agisoft-metashape

maintainer dobedobedo · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt tarball from a non-whitelisted but plausibly official AWS S3 host used by Agisoft; the content is not executed remotely and matches the project's own software distribution, posing low supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt tarball from a non-whitelisted but plausibly official AWS S3 host used by Agisoft; the content is not executed remotely and matches the project's own software distribution, posing low supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://s3-eu-west-1.amazonaws.com/download.agisoft.com/${_pkgname}_${pkgver//./_}_amd64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yu-Hsuan Tu <dobe0331 at gmail dot com>
    
      2_pkgname=metashape
    
      3pkgname=agisoft-${_pkgname}
    
      4pkgver=2.3.1
    
      5pkgrel=3
    
      6pkgdesc="Photogrammetric processing of digital images and 3D spatial data generation software. Standard edition"
    
      7arch=('x86_64')
    
      8url="https://www.agisoft.com/"
    
      9license=('custom:Agisoft EULA' 'custom')
    
      10depends=('gcc' 'libxml2-legacy')
    
      11makedepends=('imagemagick')
    
      12optdepends=('glu: mesa OpenGL lib'
    
      13            'nvidia-utils: nvidia proprietary OpenGL and Vulkan lib'
    
      14            'opencl-mesa: mesa rusticl OpenCL runtime for GPU acceleration'
    
      15	    'rocm-opencl-runtime: AMD ROCm OpenCL runtime for GPU acceleration'
    
      16            'cuda: nvidia CUDA runtime for GPU acceleration'
    
      17            'intel-compute-runtime: Intel Neo OpenCL runtime for GPU acceleration'
    
      18	    'vulkan-icd-loader: Vulkan installable client driver loader for texture blending on GPU'
    
      19	    'vulkan-radeon: AMD Vulkan driver for texture blending on GPU'
    
      20	    'vulkan-intel: Intel Vulkan driver for texture blending on GPU')
    
      21provides=('agisoft-metashape')
    
      22options=('!strip')
    
      23install=${pkgname}.install
    
      24source=("https://s3-eu-west-1.amazonaws.com/download.agisoft.com/${_pkgname}_${pkgver//./_}_amd64.tar.gz"
    
      25        "agisoft-metashape-icon-encoded.txt"
    
      26        "agisoft-psx-mime-icon-encoded.txt"
    
      27	"agisoft-psz-mime-icon-encoded.txt")
    
      28sha256sums=('da070ad8dea85f7feff66fcbae8e3688cd827e553e41772fc13da3ed3d8923f0'
    
      29            '959eb21ce482a5b1f84a0e04ec6f0d53aaf679c84bce9f813b350afe5dd201ba'
    
      30            '627df01b98f9f22b31d62ba039127b7809650990d1633e4190f1d9844830a0ff'
    
      31            'd44fb70962175505fd3bfc0e96670e5bf4092c80446e0142cc91a3e0033e1009')
    
      32
    
      33build() {
    
      34    # Create desktop entries
    
      35    echo "[Desktop Entry]
    
      36Type=Application
    
      37Name=Agisoft MetaShape
    
      38Comment=Photogrammetric processing software
    
      39Exec=agisoft-metashape
    
      40MimeType=application/agisoft.psx;application/agisoft.psz
    
      41Icon=agisoft-metashape
    
      42Terminal=false
    
      43Categories=Science;ImageProcessing" > "$srcdir/agisoft-metashape.desktop"
    
      44
    
      45    # Create MetaShape MIME type file
    
      46    echo '<?xml version="1.0" encoding="UTF-8"?>
    
      47<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
    
      48    <mime-type type="application/agisoft.psx">
    
      49        <comment>MetaShape Project</comment>
    
      50        <icon name="application-agisoft-psx"/>
    
      51        <glob-deleteall/>
    
      52        <glob pattern="*.psx"/>
    
      53    </mime-type>
    
      54    <mime-type type="application/agisoft.psz">
    
      55        <comment>MetaShape Archive</comment>
    
      56        <icon name="application-agisoft-psz"/>
    
      57        <glob-deleteall/>
    
      58        <glob pattern="*.psz"/>
    
      59    </mime-type>
    
      60</mime-info>' > "$srcdir/${pkgname}-mime.xml"
    
      61
    
      62    # Create 128x128 application icons
    
      63    base64 -d "$srcdir/agisoft-metashape-icon-encoded.txt" > "$srcdir/agisoft-metashape_128.png"
    
      64    
    
      65    # Create 128x128 mime icons
    
      66    base64 -d "$srcdir/agisoft-psx-mime-icon-encoded.txt" > "$srcdir/application-agisoft-psx_128.png"
    
      67    base64 -d "$srcdir/agisoft-psz-mime-icon-encoded.txt" > "$srcdir/application-agisoft-psz_128.png"
    
      68    
    
      69    # Create icons for other resolutions
    
      70    for _res in 16 32 48 64; do
    
      71        magick "$srcdir/agisoft-metashape_128.png" -resize ${_res}x${_res} "$srcdir/agisoft-metashape_${_res}.png"
    
      72        magick "$srcdir/application-agisoft-psx_128.png" -resize ${_res}x${_res} "$srcdir/application-agisoft-psx_${_res}.png"
    
      73        magick "$srcdir/application-agisoft-psz_128.png" -resize ${_res}x${_res} "$srcdir/application-agisoft-psz_${_res}.png"
    
      74    done
    
      75    
    
      76    # Create executables for /usr/bin
    
      77    echo "#!/bin/bash
    
      78/opt/agisoft/${_pkgname}/metashape.sh \$@" > "$srcdir/agisoft-metashape"
    
      79}
    
      80
    
      81package() {
    
      82    # Move extracted folder to opt
    
      83    cd "$pkgdir"
    
      84    mkdir -p "opt/agisoft"
    
      85    mv "${srcdir}/${_pkgname}" "${pkgdir}/opt/agisoft/"
    
      86
    
      87    # Install licenses
    
      88    cd opt/agisoft/${_pkgname}
    
      89    install -Dm644 eula.txt "$pkgdir/usr/share/licenses/$pkgname/eula.txt"
    
      90    mv licenses "$pkgdir/usr/share/licenses/$pkgname"
    
      91    rm eula.txt
    
      92
    
      93    # Move desktop entries
    
      94    mkdir -p "${pkgdir}/usr/share/applications/"
    
      95    mv "${srcdir}/agisoft-metashape.desktop" "${pkgdir}/usr/share/applications/"
    
      96
    
      97    # Create MIME type
    
      98    mkdir -p "${pkgdir}/usr/share/mime/packages"
    
      99    mv "${srcdir}/${pkgname}-mime.xml" "${pkgdir}/usr/share/mime/packages"
    
      100
    
      101    # Move icons
    
      102    for _res in 16x16 32x32 48x48 64x64 128x128; do
    
      103        mkdir -p "${pkgdir}/usr/share/icons/hicolor/${_res}/apps/"
    
      104        mkdir -p "${pkgdir}/usr/share/icons/hicolor/${_res}/mimetypes/"
    
      105        mv "$srcdir/agisoft-metashape_${_res/x*}.png" "${pkgdir}/usr/share/icons/hicolor/${_res}/apps/agisoft-metashape.png"
    
      106        mv "$srcdir/application-agisoft-psx_${_res/x*}.png" "${pkgdir}/usr/share/icons/hicolor/${_res}/mimetypes/application-agisoft-psx.png"
    
      107        mv "$srcdir/application-agisoft-psz_${_res/x*}.png" "${pkgdir}/usr/share/icons/hicolor/${_res}/mimetypes/application-agisoft-psz.png"
    
      108    done
    
      109    
    
      110    # Create executables in /usr/bin
    
      111    install -Dm755 "$srcdir/agisoft-metashape" "$pkgdir/usr/bin/agisoft-metashape"
    
      112
    
      113    # Set the rehostable directory and environment variables in executables for activation
    
      114    mkdir -p "${pkgdir}/opt/agisoft/${_pkgname}/licensing"
    
      115    sed -i '/export LD_LIBRARY_PATH/a\\nAGISOFT_LICENSING_DIR=\$dirname/licensing\nexport AGISOFT_LICENSING_DIR' "${pkgdir}/opt/agisoft/${_pkgname}/metashape.sh"
    
      116
    
      117    # Set correct permission
    
      118    chmod -R g=u "$pkgdir/opt/agisoft/${_pkgname}"
    
      119    chmod -R o=u "$pkgdir/opt/agisoft/${_pkgname}"
    
      120    chmod -R g-w "$pkgdir/opt/agisoft/${_pkgname}"
    
      121    chmod -R o-w "$pkgdir/opt/agisoft/${_pkgname}"
    
      122    chmod -R g=u "$pkgdir/usr/share/licenses/$pkgname/licenses"
    
      123    chmod -R o=u "$pkgdir/usr/share/licenses/$pkgname/licenses"
    
      124    chmod -R g-w "$pkgdir/usr/share/licenses/$pkgname/licenses"
    
      125    chmod -R o-w "$pkgdir/usr/share/licenses/$pkgname/licenses"
    
      126}
    
      127

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2