fusiondirectory

maintainer AlphaJack · 4 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads a JavaScript library from a non-whitelisted host (script.aculo.us), but it is publicly archived, widely used, and installed as static web assets without execution; the main source is from GitHub, checksummed, and the rest of the build is standard and safe.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JavaScript library from a non-whitelisted host (script.aculo.us), but it is publicly archived, widely used, and installed as static web assets without execution; the main source is from GitHub, checksummed, and the rest of the build is standard and safe.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:36 "http://script.aculo.us/dist/scriptaculous-js-1.9.0.zip"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: AlphaJack <alphajack at tuta dot io>
2# Contributor K1412 <jonathan@opensides.be>
3
4pkgname="fusiondirectory"
5pkgver=1.4
6pkgrel=2
7pkgdesc="A combination of system administrator and end user web interface, designed to handle LDAP based setups"
8url="http://fusiondirectory.org/"
9license=("GPL2")
10arch=("any")
11depends=("gettext"
12 "openldap"
13 "perl-archive-extract"
14 "perl-bytes-random-secure"
15 "perl-crypt-cbc"
16 "perl-crypt-rijndael"
17 "perl-digest-sha"
18 "perl-file-copy-recursive"
19 "perl-ldap"
20 "perl-path-class"
21 "perl-term-readkey"
22 "perl-xml-twig"
23 "php"
24 "php-imagick"
25 "php-imap"
26 "php-pear"
27 "schema2ldif"
28 "smarty3"
29 "smarty3-gettext")
30optdepends=("fusiondirectory-plugins: core plugins"
31 "apache: webserver"
32 "nginx: webserver"
33 "php-cas: cas authentication"
34 )
35source=("https://github.com/fusiondirectory/$pkgname/archive/refs/tags/fusiondirectory-$pkgver.tar.gz"
36 "http://script.aculo.us/dist/scriptaculous-js-1.9.0.zip"
37 "$pkgname.php.ini"
38 "$pkgname.tmpfiles")
39b2sums=('c0e021f9b4302e781640116097233465dd0768d4ef44c42f1051e307a341ea5cfa62bfd4c6690023e37dd7c9b5fe4b230a927c609bf530901f0f98c5623c1d29'
40 '1d3b125eaeba7c9017cb02f91b9081aceb83c0cbedcb5e6d8e3bf75d7282cc8ca2392240621f06fad8d05af0801433a8572979d95a8a6f7fb2ad47c12f23a132'
41 '44c6f9f67d2d10291ecbc5cdc652181d4e4e03ea68e559093ab5e6cf4cfd50ed5148dc840ca73e390d493652805f6ce945b8abb750a39a6a6fa7aa329aedb0bd'
42 '01764572fbcb0a39b0130b20ab1bdad7d1cd2c1800dd51a91fb71a289c2630e0f6cb82d440a59218c8117eea366fdd463f92066f3ea8bcab2c9de42e377ef5d4')
43install="$pkgname.install"
44options=("!strip")
45
46prepare() {
47 cd "fusiondirectory-$pkgname-$pkgver"
48 find . -type f -exec sed -i {} \
49 -e "s|/etc/$pkgname|/etc/webapps/$pkgname|g" \
50 -e "s|/etc/ldap|/etc/openldap|g" \
51 -e "s|/var/www/$pkgname|/usr/share/webapps/$pkgname|g" \
52 -e "s|/usr/share/$pkgname|/usr/share/webapps/$pkgname|g" \;
53 sed -i "include/variables_common.inc" -e 's|"PEAR_DIR", "/usr/share/php"|"PEAR_DIR", "/usr/share/pear"|'
54}
55
56package(){
57 cd "fusiondirectory-$pkgname-$pkgver"
58 # directories
59 install -d -m 755 "$pkgdir/etc/openldap/schema/$pkgname"
60 install -d -m 750 "$pkgdir/etc/webapps/$pkgname"
61 install -d -m 700 "$pkgdir/var/cache/$pkgname"
62 install -d -m 755 "$pkgdir/var/cache/$pkgname/template"
63 install -d -m 755 "$pkgdir/usr/share/doc/$pkgname/"
64 install -d -m 755 "$pkgdir/usr/share/webapps/$pkgname/"
65 install -d -m 755 "$pkgdir/usr/share/php/smarty3/plugins/"
66 install -d -m 755 "$pkgdir/var/spool/$pkgname/"
67 # webapp files and javascript libraries
68 _dirs=("html" "ihtml" "include" "locale" "plugins" "setup")
69 for _dir in "${_dirs[@]}"; do
70 cp -a "$_dir" "$pkgdir/usr/share/webapps/$pkgname/"
71 done
72 cp -a ../"scriptaculous-js-1.9.0/src/"* "$pkgdir/usr/share/webapps/$pkgname/html/include"
73 cp -a ../"scriptaculous-js-1.9.0/lib/prototype.js" "$pkgdir/usr/share/webapps/$pkgname/html/include"
74 # executables, no more in 1.4
75 #find "contrib/bin/" -type f -exec chmod +x {} \;
76 #mv "contrib/bin/" "$pkgdir/usr/"
77 # ldap schemas
78 cp "contrib/openldap/"* "$pkgdir/etc/openldap/schema/$pkgname/"
79 # configuration file template
80 install -D -m 640 "contrib/$pkgname.conf" "$pkgdir/var/cache/$pkgname/template/"
81 # php extensions
82 install -D -m 644 "../$pkgname.php.ini" "$pkgdir/etc/php7/conf.d/$pkgname.ini"
83 # smarty3 plugins
84 cp "contrib/smarty/plugins/"* "$pkgdir/usr/share/php/smarty3/plugins/"
85 rm -r "contrib/smarty"
86 # man pages, no more in 1.4
87 #gzip -f "contrib/man/$pkgname-setup.1" "contrib/man/$pkgname-insert-schema.1" "contrib/man/$pkgname.conf.5"
88 #install -D -m 644 "contrib/man/$pkgname-setup.1.gz" "$pkgdir/usr/share/man/man1/$pkgname-setup.1.gz"
89 #install -D -m 644 "contrib/man/$pkgname-insert-schema.1.gz" "$pkgdir/usr/share/man/man1/$pkgname-insert-schema.1.gz"
90 #install -D -m 644 "contrib/man/$pkgname.conf.5.gz" "$pkgdir/usr/share/man/man5/$pkgname.conf.5.gz"
91 #rm -r "contrib/man/"
92 # example snippets
93 cp -r "contrib" "$pkgdir/usr/share/doc/$pkgname/"
94 # directories and file permission
95 install -D -m 644 "../$pkgname.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
96}
97

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion