exdesktop-git

LOW

maintainer Snowy-Fluffy 0 votes scanned 2026-11-06 16:12:45.700570

View on AUR

Why flagged

The package builds from source using pinned git commits from official or plausible project repositories, with no remote code execution or obfuscated downloads; the low severity is due to unverified checksums (SKIP) and recent upload with few votes, but the sources are otherwise trustworthy and the build process is transparent.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source using pinned git commits from official or plausible project repositories, with no remote code execution or obfuscated downloads; the low severity is due to unverified checksums (SKIP) and recent upload with few votes, but the sources are otherwise trustworthy and the build process is transparent.

PKGBUILD

      1# Maintainer: Snowy-Fluffy <snowy.lnnk@gmail.com>
    
      2
    
      3# prevent excessive memory usage
    
      4export DEBUG_CFLAGS="-g1"
    
      5export DEBUG_CXXFLAGS="-g1"
    
      6
    
      7: ${_branch:=main}
    
      8: ${_commit=}
    
      9
    
      10_pkgname=exdesktop
    
      11pkgname="$_pkgname-git"
    
      12pkgver=7.3.3.8.r24.gb1023d0
    
      13pkgrel=1
    
      14pkgdesc='Unofficial Telegram Desktop fork with exteraGram features, channel feed and Python plugins (git version)'
    
      15arch=('x86_64')
    
      16url='https://github.com/metawka/exDesktop'
    
      17license=('GPL-3.0-or-later WITH OpenSSL-exception')
    
      18depends=(
    
      19	'abseil-cpp'
    
      20	'ada'
    
      21	'cairo'
    
      22	'ffmpeg'
    
      23	'fontconfig'
    
      24	'glib2'
    
      25	'glibc'
    
      26	'hicolor-icon-theme'
    
      27	'hunspell'
    
      28	'kcoreaddons'
    
      29	'libavif'
    
      30	'libfido2'
    
      31	'libgcc'
    
      32	'libheif'
    
      33	'libjpeg-turbo'
    
      34	'libjxl'
    
      35	'libpipewire'
    
      36	'libsrtp'
    
      37	'libstdc++'
    
      38	'libvpx'
    
      39	'libx11'
    
      40	'libxcb'
    
      41	'libxcomposite'
    
      42	'libxdamage'
    
      43	'libxext'
    
      44	'libxfixes'
    
      45	'libxkbcommon'
    
      46	'libxrandr'
    
      47	'libxtst'
    
      48	'lz4'
    
      49	'minizip'
    
      50	'openal'
    
      51	'openh264'
    
      52	'openssl'
    
      53	'opus'
    
      54	'pango'
    
      55	'pipewire'
    
      56	'python'
    
      57	'qt6-base'
    
      58	'qt6-declarative'
    
      59	'qt6-imageformats'
    
      60	'qt6-svg'
    
      61	'qt6-wayland'
    
      62	'rnnoise'
    
      63	'tlottie'
    
      64	'xxhash'
    
      65	'zlib'
    
      66)
    
      67makedepends=(
    
      68	'boost'
    
      69	'boost-libs'
    
      70	'cargo'
    
      71	'cmake'
    
      72	'git'
    
      73	'glib2-devel'
    
      74	'gobject-introspection'
    
      75	'gperf'
    
      76	'just'
    
      77	'libtg_owt'
    
      78	'microsoft-gsl'
    
      79	'ninja'
    
      80	'qt6-shadertools'
    
      81	'range-v3'
    
      82	'tl-expected'
    
      83	'vulkan-headers'
    
      84)
    
      85optdepends=(
    
      86	'webkit2gtk-4.1: embedded browser features provided by webkit2gtk-4.1 (gtk3)'
    
      87	'webkitgtk-6.0: embedded browser features provided by webkitgtk-6.0 (gtk4)'
    
      88	'xdg-desktop-portal: desktop integration'
    
      89)
    
      90provides=("$_pkgname=${pkgver%%.r*}")
    
      91# Ships the same org.telegram.desktop files and /usr/bin/Telegram as these.
    
      92conflicts=("$_pkgname" "$_pkgname-bin" 'telegram-desktop')
    
      93options=('!lto')
    
      94
    
      95_pkgsrc=exDesktop
    
      96_pkgsrc_td=telegram-tdlib
    
      97_pkgsrc_we=wallet-engine
    
      98# The commit of tdlib with the tde2e library that the project builds against,
    
      99# see Telegram/build/docker/centos_env/Dockerfile.
    
      100_td_commit=51743dfd01dff6179e2d8f7095729caa4e2222e9
    
      101# The wallet-engine commit and the desktop-app/patches commit that carries
    
      102# its patch, both pinned the same way in that Dockerfile.
    
      103_we_commit=e59e0d89d7ee90c388bf36e3334c5b276f396697
    
      104_patches_commit=a895fef40eaa7d66481cff542c623b039b7ce494
    
      105
    
      106source=(
    
      107	"$_pkgsrc"::"git+$url.git${_commit:+#commit=$_commit}${_commit:-${_branch:+#branch=$_branch}}"
    
      108	"$_pkgsrc_td"::"git+https://github.com/tdlib/td.git#commit=$_td_commit"
    
      109	"$_pkgsrc_we"::"git+https://github.com/i582/wallet-engine.git#commit=$_we_commit"
    
      110	"wallet-engine-$_patches_commit.patch::https://github.com/desktop-app/patches/raw/$_patches_commit/wallet-engine.patch"
    
      111)
    
      112sha256sums=('SKIP'
    
      113            'SKIP'
    
      114            'SKIP'
    
      115            'b40aba82c39a42d0526a85ecfa40d613baa57b1a2d6600e601a42a1576b3b822')
    
      116
    
      117prepare() {
    
      118	# tdesktop requires a massive patch against wallet-engine.
    
      119	cd "$_pkgsrc_we"
    
      120	patch -Np1 -i "$srcdir/wallet-engine-$_patches_commit.patch"
    
      121	cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
    
      122	cd ..
    
      123
    
      124	cd "$_pkgsrc"
    
      125
    
      126	# These come from the system packages.
    
      127	local lib
    
      128	for lib in GSL expected hunspell kcoreaddons libfido2 lz4 range-v3 xxHash; do
    
      129		git submodule deinit -f "Telegram/ThirdParty/$lib" 2>/dev/null || true
    
      130		git config "submodule.Telegram/ThirdParty/$lib.update" none
    
      131	done
    
      132	git submodule update --init --recursive --depth=1
    
      133}
    
      134
    
      135pkgver() {
    
      136	cd "$_pkgsrc"
    
      137	git describe --long --tags --match 'v[0-9]*' \
    
      138		| sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      139}
    
      140
    
      141build() {
    
      142	# Build wallet-engine
    
      143	pushd "$_pkgsrc_we"
    
      144	just build
    
      145	just bindings-cpp
    
      146	install -Dm644 target/release/libwallet_engine.a -t "$srcdir/deps/lib/"
    
      147	install -Dm644 bindings/cpp-experimental/* -t "$srcdir/deps/include/wallet_engine/"
    
      148	popd
    
      149
    
      150	# Build tde2e
    
      151	cmake -S "$_pkgsrc_td" -B build_tde2e \
    
      152		-G Ninja \
    
      153		-DCMAKE_BUILD_TYPE=None \
    
      154		-DCMAKE_INSTALL_PREFIX=/usr \
    
      155		-DTD_E2E_ONLY=ON \
    
      156		-DBUILD_SHARED_LIBS=OFF \
    
      157		-DBUILD_TESTING=OFF \
    
      158		-Wno-dev
    
      159	cmake --build build_tde2e
    
      160	DESTDIR="$srcdir/deps" cmake --install build_tde2e
    
      161
    
      162	# The official API key that Telegram uses for its snap builds, the same one
    
      163	# the telegram-desktop package in the official repositories uses:
    
      164	# https://github.com/telegramdesktop/tdesktop/blob/8fab9167beb2407c1153930ed03a4badd0c2b59f/snap/snapcraft.yaml#L87-L88
    
      165	cmake -S "$_pkgsrc" -B build \
    
      166		-G Ninja \
    
      167		-DCMAKE_BUILD_TYPE=None \
    
      168		-DCMAKE_INSTALL_PREFIX=/usr \
    
      169		-DCMAKE_PREFIX_PATH="$srcdir/deps/usr;$srcdir/deps" \
    
      170		-Dtde2e_DIR="$srcdir/deps/usr/lib/cmake/tde2e" \
    
      171		-DDESKTOP_APP_DISABLE_AUTOUPDATE=ON \
    
      172		-DDESKTOP_APP_DISABLE_CRASH_REPORTS=ON \
    
      173		-DTDESKTOP_API_ID=611335 \
    
      174		-DTDESKTOP_API_HASH=d524b414d21f4d37f08684c1df41ac9c \
    
      175		-Wno-dev
    
      176	cmake --build build
    
      177}
    
      178
    
      179package() {
    
      180	DESTDIR="$pkgdir" cmake --install build
    
      181
    
      182	# The Python plugin engine looks for its host scripts here.
    
      183	install -d "$pkgdir/usr/share/exDesktop/python/extera"
    
      184	cp -r --no-preserve=ownership "$_pkgsrc/Telegram/SourceFiles/extera/python/." \
    
      185		"$pkgdir/usr/share/exDesktop/python/extera/"
    
      186	find "$pkgdir/usr/share/exDesktop" -name __pycache__ -type d -prune -exec rm -rf {} +
    
      187
    
      188	install -Dm644 "$_pkgsrc/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      189}
    
      190

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 16:12:45	Low	2