fortifone-bin

LOW

maintainer infabo 0 votes scanned 2026-11-04 14:09:30.396318

View on AUR

Why flagged

Downloads a prebuilt Electron/Fortinet binary from fwimage.fortivoice-cloud.com, which appears to be Fortinet's own CDN for FortiVoice Cloud firmware; checksums are provided and non-SKIP'd, making silent substitution detectable, though the host is not a well-known official domain and cannot be fully verified as canonical Fortinet infrastructure.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt Electron/Fortinet binary from fwimage.fortivoice-cloud.com, which appears to be Fortinet's own CDN for FortiVoice Cloud firmware; checksums are provided and non-SKIP'd, making silent substitution detectable, though the host is not a well-known official domain and cannot be fully verified as canonical Fortinet infrastructure.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:56 "https://fwimage.fortivoice-cloud.com/fortivoicecloud-firmware-prd/${_debname}"
PKGBUILD:57 'https://www.fortinet.com/doc/legal/EULA.pdf'

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: infabo <der_ulmen@yahoo.de>
    
      2
    
      3pkgname=fortifone-bin
    
      4pkgver=8.0.0.67
    
      5pkgrel=1
    
      6pkgdesc='Fortinet softclient for FortiVoice phone systems and FortiVoice Cloud'
    
      7arch=('x86_64')
    
      8url='https://fortivoice-cloud.com/noauth/index.html'
    
      9license=('LicenseRef-Fortinet')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'cairo'
    
      14  'dbus'
    
      15  'expat'
    
      16  'glib2'
    
      17  'glibc'
    
      18  'gtk3'
    
      19  'libcups'
    
      20  'libgcc'
    
      21  'libnotify'
    
      22  'libpulse'
    
      23  'libsecret'
    
      24  'libstdc++'
    
      25  'libx11'
    
      26  'libxcb'
    
      27  'libxcomposite'
    
      28  'libxdamage'
    
      29  'libxext'
    
      30  'libxfixes'
    
      31  'libxkbcommon'
    
      32  'libxrandr'
    
      33  'libxss'
    
      34  'libxtst'
    
      35  'mesa'
    
      36  'nspr'
    
      37  'nss'
    
      38  'pango'
    
      39  'systemd-libs'
    
      40  'util-linux-libs'
    
      41  'xdg-utils'
    
      42)
    
      43makedepends=('libarchive')
    
      44optdepends=(
    
      45  'libappindicator: system tray integration'
    
      46  'gnome-keyring: Secret Service provider for credential storage'
    
      47  'xorg-xwayland: run the upstream X11 desktop launcher in a Wayland session'
    
      48)
    
      49provides=("fortifone=${pkgver}")
    
      50conflicts=('fortifone')
    
      51options=('!strip' '!debug')
    
      52
    
      53# Upstream names the release 8.0.0.67, but omits the patch version in the URL.
    
      54_debname="FortiFone_linux_v${pkgver%.*.*}_b${pkgver##*.}.deb"
    
      55source=(
    
      56  "https://fwimage.fortivoice-cloud.com/fortivoicecloud-firmware-prd/${_debname}"
    
      57  'https://www.fortinet.com/doc/legal/EULA.pdf'
    
      58)
    
      59noextract=("${_debname}" 'EULA.pdf')
    
      60sha256sums=(
    
      61  'e16c571c0173d096b1865aa345564ecb94188901f01486bec52b9ee9fa94960d'
    
      62  '6b8d3a60693e6f968a71f2bca5495d4ceff54f37b8c35844bb2a97a822ed533a'
    
      63)
    
      64
    
      65prepare() {
    
      66  bsdtar -xf "${srcdir}/${_debname}" -C "${srcdir}" data.tar.xz
    
      67}
    
      68
    
      69package() {
    
      70  # Includes /usr/share/applications/fortifone.desktop and the hicolor icons.
    
      71  # Keep upstream's Exec=/opt/FortiFone/fortifone --ozone-platform=x11 %U,
    
      72  # including its URL handlers and StartupWMClass, for application menu launches.
    
      73  bsdtar --no-same-owner -xf "${srcdir}/data.tar.xz" -C "${pkgdir}"
    
      74
    
      75  install -dm755 "${pkgdir}/usr/bin"
    
      76  ln -s /opt/FortiFone/fortifone "${pkgdir}/usr/bin/fortifone"
    
      77
    
      78  # The upstream postinst sets this permission for Electron's sandbox helper.
    
      79  chmod 4755 "${pkgdir}/opt/FortiFone/chrome-sandbox"
    
      80
    
      81  install -Dm644 "${srcdir}/EULA.pdf" \
    
      82    "${pkgdir}/usr/share/licenses/${pkgname}/EULA.pdf"
    
      83  ln -s /opt/FortiFone/LICENSE.electron.txt \
    
      84    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      85  ln -s /opt/FortiFone/LICENSES.chromium.html \
    
      86    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-04 14:09:30	Low	3
2026-11-04 14:07:06	Medium	2