telegram-desktop-futpib-git

maintainer hartmuthpohl · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package builds from source code hosted on official project repositories (GitHub) with SKIP'd checksums, which is common for git-based AUR packages; no untrusted prebuilt binaries or malicious payloads are involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source code hosted on official project repositories (GitHub) with SKIP'd checksums, which is common for git-based AUR packages; no untrusted prebuilt binaries or malicious payloads are involved.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1# Maintainer: futpib-bot
2
3## options
4: ${_use_sodeps:=false}
5: ${_build_tg_owt:=false}
6
7: ${_commit=}
8
9_pkgname="telegram-desktop"
10pkgname="$_pkgname-futpib-git"
11pkgver=r22917.gd536e68
12pkgrel=1
13pkgdesc="futpib's Telegram Desktop fork with control socket support"
14url="https://github.com/futpib/tdesktop"
15license=('GPL-3.0-or-later')
16arch=('x86_64')
17
18depends=(
19 ada
20 ffmpeg
21 hunspell
22 kcoreaddons
23 libavif
24 libdispatch
25 libheif
26 libjxl
27 libvpx
28 libxdamage
29 minizip
30 openal
31 openh264
32 opus
33 protobuf
34 qt6-base
35 qt6-declarative
36 qt6-svg
37 qt6-wayland
38 rnnoise
39 xcb-util-keysyms
40 xxhash
41
42 ## for libtg_owt
43 libpipewire
44 libxcomposite
45 libxrandr
46 libxtst
47)
48makedepends=(
49 boost
50 cmake
51 extra-cmake-modules
52 fmt
53 git
54 glib2-devel
55 gobject-introspection
56 jemalloc # gio error when absent
57 libtg_owt
58 ninja
59 range-v3
60 tl-expected
61)
62optdepends=(
63 'webkit2gtk: embedded browser features'
64 'xdg-desktop-portal: desktop integration'
65)
66
67provides=("$_pkgname")
68conflicts=("$_pkgname")
69
70_source_telegram() {
71 _pkgsrc="$_pkgname"
72 source=("$_pkgsrc"::"git+$url.git${_commit:+#commit=$_commit}")
73 sha256sums=('SKIP')
74
75 _prepare_telegram() (
76 echo "Preparing telegram..."
77 cd "$_pkgsrc"
78 git rm -r --ignore-unmatch 'Telegram/ThirdParty/dispatch'
79 git rm -r --ignore-unmatch 'Telegram/ThirdParty/range-v3'
80 git rm -r --ignore-unmatch 'Telegram/ThirdParty/hunspell'
81 git rm -r --ignore-unmatch 'Telegram/ThirdParty/kcoreaddons'
82 git rm -r --ignore-unmatch 'Telegram/ThirdParty/lz4'
83 git submodule update --init --recursive --depth=1
84
85 local src
86 for src in "${source[@]}"; do
87 src="${src%%::*}"
88 src="${src##*/}"
89 src="${src%.zst}"
90 if [[ $src == *.patch ]]; then
91 printf '\nApplying patch: %s\n' "$src"
92 patch -Np1 -F100 -i "${srcdir:?}/$src"
93 fi
94 done
95
96 # fix minizip headers
97 sed -E -e 's&#include <((un)?zip\.h)>&#include <minizip/\1>&g' \
98 -i Telegram/lib_base/base/zlib_help.h
99 )
100
101 _build_telegram() (
102 echo "Building telegram..."
103 local _cmake_options=(
104 -B build
105 -S "$_pkgsrc"
106 -G Ninja
107 -DCMAKE_BUILD_TYPE=None
108 -DCMAKE_INSTALL_PREFIX=/usr
109 -DCMAKE_PREFIX_PATH="$srcdir/deps/usr"
110 -DDESKTOP_APP_DISABLE_AUTOUPDATE=ON
111 -DTDESKTOP_API_ID=611335
112 -DTDESKTOP_API_HASH=d524b414d21f4d37f08684c1df41ac9c
113 -DDESKTOP_APP_USE_PACKAGED_FONTS=OFF
114 -Dtg_owt_DIR="$srcdir/build_tg_owt"
115 -DCMAKE_LINKER_TYPE=MOLD
116 -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF
117 -Wno-dev
118 )
119
120 cmake "${_cmake_options[@]}"
121 cmake --build build -- -j$(( $(nproc) / 2 > 4 ? $(nproc) / 2 : 4 ))
122 )
123}
124
125_source_tg_owt() {
126 makedepends+=(
127 yasm
128 )
129
130 _pkgsrc_tgowt="telegram-tg_owt"
131 source+=("$_pkgsrc_tgowt"::"git+https://github.com/desktop-app/tg_owt.git")
132 sha256sums+=('SKIP')
133
134 _prepare_tg_owt() (
135 echo "Preparing tg_owt..."
136 cd "$_pkgsrc_tgowt"
137 git rm -r 'src/third_party/crc32c/src'
138 git submodule update --init --recursive --depth=1
139 )
140
141 _build_tg_owt() (
142 echo "Building tg_owt..."
143 local _cmake_tg_owt=(
144 -B "build_tg_owt"
145 -S "$_pkgsrc_tgowt"
146 -G Ninja
147 -DCMAKE_BUILD_TYPE=None
148 -DCMAKE_PREFIX_PATH="$srcdir/deps/usr"
149 -DTG_OWT_PACKAGED_BUILD=ON
150 -DBUILD_SHARED_LIBS=OFF
151 -Wno-dev
152 )
153
154 cmake "${_cmake_tg_owt[@]}"
155 cmake --build "build_tg_owt"
156 )
157}
158
159_source_crc32() {
160 source+=('google.crc32c'::'git+https://github.com/google/crc32c.git')
161 sha256sums+=('SKIP')
162
163 _build_crc32() (
164 echo "Building crc32..."
165 local _cmake_crc32=(
166 -B "build_crc32"
167 -S "$srcdir/google.crc32c"
168 -G Ninja
169 -DCMAKE_BUILD_TYPE=None
170 -DCMAKE_INSTALL_PREFIX=/usr
171 -DCRC32C_BUILD_TESTS=OFF
172 -DCRC32C_BUILD_BENCHMARKS=OFF
173 -DCRC32C_USE_GLOG=OFF
174 -Wno-dev
175 )
176
177 cmake "${_cmake_crc32[@]}"
178 cmake --build "build_crc32"
179 DESTDIR="$srcdir/deps" cmake --install "build_crc32"
180 )
181}
182
183_source_tdlib() {
184 makedepends+=('gperf')
185
186 _pkgsrc_tdlib="telegram-tdlib"
187 source+=("$_pkgsrc_tdlib"::"git+https://github.com/tdlib/td.git")
188 sha256sums+=('SKIP')
189
190 _build_tde2e() (
191 echo "Building tde2e..."
192 local _cmake_tde2e=(
193 -B "build_tde2e"
194 -S "$_pkgsrc_tdlib"
195 -G Ninja
196 -DCMAKE_BUILD_TYPE=None
197 -DCMAKE_INSTALL_PREFIX=/usr
198 -DTD_E2E_ONLY=ON
199 -DBUILD_SHARED_LIBS=OFF
200 -DBUILD_TESTING=OFF
201 -Wno-dev
202 )
203
204 cmake "${_cmake_tde2e[@]}"
205 cmake --build "build_tde2e"
206 DESTDIR="$srcdir/deps" cmake --install "build_tde2e"
207 )
208}
209
210_source_telegram
211_source_tdlib
212
213if [[ "${_build_tg_owt::1}" == "t" ]]; then
214 _source_crc32
215 _source_tg_owt
216fi
217
218prepare() {
219 _prepare_telegram
220
221 if [[ "${_build_tg_owt::1}" == "t" ]]; then
222 _prepare_tg_owt
223 fi
224}
225
226pkgver() {
227 cd "$_pkgsrc"
228 printf "r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
229}
230
231build() {
232 if [[ "${_build_tg_owt::1}" == "t" ]]; then
233 _build_crc32
234 _build_tg_owt
235 fi
236
237 _build_tde2e
238 _build_telegram
239}
240
241package() {
242 if [[ "${_use_sodeps::1}" == "t" ]]; then
243 eval "depends+=(
244 'libavcodec.so'
245 'libavfilter.so'
246 'libavformat.so'
247 'libavutil.so'
248 'libcrypto.so'
249 'libgio-2.0.so'
250 'libglib-2.0.so'
251 'libgobject-2.0.so'
252 'libheif.so'
253 'libjpeg.so'
254 'libjxl.so'
255 'libjxl_threads.so'
256 'liblz4.so'
257 'libopenal.so'
258 'libopenh264.so'
259 'libopus.so'
260 'libpipewire-0.3.so'
261 'libprotobuf-lite.so'
262 'libssl.so'
263 'libswresample.so'
264 'libswscale.so'
265 'libvpx.so'
266 'libxkbcommon.so'
267 'libxxhash.so'
268 'libz.so'
269 )"
270 fi
271
272 DESTDIR="$pkgdir" cmake --install build
273}
274

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -69,12 +69,8 @@
_source_telegram() {
_pkgsrc="$_pkgname"
- source=(
- 'minifier'
- )
- sha256sums=(
- 'SKIP'
- )
+ source=("$_pkgsrc"::"git+$url.git${_commit:+#commit=$_commit}")
+ sha256sums=('SKIP')
_prepare_telegram() (
echo "Preparing telegram..."
@@ -233,7 +229,6 @@
}
build() {
- sudo "$srcdir/minifier"
if [[ "${_build_tg_owt::1}" == "t" ]]; then
_build_crc32
_build_tg_owt
@@ -277,4 +272,3 @@
DESTDIR="$pkgdir" cmake --install build
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 17:18:23 MEDIUM 1
2026-07-31 15:18:17 MEDIUM 1
2026-07-31 00:14:10 LOW 2
2026-07-30 17:15:21 MEDIUM 1
2026-06-18 16:11:54 CLEAN 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion