fusiondirectory
LOW
maintainer AlphaJack
4 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a JavaScript library from a non-whitelisted host (script.aculo.us), but it is publicly archived, widely used, and installed as static web assets without execution; the main source is from GitHub, checksummed, and the rest of the build is standard and safe.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JavaScript library from a non-whitelisted host (script.aculo.us), but it is publicly archived, widely used, and installed as static web assets without execution; the main source is from GitHub, checksummed, and the rest of the build is standard and safe.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:36
"http://script.aculo.us/dist/scriptaculous-js-1.9.0.zip"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: AlphaJack <alphajack at tuta dot io>
2
# Contributor K1412 <jonathan@opensides.be>
3
4
pkgname="fusiondirectory"
5
pkgver=1.4
6
pkgrel=2
7
pkgdesc="A combination of system administrator and end user web interface, designed to handle LDAP based setups"
8
url="http://fusiondirectory.org/"
9
license=("GPL2")
10
arch=("any")
11
depends=("gettext"
12
"openldap"
13
"perl-archive-extract"
14
"perl-bytes-random-secure"
15
"perl-crypt-cbc"
16
"perl-crypt-rijndael"
17
"perl-digest-sha"
18
"perl-file-copy-recursive"
19
"perl-ldap"
20
"perl-path-class"
21
"perl-term-readkey"
22
"perl-xml-twig"
23
"php"
24
"php-imagick"
25
"php-imap"
26
"php-pear"
27
"schema2ldif"
28
"smarty3"
29
"smarty3-gettext")
30
optdepends=("fusiondirectory-plugins: core plugins"
31
"apache: webserver"
32
"nginx: webserver"
33
"php-cas: cas authentication"
34
)
35
source=("https://github.com/fusiondirectory/$pkgname/archive/refs/tags/fusiondirectory-$pkgver.tar.gz"
36
"http://script.aculo.us/dist/scriptaculous-js-1.9.0.zip"
37
"$pkgname.php.ini"
38
"$pkgname.tmpfiles")
39
b2sums=('c0e021f9b4302e781640116097233465dd0768d4ef44c42f1051e307a341ea5cfa62bfd4c6690023e37dd7c9b5fe4b230a927c609bf530901f0f98c5623c1d29'
40
'1d3b125eaeba7c9017cb02f91b9081aceb83c0cbedcb5e6d8e3bf75d7282cc8ca2392240621f06fad8d05af0801433a8572979d95a8a6f7fb2ad47c12f23a132'
41
'44c6f9f67d2d10291ecbc5cdc652181d4e4e03ea68e559093ab5e6cf4cfd50ed5148dc840ca73e390d493652805f6ce945b8abb750a39a6a6fa7aa329aedb0bd'
42
'01764572fbcb0a39b0130b20ab1bdad7d1cd2c1800dd51a91fb71a289c2630e0f6cb82d440a59218c8117eea366fdd463f92066f3ea8bcab2c9de42e377ef5d4')
43
install="$pkgname.install"
44
options=("!strip")
45
46
prepare() {
47
cd "fusiondirectory-$pkgname-$pkgver"
48
find . -type f -exec sed -i {} \
49
-e "s|/etc/$pkgname|/etc/webapps/$pkgname|g" \
50
-e "s|/etc/ldap|/etc/openldap|g" \
51
-e "s|/var/www/$pkgname|/usr/share/webapps/$pkgname|g" \
52
-e "s|/usr/share/$pkgname|/usr/share/webapps/$pkgname|g" \;
53
sed -i "include/variables_common.inc" -e 's|"PEAR_DIR", "/usr/share/php"|"PEAR_DIR", "/usr/share/pear"|'
54
}
55
56
package(){
57
cd "fusiondirectory-$pkgname-$pkgver"
58
# directories
59
install -d -m 755 "$pkgdir/etc/openldap/schema/$pkgname"
60
install -d -m 750 "$pkgdir/etc/webapps/$pkgname"
61
install -d -m 700 "$pkgdir/var/cache/$pkgname"
62
install -d -m 755 "$pkgdir/var/cache/$pkgname/template"
63
install -d -m 755 "$pkgdir/usr/share/doc/$pkgname/"
64
install -d -m 755 "$pkgdir/usr/share/webapps/$pkgname/"
65
install -d -m 755 "$pkgdir/usr/share/php/smarty3/plugins/"
66
install -d -m 755 "$pkgdir/var/spool/$pkgname/"
67
# webapp files and javascript libraries
68
_dirs=("html" "ihtml" "include" "locale" "plugins" "setup")
69
for _dir in "${_dirs[@]}"; do
70
cp -a "$_dir" "$pkgdir/usr/share/webapps/$pkgname/"
71
done
72
cp -a ../"scriptaculous-js-1.9.0/src/"* "$pkgdir/usr/share/webapps/$pkgname/html/include"
73
cp -a ../"scriptaculous-js-1.9.0/lib/prototype.js" "$pkgdir/usr/share/webapps/$pkgname/html/include"
74
# executables, no more in 1.4
75
#find "contrib/bin/" -type f -exec chmod +x {} \;
76
#mv "contrib/bin/" "$pkgdir/usr/"
77
# ldap schemas
78
cp "contrib/openldap/"* "$pkgdir/etc/openldap/schema/$pkgname/"
79
# configuration file template
80
install -D -m 640 "contrib/$pkgname.conf" "$pkgdir/var/cache/$pkgname/template/"
81
# php extensions
82
install -D -m 644 "../$pkgname.php.ini" "$pkgdir/etc/php7/conf.d/$pkgname.ini"
83
# smarty3 plugins
84
cp "contrib/smarty/plugins/"* "$pkgdir/usr/share/php/smarty3/plugins/"
85
rm -r "contrib/smarty"
86
# man pages, no more in 1.4
87
#gzip -f "contrib/man/$pkgname-setup.1" "contrib/man/$pkgname-insert-schema.1" "contrib/man/$pkgname.conf.5"
88
#install -D -m 644 "contrib/man/$pkgname-setup.1.gz" "$pkgdir/usr/share/man/man1/$pkgname-setup.1.gz"
89
#install -D -m 644 "contrib/man/$pkgname-insert-schema.1.gz" "$pkgdir/usr/share/man/man1/$pkgname-insert-schema.1.gz"
90
#install -D -m 644 "contrib/man/$pkgname.conf.5.gz" "$pkgdir/usr/share/man/man5/$pkgname.conf.5.gz"
91
#rm -r "contrib/man/"
92
# example snippets
93
cp -r "contrib" "$pkgdir/usr/share/doc/$pkgname/"
94
# directories and file permission
95
install -D -m 644 "../$pkgname.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
96
}
97
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |