mautrix-instagram

maintainer marcool04 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate project source on GitHub, uses standard Go build practices, and installs configuration files and a binary; the orphaned-and-readopted flag is administrative and does not indicate malicious content.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project source on GitHub, uses standard Go build practices, and installs configuration files and a binary; the orphaned-and-readopted flag is administrative and does not indicate malicious content.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Mark Collins <tera_1225 hat hotmail δot com>
    
      2
    
      3pkgname=mautrix-instagram
    
      4_name=instagram
    
      5_base_name=meta
    
      6pkgver=0.2607.0
    
      7pkgrel=1
    
      8pkgdesc="A Matrix-Instagram puppeting bridge"
    
      9arch=('x86_64' 'aarch64')
    
      10license=('AGPL-3.0-or-later')
    
      11makedepends=(
    
      12  go
    
      13)
    
      14depends=(
    
      15  glibc
    
      16  libolm
    
      17)
    
      18optdepends=('ffmpeg: If you want to send gifs from Matrix')
    
      19url="https://github.com/mautrix/meta"
    
      20source=(
    
      21  "${pkgname}-${pkgver}.zip::${url}/archive/refs/tags/v${pkgver}.zip"
    
      22  sysusers-${pkgname}.conf
    
      23  ${pkgname}.tmpfiles
    
      24  ${pkgname}.service
    
      25  log-path.diff
    
      26)
    
      27backup=("etc/${pkgname}/${pkgname}.yaml")
    
      28sha256sums=('af40b554914698e3d68567b761be369e5b309934af5a7f97734b8bc49227e897'
    
      29            '6888d152b7b6b0175160a452009b866eba53244ff844da9f6abeb02654e28be5'
    
      30            '7dfa012f34ec7f940b1c4111de701b97273b1c2f4075b2f5e67a4c2327f8fb2f'
    
      31            '9460950662be4d89a8f2f457922f0eaffbf43e9d30842b8aa3b3524dae48efae'
    
      32            '2c4f89e9aff5a246590b62d6a350fad37b0ec76407773ff4c061eda8c4dfaadf')
    
      33options=(!debug !strip)
    
      34
    
      35prepare() {
    
      36  cd "${srcdir}/${_base_name}-${pkgver}"
    
      37  go mod tidy
    
      38}
    
      39
    
      40build() {
    
      41  cd "${srcdir}/${_base_name}-${pkgver}"
    
      42  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      43  export CGO_CFLAGS="${CFLAGS}"
    
      44  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      45  export CGO_LDFLAGS="${LDFLAGS}"
    
      46  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
    
      47  export MAUTRIX_VERSION=$(cat go.mod | grep 'maunium.net/go/mautrix ' | awk '{ print $2 }')
    
      48  export GO_LDFLAGS="-s -w -X main.Tag="v${_pkgver}" -X 'maunium.net/go/mautrix.GoModVersion=$MAUTRIX_VERSION'"
    
      49  go build -ldflags "$GO_LDFLAGS" -o "$pkgname" "./cmd/$pkgname"
    
      50}
    
      51
    
      52package() {
    
      53  cd "${srcdir}/${_base_name}-${pkgver}"
    
      54  install -Dm755 "$pkgname" "${pkgdir}/usr/bin/$pkgname"
    
      55  install -Dm644 "${srcdir}/sysusers-${pkgname}.conf" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
    
      56  install -Dm644 "${srcdir}/${pkgname}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
    
      57  install -dm755 "${pkgdir}/etc/${pkgname}"
    
      58  install -Dm644 "${srcdir}/${pkgname}.service" "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
    
      59  install -Dm644 'LICENSE' "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      60  
    
      61  echo "Generating config and applying fix for log path"
    
      62  ./mautrix-instagram -e -c "${pkgdir}/etc/${pkgname}/${pkgname}.yaml"
    
      63  cd "${pkgdir}/etc/${pkgname}/"
    
      64  patch -Np1 < "$srcdir/log-path.diff"
    
      65  chmod 644 "${pkgname}.yaml"
    
      66}
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,72 +1,67 @@
+# Maintainer: Mark Collins <tera_1225 hat hotmail δot com>
+
 pkgname=mautrix-instagram
-pkgver=0.3.1
-pkgrel=3
-pkgdesc='A Matrix-Instagramhybrid puppeting/relaybot bridge'
-arch=('any')
-license=('AGPL-3.0')
-depends=(python-sqlalchemy python-alembic python-ruamel-yaml python-magic python-commonmark
-  python-aiohttp python-mautrix python-attrs python-paho-mqtt python-yarl
-  python-asyncpg python-pycryptodome)
-makedepends=('git' 'python-setuptools')
-optdepends=(
-  'python-prometheus_client: prometheus metrics'
-  'python-psycopg2: postgres'
-  'python-matrix-nio: end-to-bridge encryption'
+_name=instagram
+_base_name=meta
+pkgver=0.2607.0
+pkgrel=1
+pkgdesc="A Matrix-Instagram puppeting bridge"
+arch=('x86_64' 'aarch64')
+license=('AGPL-3.0-or-later')
+makedepends=(
+  go
 )
-backup=("etc/$pkgname/config.yaml")
-install=${pkgname}.install
-url='https://github.com/mautrix/instagram'
-license=('AGPLv3')
-arch=('any')
-source=("${pkgname}-${pkgver}::${url}/archive/v${pkgver}.tar.gz" "${pkgname}.service" "${pkgname}.sysusers" "${pkgname}.tmpfiles")
-sha256sums=('6bccc72a02e93f0dfcf0d7ba73fdd1752d9249e674fdb6c904816c3a06bba510'
-            '04905077fe628aa668d5d70729fbbd8e52654d0a2a0d1db0f173c25f68c0c56f'
-            '7cf46059f0e5f571dd18349f90d8da1e0ffadd86951c0d75c2d837113b20489e'
-            '0d6ceb4110d8e3a130e2960779cd57f9b79862a790c82ea64f989ca519ca90b0')
-backup=("etc/${pkgname}/config.yaml" "etc/${pkgname}/registration.yaml")
-install="${pkgname}.install"
-_dirname="${pkgname#mautrix-}-${pkgver}"
-
+depends=(
+  glibc
+  libolm
+)
+optdepends=('ffmpeg: If you want to send gifs from Matrix')
+url="https://github.com/mautrix/meta"
+source=(
+  "${pkgname}-${pkgver}.zip::${url}/archive/refs/tags/v${pkgver}.zip"
+  sysusers-${pkgname}.conf
+  ${pkgname}.tmpfiles
+  ${pkgname}.service
+  log-path.diff
+)
+backup=("etc/${pkgname}/${pkgname}.yaml")
+sha256sums=('af40b554914698e3d68567b761be369e5b309934af5a7f97734b8bc49227e897'
+            '6888d152b7b6b0175160a452009b866eba53244ff844da9f6abeb02654e28be5'
+            '7dfa012f34ec7f940b1c4111de701b97273b1c2f4075b2f5e67a4c2327f8fb2f'
+            '9460950662be4d89a8f2f457922f0eaffbf43e9d30842b8aa3b3524dae48efae'
+            '2c4f89e9aff5a246590b62d6a350fad37b0ec76407773ff4c061eda8c4dfaadf')
+options=(!debug !strip)
 
 prepare() {
-	cd "${srcdir}/${_dirname}"
-	# the author makes liberal usage of max version for requirements without a real need
-	# we'll strip them and re-introduce in the deps/optdeps array if truly necessary
-	# to prevent a nightmare during updates while tracking stable releases
-	cp requirements.txt ../requirements.txt.orig
-	cp optional-requirements.txt  ../optional-requirements.txt.orig
-	sed -i -E 's/,?<[[:digit:]]*\.?[[:digit:]]+,?//g' requirements.txt
-	sed -i -E 's/,?<[[:digit:]]*\.?[[:digit:]]+,?//g' optional-requirements.txt
-	# create an empty registration file so that permissions get written properly from the get go
-	# this way secret keys are never world readable
-	touch registration.yaml
+  cd "${srcdir}/${_base_name}-${pkgver}"
+  go mod tidy
 }
 
 build() {
-	cd "${srcdir}/${_dirname}"
-	python setup.py build
+  cd "${srcdir}/${_base_name}-${pkgver}"
+  export CGO_CPPFLAGS="${CPPFLAGS}"
+  export CGO_CFLAGS="${CFLAGS}"
+  export CGO_CXXFLAGS="${CXXFLAGS}"
+  export CGO_LDFLAGS="${LDFLAGS}"
+  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
+  export MAUTRIX_VERSION=$(cat go.mod | grep 'maunium.net/go/mautrix ' | awk '{ print $2 }')
+  export GO_LDFLAGS="-s -w -X main.Tag="v${_pkgver}" -X 'maunium.net/go/mautrix.GoModVersion=$MAUTRIX_VERSION'"
+  go build -ldflags "$GO_LDFLAGS" -o "$pkgname" "./cmd/$pkgname"
 }
 
 package() {
-	cd "${srcdir}/${_dirname}"
-
-	_shared_dir="/usr/share/${pkgname}"
-
-	python setup.py install --optimize=1 --skip-build --root="${pkgdir}/" --prefix="/usr" --install-data="${_shared_dir}"
-
-	# it's a semi-common failure for python packages to install tests in the main dir
-	# which would make them conflict eachother
-	rm -rf "${pkgdir}$(python -c 'import site; print(site.getsitepackages()[0])')/tests"
-
-	# install the original requirements file, useful as documentation
-	install -Dvm 644 "${srcdir}/requirements.txt.orig" "$(find ${pkgdir} -name 'requires.txt' -printf '%h')"
-	install -Dvm 644 "${srcdir}/optional-requirements.txt.orig" "$(find ${pkgdir} -name 'requires.txt' -printf '%h')"
-
-	install -Dvm 644 "${srcdir}/${pkgname}.service" "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
-	install -Dvm 644 "${srcdir}/${pkgname}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
-	install -Dvm 644 "${srcdir}/${pkgname}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
-
-	install -Dvm 640 "${pkgdir}${_shared_dir}/example-config.yaml" "${pkgdir}/etc/${pkgname}/config.yaml"
-	install -Dvm 640 registration.yaml "${pkgdir}/etc/${pkgname}/registration.yaml"
+  cd "${srcdir}/${_base_name}-${pkgver}"
+  install -Dm755 "$pkgname" "${pkgdir}/usr/bin/$pkgname"
+  install -Dm644 "${srcdir}/sysusers-${pkgname}.conf" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
+  install -Dm644 "${srcdir}/${pkgname}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
+  install -dm755 "${pkgdir}/etc/${pkgname}"
+  install -Dm644 "${srcdir}/${pkgname}.service" "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
+  install -Dm644 'LICENSE' "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+  
+  echo "Generating config and applying fix for log path"
+  ./mautrix-instagram -e -c "${pkgdir}/etc/${pkgname}/${pkgname}.yaml"
+  cd "${pkgdir}/etc/${pkgname}/"
+  patch -Np1 < "$srcdir/log-path.diff"
+  chmod 644 "${pkgname}.yaml"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 17:52:43	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0