dolibarr

maintainer lapsus · 18 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged download in 'latestver()' is only used for version checking and does not affect the build; the actual source is securely fetched from SourceForge with verified checksums.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged download in 'latestver()' is only used for version checking and does not affect the build; the actual source is securely fetched from SourceForge with verified checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 curl -fsSL "https://www.dolibarr.org/downloads/" |

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: HLFH <gaspard@dhautefeuille.eu>
    
      2pkgname=dolibarr
    
      3pkgver=23.0.3
    
      4pkgrel=1
    
      5pkgdesc="Dolibarr ERP CRM: modern software package to manage your company"
    
      6arch=('any')
    
      7url="https://dolibarr.org/"
    
      8license=('GPL-3.0-or-later')
    
      9depends=('php-legacy' 'php-legacy-gd')
    
      10optdepends=('mariadb-clients: MariaDB backend'
    
      11            'postgresql: PostgreSQL backend'
    
      12            'php-legacy-xsl: xlsx export'
    
      13            'php-tcpdf: pdf export')
    
      14options=('!strip' 'emptydirs')
    
      15backup=("etc/$pkgname/conf.php")
    
      16install=dolibarr.install
    
      17source=("https://downloads.sourceforge.net/project/$pkgname/Dolibarr%20ERP-CRM/$pkgver/$pkgname-$pkgver.tgz"
    
      18        dolibarr.conf
    
      19        nginx.conf.example
    
      20        apache.conf.example)
    
      21b2sums=('9a1aae383e1787bd4ef1622d8540279f9a991b0f9a46165748a9ff7c113593d792228aacc2ae839551942146f8a548a04913933c8053d5f0a41c644e888f4c10'
    
      22        'e78f127924e37c9d5910ec3081cf0b13d79c58e6350f499261380cffd0ee0023e2488e20e24d0463c01548694c80e45e79b27efc9a81a3458e96c050dce7211d'
    
      23        '6ab4f2b86e9db40c91a0db181421594b78deccaac8d45c851f8d61a2999bdd14b84ac11018356728d1ec6ec0215094a6658ab5b74960f37a67e1d089c4ed61ac'
    
      24        '8bb3823afee0515931cfbd4ddc8714ccab29f3d46fa249554670cce9d5ed79b8645515cc758edf3293c40bd9a7917bc1ae8664e3bd6b6a2a1502379b4257f499')
    
      25
    
      26latestver() {
    
      27	curl -fsSL "https://www.dolibarr.org/downloads/" |
    
      28		perl -0ne 'print "$1\n" if /Last version\s*<.*?>\s*([0-9]+(?:\.[0-9]+)*)/s'
    
      29}
    
      30
    
      31prepare() {
    
      32	sed -e "3,5d" \
    
      33		-e "s|example for ||g" \
    
      34		-e "s|main_document_root=''|main_document_root='/usr/share/$pkgname/htdocs'|g" \
    
      35		-e "s|main_data_root=''|main_data_root='/var/lib/$pkgname'|g" \
    
      36		"$pkgname-$pkgver/htdocs/conf/conf.php.example" >"$pkgname-$pkgver/htdocs/conf/conf.php"
    
      37}
    
      38
    
      39package() {
    
      40	mkdir -p "$pkgdir/usr/share/$pkgname"
    
      41	mkdir -p "$pkgdir/etc/$pkgname/contrib"
    
      42	mkdir -p "$pkgdir/var/lib/$pkgname"
    
      43	mkdir -p "$pkgdir/usr/share/licenses/$pkgname"
    
      44	mkdir -p "$pkgdir/usr/share/doc/$pkgname"
    
      45        mkdir -p "$pkgdir/etc/systemd/system/php-fpm-legacy.service.d"
    
      46	cp *.conf.example "$pkgdir/etc/$pkgname/contrib/"
    
      47        cp dolibarr.conf "$pkgdir/etc/systemd/system/php-fpm-legacy.service.d/"
    
      48
    
      49	cd "$pkgname-$pkgver"
    
      50	cp -ra htdocs "$pkgdir/usr/share/$pkgname/"
    
      51	cp -ra scripts "$pkgdir/usr/share/$pkgname/"
    
      52	cp COPYING "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
    
      53	cp -ra doc/* "$pkgdir/usr/share/doc/$pkgname/"
    
      54	cp htdocs/conf/conf.php "$pkgdir/etc/$pkgname/conf.php"
    
      55	rm "$pkgdir/usr/share/$pkgname/htdocs/conf/conf.php"
    
      56	ln -s /etc/$pkgname/conf.php "$pkgdir/usr/share/$pkgname/htdocs/conf/conf.php"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2