php "$pkgdir/usr/share/$pkgname/htdocs/conf/conf.php"
    
      57}
    
      58

Changes since previous scan

--- PKGBUILD @ 2026-08-23 00:10
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,6 +1,6 @@
 # Maintainer: HLFH <gaspard@dhautefeuille.eu>
 pkgname=dolibarr
-pkgver=24.0.0
+pkgver=24.0.1
 pkgrel=1
 pkgdesc="Dolibarr ERP CRM: modern software package to manage your company"
 arch=('any')
@@ -18,7 +18,7 @@
         dolibarr.conf
         nginx.conf.example
         apache.conf.example)
-b2sums=('3ee827cb5d3ceb3617d212e34a67822671330ab247c2a214e07403ea712a44cf03678fc2ff37433e8f2b9229f6036d4c3f6f014d92512d3b09df955bb1bb3b2a'
+b2sums=('4b05f7c00e1cd8ab215eca8c733ad71b4fae6ade52de77e10a46835df2612e5c32a3ce75e4c1365f464048a3e19ff01725d5e0f99bbde730ba1d2fe470bae075'
         'e78f127924e37c9d5910ec3081cf0b13d79c58e6350f499261380cffd0ee0023e2488e20e24d0463c01548694c80e45e79b27efc9a81a3458e96c050dce7211d'
         '6ab4f2b86e9db40c91a0db181421594b78deccaac8d45c851f8d61a2999bdd14b84ac11018356728d1ec6ec0215094a6658ab5b74960f37a67e1d089c4ed61ac'
         '8bb3823afee0515931cfbd4ddc8714ccab29f3d46fa249554670cce9d5ed79b8645515cc758edf3293c40bd9a7917bc1ae8664e3bd6b6a2a1502379b4257f499')

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 21:24:02	Medium	1
2026-08-23 00:10:13	Clean	2
2026-08-22 15:17:41	Medium	1
2026-08-22 00:02:17	Low	2
2026-08-21 00:01:35	Low	2
2026-08-20 00:05:13	Low	2
2026-08-19 00:15:45	Low	2
2026-08-18 00:03:42	Low	2
2026-08-17 00:18:29	Low	2
2026-08-16 00:03:42	Low	2
2026-08-15 00:26:13	Low	2
2026-08-14 00:03:41	Low	2
2026-08-13 00:17:07	Low	2
2026-08-12 00:27:08	Low	2