◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

matomo

maintainer Spixmaster · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The external download is a geolocation database from a legitimate project-controlled domain (download.db-ip.com), used as non-executable data, and the build process compiles only the project's own source code from declared git repositories.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The external download is a geolocation database from a legitimate project-controlled domain (download.db-ip.com), used as non-executable data, and the build process compiles only the project's own source code from declared git repositories.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

  • PKGBUILD:113 while [[ "$(curl -o /dev/null/ -sw "%{http_code}" https://download.db-ip.com/free/dbip-city-lite-"${_current_year}"-"${_current_month}".mmdb.gz || true)" != "200" ]]; do
  • PKGBUILD:133 curl -o "${srcdir}"/DBIP-City.mmdb.gz https://download.db-ip.com/free/dbip-city-lite-"${_current_year}"-"${_current_month}".mmdb.gz

PKGBUILD

2 offending line(s) highlighted
1#!/usr/bin/env bash
2# shellcheck disable=SC2034
3# shellcheck disable=SC2154
4# The PKGBUILD for Matomo.
5# Maintainer: Matheus <matheusgwdl@protonmail.com>
6# Contributor: Matheus <matheusgwdl@protonmail.com>
7
8declare -r _tag="4a6c282486661287a0cba3fd5e24d450fac07da6"
9
10pkgname="matomo"
11pkgver="5.12.0"
12pkgrel="1"
13pkgdesc="A powerful web analytics platform."
14arch=("x86_64")
15url="https://github.com/matomo-org/${pkgname}"
16license=("GPL-3.0-or-later")
17depends=("bash" "gcc-libs" "glibc" "lib32-glibc" "mariadb" "nodejs" "perl" "php" "php-gd" "python" "python-beautifulsoup4" "python-requests" "python-yaml" "rhino")
18makedepends=("composer" "curl" "git" "git-lfs" "npm")
19checkdepends=("alsa-lib" "at-spi2-core" "cairo" "coffeescript" "dbus" "expat" "glib2" "gtk3" "java-runtime" "libcups" "libdrm" "libx11" "libxcb" "libxcomposite" "libxdamage" "libxext" "libxfixes" "libxkbcommon" "libxrandr" "libxshmfence" "mesa" "nspr" "nss" "pango" "ruby")
20optdepends=("apache: HTTP server."
21 "certbot: Creates SSL certificates."
22 "mod_fcgid: FastCGI."
23 "nginx: HTTP server."
24 "php-cgi: CGI."
25 "php-fpm: FastCGI."
26 "php-legacy-cgi: CGI."
27 "php-legacy-fpm: FastCGI."
28 "spawn-fcgi: FastCGI."
29 "uwsgi-plugin-php: CGI."
30 "uwsgi-plugin-php-legacy: CGI."
31)
32provides=("${pkgname}")
33conflicts=("matomo-bin")
34options=("!strip")
35install="${pkgname}.install"
36source=("${pkgname}::git+${url}.git#tag=${_tag}"
37 "git+https://github.com/matomo-org/matomo-icons.git"
38 "git+https://github.com/matomo-org/matomo-log-analytics.git"
39 "git+https://github.com/matomo-org/plugin-AnonymousPiwikUsageMeasurement.git"
40 "git+https://github.com/matomo-org/plugin-Bandwidth.git"
41 "git+https://github.com/matomo-org/plugin-CustomAlerts.git"
42 "git+https://github.com/matomo-org/plugin-CustomVariables.git"
43 "git+https://github.com/matomo-org/plugin-DeviceDetectorCache.git"
44 "git+https://github.com/matomo-org/plugin-LoginLdap.git"
45 "git+https://github.com/matomo-org/plugin-LogViewer.git"
46 "git+https://github.com/matomo-org/plugin-MarketingCampaignsReporting.git"
47 "git+https://github.com/matomo-org/plugin-Provider.git"
48 "git+https://github.com/matomo-org/plugin-QueuedTracking.git"
49 "git+https://github.com/matomo-org/plugin-SecurityInfo.git"
50 "git+https://github.com/matomo-org/plugin-TasksTimetable.git"
51 "git+https://github.com/matomo-org/plugin-TrackingSpamPrevention.git"
52 "git+https://github.com/matomo-org/plugin-TreemapVisualization.git"
53 "git+https://github.com/matomo-org/plugin-VisitorGenerator.git"
54 "git+https://github.com/matomo-org/tag-manager.git"
55 "git+https://github.com/matomo-org/travis-scripts.git"
56 "override-${pkgname}.conf")
57sha512sums=("2c09322006f8c501ceb165a3e172e08bdb24d96f398c3308648a782e41d08793e4cd5bc630428aac0a3702e5c4fe3fb9721f2d6c9cf5210e25dc923543c5f363"
58 "SKIP"
59 "SKIP"
60 "SKIP"
61 "SKIP"
62 "SKIP"
63 "SKIP"
64 "SKIP"
65 "SKIP"
66 "SKIP"
67 "SKIP"
68 "SKIP"
69 "SKIP"
70 "SKIP"
71 "SKIP"
72 "SKIP"
73 "SKIP"
74 "SKIP"
75 "SKIP"
76 "SKIP"
77 "3802c7aae4c26cf23a61c48fedabe1d4bb516bbc07e42573cdb8cdfd19a556cc0b65941eae03ceb1c9cbf3eff2d40742e01eea12f3b420ae0d277c3582368b34")
78
79prepare()
80{
81 cd "${srcdir}"/"${pkgname}"/ || exit 1
82 git submodule init
83
84 git config submodule.misc/log-analytics.url "${srcdir}"/matomo-log-analytics/
85 git config submodule.plugins/AnonymousPiwikUsageMeasurement.url "${srcdir}"/plugin-AnonymousPiwikUsageMeasurement/
86 git config submodule.plugins/Bandwidth.url "${srcdir}"/plugin-Bandwidth/
87 git config submodule.plugins/CustomAlters.url "${srcdir}"/plugin-CustomAlters/
88 git config submodule.plugins/CustomVariables.url "${srcdir}"/plugin-CustomVariables/
89 git config submodule.plugins/DeviceDetectorCache.url "${srcdir}"/plugin-DeviceDetectorCache/
90 git config submodule.plugins/LoginLdap.url "${srcdir}"/plugin-LoginLdap/
91 git config submodule.plugins/LogViewer.url "${srcdir}"/plugin-LogViewer/
92 git config submodule.plugins/MarketingCampaignsReporting.url "${srcdir}"/plugin-MarketingCampaignsReporting/
93 git config submodule.plugins/Morpheus/icons.url "${srcdir}"/matomo-icons/
94 git config submodule.plugins/Provider.url "${srcdir}"/plugin-Provider/
95 git config submodule.plugins/QueuedTracking.url "${srcdir}"/plugin-QueuedTracking/
96 git config submodule.plugins/SecurityInfo.url "${srcdir}"/plugin-SecurityInfo/
97 git config submodule.plugins/TagManager.url "${srcdir}"/tag-manager/
98 git config submodule.plugins/TasksTimetable.url "${srcdir}"/plugin-TasksTimetable/
99 git config submodule.plugins/TrackingSpamPrevention.url "${srcdir}"/plugin-TrackingSpamPrevention/
100 git config submodule.plugins/TreemapVisualization.url "${srcdir}"/plugin-TreemapVisualization/
101 git config submodule.plugins/VisitorGenerator.url "${srcdir}"/plugin-VisitorGenerator/
102 git config submodule.tests/travis.url "${srcdir}"/travis-scripts/
103
104 git -c protocol.file.allow=always submodule update
105
106 # Geolocation database
107 ## Do not use option "-i" as it will remove the preceding "0".
108 declare _current_year
109 _current_year="$(date +"%Y")"
110 declare _current_month
111 _current_month="$(date +"%m")"
112
113 while [[ "$(curl -o /dev/null/ -sw "%{http_code}" https://download.db-ip.com/free/dbip-city-lite-"${_current_year}"-"${_current_month}".mmdb.gz || true)" != "200" ]]; do
114 ## Remove the preceding "0".
115 if [[ "${_current_month::1}" -eq "0" ]]; then
116 _current_month=${_current_month:1}
117 fi
118
119 ## Take the last month.
120 if [[ "${_current_month}" -gt "1" ]]; then
121 ((_current_month--))
122 else
123 ((_current_year--))
124 _current_month="12"
125 fi
126
127 ## Put a "0" at the beginning again.
128 if [[ "${#_current_month}" -eq "1" ]]; then
129 _current_month="0${_current_month}"
130 fi
131 done
132
133 curl -o "${srcdir}"/DBIP-City.mmdb.gz https://download.db-ip.com/free/dbip-city-lite-"${_current_year}"-"${_current_month}".mmdb.gz
134 gzip -d "${srcdir}"/DBIP-City.mmdb.gz
135}
136
137build()
138{
139 cd "${srcdir}"/"${pkgname}"/ || exit 1
140 composer install --no-dev
141
142 declare -r _package_jsons="$(find "${srcdir}"/"${pkgname}"/ -name package.json -type f)"
143 readarray -t _package_json_array <<< "${_package_jsons}"
144
145 for _package_json in "${_package_json_array[@]}"; do
146 if [[ "${_package_json}" != "${srcdir}"/"${pkgname}"*/node_modules/* ]]; then
147 cd "$(dirname "${_package_json}")" || exit 1
148 # TODO Not usable yet, https://github.com/matomo-org/matomo/issues/23667.
149 #npm install --omit dev
150 npm install
151 fi
152 done
153
154 cd "${srcdir}"/"${pkgname}"/ || exit 1
155 # TODO Node.js v16 is currently needed, https://github.com/matomo-org/matomo/issues/21440.
156 #./console development:enable
157 #./console vue:build
158 ./console development:disable
159}
160
161package()
162{
163 # Assure that the directories exist.
164 mkdir -p "${pkgdir}"/usr/lib/systemd/system/php-fpm.service.d/
165 mkdir -p "${pkgdir}"/usr/share/doc/"${pkgname}"/
166 mkdir -p "${pkgdir}"/usr/share/webapps/"${pkgname}"/misc/
167
168 # Install the software.
169 cp -r "${srcdir}"/"${pkgname}"/ "${pkgdir}"/usr/share/webapps/
170 install -Dm644 "${srcdir}"/DBIP-City.mmdb "${pkgdir}"/usr/share/webapps/"${pkgname}"/misc/
171 install -Dm644 "${srcdir}"/override-"${pkgname}".conf "${pkgdir}"/usr/lib/systemd/system/php-fpm.service.d/
172 chown -R http:http "${pkgdir}"/usr/share/webapps/"${pkgname}"/
173
174 # Install the documentation.
175 install -Dm644 "${srcdir}"/"${pkgname}"/README.md "${pkgdir}"/usr/share/doc/"${pkgname}"/
176}
177

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion