dolibarr

LOW

maintainer lapsus 18 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The flagged download in 'latestver()' is only used to check the latest version and does not affect the build; the actual source is a verifiable tarball from SourceForge, a known project host, with a valid checksum.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged download in 'latestver()' is only used to check the latest version and does not affect the build; the actual source is a verifiable tarball from SourceForge, a known project host, with a valid checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 curl -fsSL "https://www.dolibarr.org/downloads/" |

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: HLFH <gaspard@dhautefeuille.eu>
    
      2pkgname=dolibarr
    
      3pkgver=24.0.2
    
      4pkgrel=1
    
      5pkgdesc="Dolibarr ERP CRM: modern software package to manage your company"
    
      6arch=('any')
    
      7url="https://dolibarr.org/"
    
      8license=('GPL-3.0-or-later')
    
      9depends=('php-legacy' 'php-legacy-gd')
    
      10optdepends=('mariadb-clients: MariaDB backend'
    
      11            'postgresql: PostgreSQL backend'
    
      12            'php-legacy-xsl: xlsx export'
    
      13            'php-tcpdf: pdf export')
    
      14options=('!strip' 'emptydirs')
    
      15backup=("etc/$pkgname/conf.php")
    
      16install=dolibarr.install
    
      17source=("https://downloads.sourceforge.net/project/$pkgname/Dolibarr%20ERP-CRM/$pkgver/$pkgname-$pkgver.tgz"
    
      18        dolibarr.conf
    
      19        nginx.conf.example
    
      20        apache.conf.example)
    
      21b2sums=('3713bcdac7cd0e8e4e6569a91ce7e91809fc2b767acd8fc4ed92488ed1ea5c3f736e6d65364d8b7943a20927bd5580d8e834ff33a368ed74b5fd2db6cae73034'
    
      22        'e78f127924e37c9d5910ec3081cf0b13d79c58e6350f499261380cffd0ee0023e2488e20e24d0463c01548694c80e45e79b27efc9a81a3458e96c050dce7211d'
    
      23        '6ab4f2b86e9db40c91a0db181421594b78deccaac8d45c851f8d61a2999bdd14b84ac11018356728d1ec6ec0215094a6658ab5b74960f37a67e1d089c4ed61ac'
    
      24        '8bb3823afee0515931cfbd4ddc8714ccab29f3d46fa249554670cce9d5ed79b8645515cc758edf3293c40bd9a7917bc1ae8664e3bd6b6a2a1502379b4257f499')
    
      25
    
      26latestver() {
    
      27	curl -fsSL "https://www.dolibarr.org/downloads/" |
    
      28		perl -0ne 'print "$1\n" if /Last version\s*<.*?>\s*([0-9]+(?:\.[0-9]+)*)/s'
    
      29}
    
      30
    
      31prepare() {
    
      32	sed -e "3,5d" \
    
      33		-e "s|example for ||g" \
    
      34		-e "s|main_document_root=''|main_document_root='/usr/share/$pkgname/htdocs'|g" \
    
      35		-e "s|main_data_root=''|main_data_root='/var/lib/$pkgname'|g" \
    
      36		"$pkgname-$pkgver/htdocs/conf/conf.php.example" >"$pkgname-$pkgver/htdocs/conf/conf.php"
    
      37}
    
      38
    
      39package() {
    
      40	mkdir -p "$pkgdir/usr/share/$pkgname"
    
      41	mkdir -p "$pkgdir/etc/$pkgname/contrib"
    
      42	mkdir -p "$pkgdir/var/lib/$pkgname"
    
      43	mkdir -p "$pkgdir/usr/share/licenses/$pkgname"
    
      44	mkdir -p "$pkgdir/usr/share/doc/$pkgname"
    
      45        mkdir -p "$pkgdir/etc/systemd/system/php-fpm-legacy.service.d"
    
      46	cp *.conf.example "$pkgdir/etc/$pkgname/contrib/"
    
      47        cp dolibarr.conf "$pkgdir/etc/systemd/system/php-fpm-legacy.service.d/"
    
      48
    
      49	cd "$pkgname-$pkgver"
    
      50	cp -ra htdocs "$pkgdir/usr/share/$pkgname/"
    
      51	cp -ra scripts "$pkgdir/usr/share/$pkgname/"
    
      52	cp COPYING "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
    
      53	cp -ra doc/* "$pkgdir/usr/share/doc/$pkgname/"
    
      54	cp htdocs/conf/conf.php "$pkgdir/etc/$pkgname/conf.php"
    
      55	rm "$pkgdir/usr/share/$pkgname/htdocs/conf/conf.php"
    
      56	ln -s /etc/$pkgname/conf.php "$pkgdir/usr/share/$pkgname/htdocs/conf/conf.php"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2