pixum-fotowelt
LOW
maintainer kodiak
3 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The package builds from a legitimate project source hosted on a plausibly official domain (dls.photoprintit.com), checks script integrity via md5sum, and installs only the application's own files without executing untrusted remote code or exfiltrating data.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project source hosted on a plausibly official domain (dls.photoprintit.com), checks script integrity via md5sum, and installs only the application's own files without executing untrusted remote code or exfiltrating data.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
Recently orphaned & re-adopted
orphaned_readopted
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
PKGBUILD
1
# Maintainer: NoNickKnown <nonickknown at gmail dot com>
2
# forked from cewe-fotobuch, originally created by contributors listed below:
3
# Contributor: DonJaime
4
# Contributor: Jozef Riha <jose1711 at gmail dot com>
5
# Contributor: Manuel Conzelmann
6
7
# to package a different version, change this line to _productVariant=<one of the words after '_prams_' below>
8
# or download a setup file from a local CEWE site, put it in the same folder as this file, and run:
9
# _SETUP_FILE=<filename> makepkg
10
_productVariant=Pixum
11
# leave this unset to get a package name based on the application name
12
pkgname=
13
pkgrel=1
14
15
## Begin shared code ##
16
pkgdesc='an offline client for creating photobooks and other photo products and ordering them from Pixum'
17
# 7.3.1 segfaults without this:
18
options=(!strip)
19
20
declare -g -A _scriptTailMd5sums
21
_scriptTailMd5sums[7.1]=1b231f3988603dbec4e857e247784295
22
_scriptTailMd5sums[7.2]=d9edd2bb89870dc61692e73f81fe0efa
23
_scriptTailMd5sums[7.3]=8cf896344365958462902bfb340201cd
24
_scriptTailMd5sums[7.4]=b9878ccca286ec7faa4d230633294853
25
_scriptTailMd5sums[7.4a]=6f987a683f17b3595cc5993c1b1375ed
26
_scriptTailMd5sums[8.0]=e53bd9e7beabb2eb1c6857bea61ccdde
27
28
# locale, key account, original name, version, (optional) replacement name
29
_prams_Austria=(de_AT 29762 'CEWE Fotowelt' 7.1.4)
30
_prams_Belgie=(nl_BE 28049 'CEWE Photoservice' 7.1.4)
31
_prams_Belgique=(fr_BE 28049 'CEWE Photoservice' 7.1.4)
32
_prams_Czechia=(cs_CZ 4860 'CEWE fotosvet' 7.3.3 "CEWE fotosvět")
33
_prams_France=(fr_FR 7884 'Logiciel de création CEWE' 7.1.5)
34
_prams_Fnac=(fr_FR 18455 'Atelier Photo Fnac' 7.1.3)
35
_prams_Fotobuch=(de_DE 16523 'Mein CEWE FOTOBUCH' 8.0.2 'CEWE Fotobuch')
36
_prams_Fotowelt=(de_DE 6822 'CEWE Fotowelt' 7.4.0)
37
_prams_Germany=(de_DE 24441 'CEWE Fotowelt' 8.0.2)
38
_prams_Pixum=(de_DE 1291 'Pixum Fotowelt' 8.0.2)
39
_prams_Italy=(it_IT 19991 'CEWE.IT Foto World' 7.1.5)
40
_prams_Luxemburg=(de_LU 32905 'CEWE Photoservice' 7.1.5)
41
_prams_Luxembourg=(fr_LU 32905 'CEWE Photoservice' 7.1.4)
42
_prams_Netherlands=(nl_NL 28035 'CEWE Fotoservice' 7.1.4)
43
_prams_Poland=(pl_PL 29241 'CEWE Fotoswiat' 7.1.4 'CEWE Fotoświat')
44
_prams_Slovakia=(sk_SK 31916 'CEWE fotosvet' 7.1.3)
45
_prams_Slovenia=(sl_SI 17409 'CEWE Fotosvet' 7.1.5)
46
_prams_Spain=(es_ES 29227 'Taller CEWE' 7.1.3)
47
_prams_UK=(en_GB 12611 'CEWE Creator' 7.1.3)
48
49
pkgver() {
50
[ -z "$1" ] && set -- '$HPS_VER'
51
grep -m1 "my $1" ${2}install.pl | grep -Po "'.*'" | grep -Po "[^']+"
52
}
53
54
if [ -z "$_SETUP_FILE" ]
55
then
56
declare -n _prams=_prams_$_productVariant
57
# remove any accents and replace spaces and dots for setup file name
58
source="https://dls.photoprintit.com/download/Data/${_prams[1]}-${_prams[0]}/hps/setup_$(echo ${_prams[2]} | iconv -t ascii//TRANSLIT | sed 's/[ .]/_/g').tgz"
59
else
60
mkdir -p src
61
bsdtar -xf "$_SETUP_FILE" -C src install.pl
62
63
_prams=('$FULL_LOCALE' '$KEYACCID' '$APPLICATION_NAME' '$HPS_VER' "$_RENAME")
64
for _i in {0..3}
65
do
66
_prams[_i]="$(pkgver "${_prams[_i]}" src/)"
67
done
68
source="$_SETUP_FILE"
69
[ $(whoami) != root -a -z "$_UPDATING" ] && echo -e "_prams_?=(${_prams[@]:0:2} '${_prams[2]}' ${_prams[3]})\n_scriptTailMd5sums[${_prams[3]%.*}]=$(md5sum <(sed '0,/AB HIER SOLLTE NICHTS MEHR GEAENDERT WERDEN/d' src/install.pl) | grep -Po '^[^ ]*')"
70
[ -n "$_PRAMS_ONLY" ] && exit
71
fi
72
73
_keyaccount=${_prams[1]}
74
# what they call their package (e.g. MY CEWE TOO MANY CAPITALS)
75
_productUrname=${_prams[2]}
76
# what I want to call it (e.g. CEWE Sensible Name)
77
[ -z "${_prams[4]}" ] && _productRename="$_productUrname" || _productRename=${_prams[4]}
78
79
# remove accents, lowercase and replace spaces for package name
80
[ -z "$pkgname" ] && pkgname="$(iconv -t ascii//TRANSLIT <(echo $_productRename))"
81
pkgname=${pkgname,,}
82
pkgname=${pkgname// /-}
83
[ -f CEWE.install -a "$BUILDPKG" != 0 ] && sed "s/CEWE/$pkgname/" CEWE.install > $pkgname.install
84
85
conflicts=(pixum-fotowelt cewe-fotowelt cewe-fotobuch cewe-fotoservice cewe-monlivrephoto-fnac cewe-monlivrephoto-fr)
86
conflicts=(${conflicts[@]/$pkgname/})
87
88
# ${_prams[3]}
89
pkgver=${_prams[3]}
90
91
url="https://www.pixum.de/"
92
license=("custom:eula")
93
depends=('libx11' 'libjpeg' 'curl' 'wget' 'snappy' 'libxcrypt-compat')
94
makedepends=('unzip' 'xdg-utils')
95
arch=('i686' 'x86_64')
96
source=($source 'updater.pl')
97
md5sums=('838058aae62a2d64a6ce68df5e5823bd'
98
'6dbb622ce7c602a6a42e808a05f1561a')
99
install="$pkgname.install"
100
101
_installDir=/usr/share/$pkgname
102
103
check() {
104
# from start of script, where parameters are set:
105
local setRightDownloadServer="$(sed '0,/AB HIER SOLLTE NICHTS MEHR GEAENDERT WERDEN/p;d' "$src"install.pl | grep -Po '^my \$DOWNLOAD_SERVER\s+= "https://dls.photoprintit.com";')"
106
local mentionDownloadServer="$(sed '0,/AB HIER SOLLTE NICHTS MEHR GEAENDERT WERDEN/p;d' "$src"install.pl | grep -Po '.*\$DOWNLOAD_SERVER[^\r]*')"
107
# for body of script, after parameters set:
108
local md5sum=$(md5sum <(sed '0,/AB HIER SOLLTE NICHTS MEHR GEAENDERT WERDEN/d' "$src"install.pl) | grep -Po '^[^ ]*')
109
110
# only mention of server variable in parameter section should be to set correct server;
111
# md5sum of script body should match package version unless a setup file was provided:
112
local index=${pkgver%.*}
113
[ $index = 7.4 -a ${pkgver#$index.} -gt 2 ] && index=7.4a
114
[ "$mentionDownloadServer" == "$setRightDownloadServer" ] && [ "${_scriptTailMd5sums[$index]}" == $md5sum -o -n "$_SETUP_FILE" ]
115
}
116
117
package() {
118
# put icons and mimetype in the right place
119
export XDG_UTILS_INSTALL_MODE=system
120
export XDG_DATA_DIRS="$pkgdir/usr/share:"
121
122
_installDir=$pkgdir$_installDir
123
mkdir -p $_installDir $pkgdir/usr/{bin,share/icons/hicolor,share/mime/packages,share/applications}
124
125
cd $srcdir
126
# don't clear screen, fail to update system mime database, install broken desktop file, or burble
127
sed -i 's/^\s*\(system("clear"\|system("update-mime-database \|createDesktopShortcuts(\|printf(\$TRANSLATABLE\).*;//' install.pl
128
129
# don't show EULA/ask for confirmation (EULA is addressed in install script)
130
update='--update'
131
# keep packages unless updating from within application
132
[ -z "$_UPDATING" ] && keepPackages='-k' || update='--upgrade'
133
134
./install.pl $update $keepPackages --installDir="$_installDir" -v
135
136
install -m644 -b updater.pl $_installDir/updater.pl
137
sed -i "s/APPLICATION NAME/$_productRename/" $_installDir/updater.pl
138
rm $_installDir/uninstall.pl
139
140
install -D -m644 $srcdir/EULA.txt $pkgdir/usr/share/licenses/$pkgname/EULA.txt
141
142
# create startup script and desktop file
143
cat > $pkgdir/usr/bin/$pkgname <<-EOF
144
#!/usr/bin/bash
145
cd ${_installDir#$pkgdir}
146
# nouveau bug with QT web engine: https://bugreports.qt.io/browse/QTBUG-41242
147
lsmod | grep nouveau && export QT_XCB_FORCE_SOFTWARE_OPENGL=1
148
exec ./"${_productUrname/_/ }" "\$@"
149
EOF
150
cat > $pkgdir/usr/share/applications/$pkgname.desktop <<-EOF
151
[Desktop Entry]
152
Type=Application
153
Name=$_productRename
154
Comment=Offline client for cewe.de service
155
Exec=$pkgname
156
Icon=hps-$_keyaccount-$pkgver
157
StartupNotify=true
158
Categories=Graphics;Photography;
159
MimeType=application/x-hps-mcf
160
EOF
161
# make executables executable and resources available to all users
162
chmod 755 $pkgdir/usr/bin/$pkgname $pkgdir/usr/share/applications/$pkgname.desktop $(find $_installDir -type d)
163
164
# adjust product name in mimetype comment
165
sed -i "s/$_productUrname/$_productRename/" $pkgdir/usr/share/mime/packages/*
166
# remove unneeded mime cache files and installation logs
167
rm -d $pkgdir/usr/share/mime/application/* $pkgdir/usr/share/mime/* \
168
$_installDir/.log/* $_installDir/.log &> /dev/null || true
169
echo
170
}
171
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 22:16:18 | Medium | 1 |
| 2026-06-18 16:11:54 | Clean | 0 |