blender-as-py-module
LOW
maintainer jagot
3 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The non-standard host is for a legitimate project dependency (NVIDIA OptiX headers) from a vendor's official domain, and the source is built from official Git repositories; the worst case of a swapped source is limited to non-executed data or headers, not remote code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The non-standard host is for a legitimate project dependency (NVIDIA OptiX headers) from a vendor's official domain, and the source is built from official Git repositories; the worst case of a swapped source is limited to non-executed data or headers, not remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
source=("${pkgname}-${pkgver}::git+https://git.blender.org/blender.git#tag=v$pkgver" -
PKGBUILD:27
https://developer.download.nvidia.com/redist/optix/v7.0/OptiX-7.0.0-include.zip
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Stefanos Carlström <stefanos.carlstrom@gmail.com>
2
3
# This PKGBUILD is based on that for the full application found in the
4
# main package repo, but customized to compile a standalone Python
5
# module.
6
7
pkgname=blender-as-py-module
8
pkgver=2.93.3
9
pkgrel=1
10
pkgdesc="A fully integrated 3D graphics creation suite, to be used as Python module. Useful for programmatic/batch rendering."
11
arch=('x86_64')
12
license=('GPL')
13
url="https://www.blender.org"
14
depends=('libpng' 'libtiff' 'openexr' 'python' 'desktop-file-utils' 'python-requests' 'potrace'
15
'shared-mime-info' 'hicolor-icon-theme' 'xdg-utils' 'glew' 'openjpeg2' 'python-numpy'
16
'freetype2' 'openal' 'ffmpeg' 'fftw' 'boost-libs' 'opencollada' 'alembic' 'openxr'
17
'openimageio' 'libsndfile' 'jack' 'opencolorio' 'openshadinglanguage' 'openimagedenoise'
18
'jemalloc' 'libspnav' 'ptex' 'opensubdiv' 'openvdb' 'log4cplus' 'sdl2' 'embree')
19
makedepends=('cmake' 'boost' 'mesa' 'git' 'llvm' 'cuda' 'ninja')
20
optdepends=('cuda: cycles renderer cuda support')
21
options=(!strip)
22
source=("${pkgname}-${pkgver}::git+https://git.blender.org/blender.git#tag=v$pkgver"
23
"git+https://git.blender.org/blender-addons.git"
24
"git+https://git.blender.org/blender-addons-contrib.git"
25
"git+https://git.blender.org/blender-translations.git"
26
"git+https://git.blender.org/blender-dev-tools.git"
27
https://developer.download.nvidia.com/redist/optix/v7.0/OptiX-7.0.0-include.zip
28
blender-openexr3.patch)
29
sha512sums=('SKIP'
30
'SKIP'
31
'SKIP'
32
'SKIP'
33
'SKIP'
34
'b2cff73def3757d4259f4b4d318a8ccfe166bf7c215cbb2124f1c81bd6e742f96207285b24eb4d99b527b7b97dc6d5e8fdf2f16d78d5d1e2684c26d681328491'
35
'e2dd7210d26b70445e9ae8e33dea35111ad0b0aca9d3b4ded3df560d0fcc8dc044868f729e0f090a04b6f316f083b5505a7056ce088e8702065add87b9b457e5')
36
37
prepare() {
38
cd "$srcdir/$pkgname-$pkgver"
39
40
git submodule init
41
git config submodule."release/scripts/addons".url "${srcdir}/blender-addons"
42
git config submodule."release/scripts/addons_contrib".url "${srcdir}/blender-addons-contrib"
43
git config submodule."release/datafiles/locale".url "${srcdir}/blender-translations"
44
git config submodule."source/tools".url "${srcdir}/blender-dev-tools"
45
git submodule update
46
git submodule foreach git checkout v${pkgver}
47
48
patch -p1 < "$srcdir"/blender-openexr3.patch # Fix build with OpenEXR 3
49
}
50
51
build() {
52
cd "$srcdir/$pkgname-$pkgver"
53
54
local PYTHON_VER=3.9
55
export PYTHONHASHSEED=0
56
57
cmake . \
58
-Bbuild \
59
-GNinja \
60
-Cbuild_files/cmake/config/bpy_module.cmake .. \
61
-DOPTIX_ROOT_DIR="$srcdir"/include \
62
-DWITH_CYCLES_EMBREE=ON \
63
-DCMAKE_INSTALL_PREFIX=/usr \
64
-DCMAKE_BUILD_TYPE=Release \
65
-DWITH_INSTALL_PORTABLE=OFF \
66
-DWITH_PYTHON_INSTALL=OFF \
67
-DPYTHON_VERSION=$PYTHON_VER \
68
-DPYTHON_LIBPATH=/usr/lib \
69
-DPYTHON_LIBRARY=python$PYTHON_VER \
70
-DPYTHON_INCLUDE_DIRS=/usr/include/python$PYTHON_VER \
71
-DCMAKE_CXX_FLAGS="-I /usr/include/python$PYTHON_VER"
72
ninja -C build
73
}
74
75
package() {
76
cd "$srcdir/$pkgname-$pkgver"
77
78
DESTDIR="${pkgdir}" ninja -C build install
79
python -m compileall "${pkgdir}/usr/share/blender"
80
python -O -m compileall "${pkgdir}/usr/share/blender"
81
}
82
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |