matomo-bin
LOW
maintainer C0rn3j
35 votes
scanned 2026-10-30 00:29:30.650963
Why flagged
The source is a prebuilt tarball from the official project's build domain (builds.matomo.org), which is plausibly project-owned; the package installs static web files and performs standard relocations, with no execution of remote code or obfuscated payloads.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt tarball from the official project's build domain (builds.matomo.org), which is plausibly project-owned; the package installs static web files and performs standard relocations, with no execution of remote code or obfuscated payloads.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
"https://builds.matomo.org/${_pkgname}-${pkgver}.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Martin Rys <https://rys.rs/contact>
2
# Contributor: Chris Morgan <me@chrismorgan.info>
3
# Contributor: Carsten Feuls <archlinux dot carstenfeuls dot de>
4
# Contributor: Nils Czernia <nils at czserver dot de>
5
6
pkgname=matomo-bin
7
_pkgname=matomo
8
pkgver=5.14.2
9
pkgrel=1
10
pkgdesc="A real-time web analytics platform"
11
arch=("any")
12
url="https://matomo.org/"
13
license=("GPL-3.0-or-later")
14
depends=("php" "php-gd")
15
replaces=("piwik")
16
conflicts=("matomo")
17
provides=("matomo")
18
optdepends=(
19
"mariadb: Database server"
20
"python: Log importer script"
21
"geoipupdate: GeoIP database")
22
install="${_pkgname}.install"
23
source=(
24
"https://builds.matomo.org/${_pkgname}-${pkgver}.tar.gz"
25
"https://builds.matomo.org/${_pkgname}-${pkgver}.tar.gz.asc")
26
backup=("usr/share/webapps/${_pkgname}/piwik.js" "usr/share/webapps/${_pkgname}/matomo.js")
27
sha256sums=('769982163c1677cfd23490f20daffbaa6d0d39b32844399dbfbacba2457fefb7'
28
'SKIP')
29
30
validpgpkeys=("F529A27008477483777FC23D63BB30D0E5D2C749")
31
32
package() {
33
install -d "${pkgdir}/usr/share/webapps"
34
cp -r "${srcdir}/${_pkgname}" "${pkgdir}/usr/share/webapps/${_pkgname}"
35
# Some extensions want to append to piwik.js (matomo.js from 3.8.0 onwards),
36
# so we reluctantly let them.
37
chmod g+w "${pkgdir}/usr/share/webapps/${_pkgname}/piwik.js"
38
chmod g+w "${pkgdir}/usr/share/webapps/${_pkgname}/matomo.js"
39
40
# While installing matomo, it insists on being able to write to the config directory,
41
# because it creates config.ini.php. After it’s installed, you can make it read-only,
42
# e.g. by `chown -R root:http /etc/webapps/${_pkgname}`
43
install -d "${pkgdir}/etc/webapps"
44
mv "${pkgdir}/usr/share/webapps/${_pkgname}/config" "${pkgdir}/etc/webapps/${_pkgname}"
45
ln -s "/etc/webapps/${_pkgname}" "${pkgdir}/usr/share/webapps/matomo/config"
46
47
# matomo uses this tmp dir for writing its own data;
48
# but it belongs in /var rather than /usr.
49
rmdir "${pkgdir}/usr/share/webapps/matomo/tmp"
50
install -dm700 "${pkgdir}/var/lib/webapps/matomo/tmp"
51
ln -s "/var/lib/webapps/matomo/tmp" "${pkgdir}/usr/share/webapps/matomo/tmp"
52
53
# Installing or upgrading non-core plugins requires write access to plugins/;
54
# we could try g+w on the directory and try to restrict core plugins, but
55
# then you’ve got mixed ownership (anything it creates will be http:http
56
# instead of root:http) which is nasty. Another approach is to put `plugins`
57
# in /var/lib with core plugins *actually* in /usr/share and symlinked back;
58
# but that’s getting too clever for my sanity at present: this is all getting
59
# rather bothersome; I’m tired of messing around with PHP apps that are
60
# ill-designed for hardening and not designed for use in the scope of a
61
# system package manager. So for now at least, we’re just going to leave it
62
# as it is, chown the whole plugins directory in matomo.install, and wash our
63
# hands of it.
64
65
# GeoLite2-City.mmdb is provided by geoipupdate, which is optdepends.
66
# See /etc/GeoIP.conf and make sure to enable geoipupdate's timer
67
# Keep in mind it takes a while before a newly generated license becomes active
68
# I figure a dead symlink should be safe if the DB is missing.
69
ln -s "/var/lib/GeoIP/GeoLite2-City.mmdb" "${pkgdir}/usr/share/webapps/matomo/misc"
70
}
71
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-10-30 00:29@@ -5,7 +5,7 @@ pkgname=matomo-bin _pkgname=matomo-pkgver=5.11.2+pkgver=5.14.2 pkgrel=1 pkgdesc="A real-time web analytics platform" arch=("any")@@ -24,7 +24,7 @@ "https://builds.matomo.org/${_pkgname}-${pkgver}.tar.gz" "https://builds.matomo.org/${_pkgname}-${pkgver}.tar.gz.asc") backup=("usr/share/webapps/${_pkgname}/piwik.js" "usr/share/webapps/${_pkgname}/matomo.js")-sha256sums=('ceb9c6111fabce8541efea22548bd30c602e4067b825fc29fbc6b2b6229b56f1'+sha256sums=('769982163c1677cfd23490f20daffbaa6d0d39b32844399dbfbacba2457fefb7' 'SKIP') validpgpkeys=("F529A27008477483777FC23D63BB30D0E5D2C749")Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 23:54:04 | Medium | 1 |
| 2026-06-19 19:07:35 | Clean | 2 |
| 2026-06-18 17:53:10 | Clean | 2 |
| 2026-06-18 16:11:54 | Medium | 1 |