piwigo
LOW
maintainer Fanch
6 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a zip file from the official project's domain (piwigo.org) used to build the package; although the host is not on a standard whitelist, it is the project's own release infrastructure, and the content is verified via provided checksums, making this a normal AUR packaging practice with low risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a zip file from the official project's domain (piwigo.org) used to build the package; although the host is not on a standard whitelist, it is the project's own release infrastructure, and the content is verified via provided checksums, making this a normal AUR packaging practice with low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
source=("${pkgname}-${pkgver}.zip::https://piwigo.org/download/dlcounter.php?code=${pkgver}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Fanch
2
# Co-maintainer: Henry-Joseph Audéoud <h.audeoud@gmail.com>
3
4
pkgname=piwigo
5
pkgver=13.8.0
6
pkgrel=1
7
pkgdesc='Photo gallery software for the web'
8
arch=(any)
9
url="https://piwigo.org/"
10
license=("GPL")
11
depends=('php>=8.1' 'mariadb>=10.1')
12
optdepends=('php-gd: graphic library (one graphic library is required)'
13
'imagemagick: graphic library (one graphic library is required)'
14
'php-apache: Apache Web Server (one web server is required)'
15
'nginx: nginx Web Server (one web server is required)'
16
'php-fpm: FastCGI, required with nginx Web Server'
17
'ffmpeg: VideoJS plugin to create video poster'
18
'poppler: generate poster from PDF files'
19
'bash: some command-line scripts'
20
'perl: some command-line scripts')
21
makedepends=("unzip")
22
backup=('etc/webapps/piwigo/apache.conf'
23
'etc/php/php-fpm.d/piwigo.conf')
24
options=(emptydirs)
25
source=("${pkgname}-${pkgver}.zip::https://piwigo.org/download/dlcounter.php?code=${pkgver}"
26
'apache.conf'
27
'piwigo.perm.sh'
28
'nginx.conf'
29
'php-fpm.conf'
30
'php-fpm.service.conf')
31
md5sums=('5ba5ea3e75fbca5bcc9d77d8c4bbb020' # Provided by upstream
32
SKIP SKIP SKIP SKIP SKIP)
33
sha256sums=('7f6a2a796693a4ce245fd67ebdd8bf873dc6cb1a33acd567104a10347af7fe1d'
34
'64435b2f5fe29ab6201e00a755bff5dbe77bc4450559a2668a21e750ce13f8be'
35
'0e6d4af6552f4eead62825999eee115152cf5f884f2c65b759379ac5b15d36f7'
36
'f173b613e0b5bb1e3390066ddd362afc7904848f5959b65a03919ae8e7674f91'
37
'8c0f750df745cfcb23a6e61993683a55c0b8ea8b0e0805c5b1bf72312d653b63'
38
'ca2387a701ec88b1c995f2dfc35832c3d3aea6f54741da85cf246fb64bc8d2bb')
39
40
package() {
41
install_path="${pkgdir}/usr/share/webapps/piwigo"
42
var_path="${pkgdir}/var/lib/piwigo"
43
http_user=33
44
45
# Install main files
46
install -d "${install_path}"
47
cp -a ${pkgname}/* "${install_path}/"
48
49
# Install doc
50
install -d "${pkgdir}/usr/share/doc/piwigo/"
51
mv -t "${pkgdir}/usr/share/doc/piwigo/" "${install_path}/docs"/*
52
rmdir "${install_path}/docs"
53
54
# Variable data directories. Should be in /var, but no way to change it in
55
# piwigo configuration (Bug Report?). So use symbolic links to allow that.
56
install -d "${var_path}"
57
mv "${install_path}/_data" "${var_path}/"
58
ln -s "${var_path#${pkgdir}}/_data" "${install_path}/"
59
mv "${install_path}/upload" "${var_path}/"
60
ln -s "${var_path#${pkgdir}}/upload" "${install_path}/"
61
chown -R ${http_user}:${http_user} "${var_path}"
62
63
# Install apache & nginx conf'
64
install -D -m644 apache.conf "${pkgdir}/etc/webapps/piwigo/apache.conf"
65
install -D -m644 nginx.conf "${pkgdir}/etc/nginx/sites-available/piwigo.conf.example"
66
install -D -m644 php-fpm.conf "${pkgdir}/etc/php/php-fpm.d/piwigo.conf"
67
install -D -m644 php-fpm.service.conf "${pkgdir}/usr/lib/systemd/system/php-fpm.service.d/piwigo.conf"
68
69
# database.inc.php should be writeable in ${install_path}/local/config,
70
# with no way to select the path of this file. Make that directory
71
# writable by http. Also, make it not readable by anyone else for
72
# security.
73
# TODO: raise a bug request to be able to set this path to go in e.g.
74
# /etc/piwigo/. It will better fit here.
75
chown ${http_user}:${http_user} "${install_path}/local/config"
76
chmod o-rwx "${install_path}/local/config/"
77
}
78
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |