blender-git

maintainer fbrennan · 76 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged URL is for the official Blender project repository on projects.blender.org, which is a legitimate and expected source for a development version of Blender; building from a non-whitelisted but project-owned Git host is normal for AUR packages and does not constitute a security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged URL is for the official Blender project repository on projects.blender.org, which is a legitimate and expected source for a development version of Blender; building from a non-whitelisted but project-owned Git host is normal for AUR packages and does not constitute a security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:54 source=("blender::git-lfs+https://projects.blender.org/blender/blender${_fragment}"

PKGBUILD

1 offending line(s) highlighted

      1#!/bin/bash
    
      2# Maintainer: Fredrick Brennan <copypaste@kittens.ph>
    
      3# Submitter: Lukas Jirkovsky <l.jirkovsky@gmail.com>
    
      4# Co-maintainer: bartus <arch-user-repoᘓbartus.33mail.com>
    
      5# Contributor: Adrian Sausenthaler <aur@sausenthaler.de>
    
      6
    
      7#Configuration:
    
      8#Use: makepkg VAR1=0 VAR2=1 to enable(1) disable(0) a feature
    
      9#Use: {yay,paru} --mflags=VAR1=0,VAR2=1
    
      10#Use: aurutils --margs=VAR1=0,VAR2=1
    
      11#Use: VAR1=0 VAR2=1 pamac
    
      12
    
      13# Use FRAGMENT=#{commit,tag,brach}=xxx for bisect build
    
      14_fragment="${FRAGMENT:-#branch=main}"
    
      15# revert oneapi:2025.3 conflicts
    
      16_git_revert=(49414a72f607ccd15f8b71b81edc9aff040d581e) # v3.1 arch
    
      17
    
      18# Use CUDA_ARCH to build for specific GPU architecture
    
      19# Supports: single arch (sm_52) and list of archs (sm_52;sm_60)
    
      20[[ -v CUDA_ARCH ]] && _CMAKE_FLAGS+=(-DCYCLES_CUDA_BINARIES_ARCH="${CUDA_ARCH}")
    
      21[[ -v HIP_ARCH  ]] && _CMAKE_FLAGS+=(-DCYCLES_HIP_BINARIES_ARCH="${HIP_ARCH}")
    
      22
    
      23pkgname=blender-git
    
      24pkgver=5.3.r163133.gc9dd766ce9c2
    
      25pkgrel=1
    
      26pkgdesc="A fully integrated 3D graphics creation suite (development)"
    
      27arch=('i686' 'x86_64')
    
      28url="https://blender.org/"
    
      29options=(!lto)
    
      30depends+=('alembic' 'ceres-solver' 'eigen' 'embree' 'libgl' 'python' 'python-numpy' 'openjpeg2' 'libharu' 'potrace' 'openxr'
    
      31          'ffmpeg' 'fftw' 'openal' 'freetype2' 'libxi' 'manifold' 'openimageio' 'opencolorio'
    
      32          'openvdb' 'opensubdiv' 'openshadinglanguage' 'libtiff' 'libpng'
    
      33          'python' 'python-zstandard' 'ccache')
    
      34depends+=('libdecor' 'libepoxy')
    
      35optdepends=('cuda: CUDA support in Cycles'
    
      36            'optix8: OptiX support in Cycles >=8.0.0 <9.0.0'
    
      37            'usd: USD export Scene'
    
      38            'openpgl: Intel Path Guiding library in Cycles'
    
      39            'openimagedenoise: Intel Open Image Denoise support in compositing'
    
      40            'materialx: MaterialX materials'
    
      41            'level-zero-headers: Intel OpenCL FPGA kernels (all four needed)'
    
      42            'intel-compute-runtime: Intel OpenCL FPGA kernels (all four needed)'
    
      43            'intel-oneapi-compiler-shared-runtime: Intel OpenCL FPGA kernels (all four needed)'
    
      44            'intel-oneapi-dpcpp-cpp: Intel OpenCL FPGA kernels (all four needed)'
    
      45            'makepkg-cg: Control resources during compilation')
    
      46makedepends+=('git' 'cmake' 'boost' 'mesa' 'llvm' 'clang' 'subversion' 'ninja' 'mold')
    
      47makedepends+=('wayland-protocols')
    
      48makedepends+=('cython')
    
      49makedepends+=('vulkan-headers')
    
      50makedepends+=('makepkg-git-lfs-proto') # provides /usr/share/makepkg/source/git-lfs.sh (download_git-lfs, extract_git-lfs)
    
      51provides=('blender')
    
      52conflicts=('blender')
    
      53license=('GPL')
    
      54source=("blender::git-lfs+https://projects.blender.org/blender/blender${_fragment}"
    
      55        blender-fix-oneapi-2026.patch::https://raw.githubusercontent.com/intel/llvm/20a7095cba72ace59f7c8a64711ec4b51f01f030/devops/actions/blender/blender-build/patches/Fix-build.patch
    
      56  )
    
      57sha256sums=('SKIP'
    
      58            '154d89a0187476265f3d29fbc3ec696c0e293e27f75a4c633ea81393ab9a1ae2'
    
      59  )
    
      60
    
      61pkgver() {
    
      62  blender_version=$(grep -Po "BLENDER_VERSION \K[0-9]{3}" "$srcdir"/blender/source/blender/blenkernel/BKE_blender_version.h)
    
      63  printf "%d.%d.r%s.g%s" \
    
      64    $((blender_version/100)) \
    
      65    $((blender_version%100)) \
    
      66    "$(git -C "$srcdir/blender" rev-list --count HEAD)" \
    
      67    "$(git -C "$srcdir/blender" rev-parse --short HEAD)"
    
      68}
    
      69
    
      70prepare() {
    
      71  mapfile -t patches < <(grep -Po '^.*?(patch|diff)(?=::|$)' < <(printf "${srcdir}/%s\n" ${source[@]}))
    
      72  for patch in "${patches[@]}"; do
    
      73    msg2  "apply ${patch##*/}..."
    
      74    git -C "${srcdir}"/blender apply -v "${patches[@]}"
    
      75  done
    
      76  if [ -v _git_revert ]; then
    
      77  msg2  "revert ${_git_revert[@]}..."
    
      78  [[ -v _git_revert ]] && git -C "${srcdir}"/blender revert --no-commit -Xours "${_git_revert[@]}" || git -C "${srcdir}"/blender revert --abort
    
      79  fi
    
      80# remove deprecated headers in rocm:7
    
      81  sed -e '/Geometry.h/d' -e '/Scene.h/d' -i "$srcdir"/blender/intern/cycles/kernel/CMakeLists.txt
    
      82}
    
      83
    
      84build() {
    
      85  _pyver=$(python -c "from sys import version_info; print(\"%d.%d\" % (version_info[0],version_info[1]))")
    
      86  msg "python version detected: ${_pyver}"
    
      87
    
      88  _CMAKE_FLAGS+=( -DPYTHON_VERSION=$_pyver
    
      89                  -DPYTHON_LIBRARY=/usr/lib/libpython${_pyver}.so
    
      90                  -DWITH_PYTHON_INSTALL=OFF
    
      91                  -DWITH_PYTHON_SAFETY=OFF )
    
      92
    
      93
    
      94  # check for oneapi
    
      95  export _ONEAPI_CLANG=/opt/intel/oneapi/compiler/latest/bin/compiler/clang
    
      96  export _ONEAPI_CLANGXX=/opt/intel/oneapi/compiler/latest/bin/compiler/clang++
    
      97  if [ -f "$_ONEAPI_CLANG" ]; then
    
      98    _CMAKE_FLAGS+=( -DWITH_CYCLES_DEVICE_ONEAPI=ON
    
      99                    -DWITH_CYCLES_ONEAPI_BINARIES=ON
    
      100                    -DWITH_CLANG=ON
    
      101                    -DSYCL_CPP_FLAGS="--verbose"  # for debugging
    
      102                    -DOCLOC_INSTALL_DIR=/usr
    
      103                    -DSYCL_ROOT_DIR=/opt/intel/oneapi/compiler/latest/
    
      104                    -DSYCL_OFFLINE_COMPILER_PARALLEL_JOBS=$(nproc)
    
      105                  )
    
      106  else
    
      107    # Because some defaults are ON.
    
      108    _CMAKE_FLAGS+=( -DWITH_CYCLES_DEVICE_ONEAPI=OFF
    
      109                    -DWITH_CYCLES_ONEAPI_BINARIES=OFF )
    
      110  fi
    
      111
    
      112  # determine whether we can precompile CUDA kernels
    
      113  _CUDA_PKG=$(pacman -Qq cuda 2>/dev/null) || true
    
      114  if [ "$_CUDA_PKG" != "" ]; then
    
      115    export CUDAHOSTCXX="$NVCC_CCBIN" # defined in /etc/profile.d/cuda.sh
    
      116    # https://wiki.blender.org/wiki/Building_Blender/GPU_Binaries
    
      117    _CMAKE_FLAGS+=( -DWITH_CYCLES_CUDA_BINARIES=ON
    
      118                    -DWITH_COMPILER_ASAN=OFF
    
      119                    -DCMAKE_CUDA_HOST_COMPILER=${NVCC_CCBIN} ) # defined in /etc/profile.d/cuda.sh
    
      120  fi
    
      121
    
      122  # check for materialx
    
      123  _MX_PKG=$(pacman -Qq materialx 2>/dev/null) || true
    
      124  if [ "$_MX_PKG" != "" ]; then
    
      125    _CMAKE_FLAGS+=( -DWITH_MATERIALX=ON )
    
      126  fi
    
      127
    
      128  _USD_PKG=$(pacman -Qq usd 2>/dev/null) || true
    
      129  if [ "$_USD_PKG" != "" ]; then
    
      130    _CMAKE_FLAGS+=( -DWITH_USD=ON )
    
      131  fi
    
      132
    
      133  # check for optix
    
      134  _OPTIX_PKG=$(pacman -Qq optix8 2>/dev/null) || true
    
      135  if [ "$_OPTIX_PKG" != "" ]; then
    
      136      _CMAKE_FLAGS+=( -DWITH_CYCLES_DEVICE_OPTIX=ON
    
      137                      -DOPTIX_ROOT_DIR=/opt/optix )
    
      138  fi
    
      139
    
      140  # check for open image denoise
    
      141  _OIDN_PKG=$(pacman -Qq openimagedenoise 2>/dev/null) || true
    
      142  if [ "$_OIDN_PKG" != "" ]; then
    
      143      _CMAKE_FLAGS+=( -DWITH_OPENIMAGEDENOISE=ON )
    
      144  fi
    
      145
    
      146  if [ -d /opt/rocm/bin ]; then
    
      147      _CMAKE_FLAGS+=( -DWITH_CYCLES_HIP_BINARIES=ON
    
      148                      -DWITH_CYCLES_DEVICE_HIP=ON
    
      149                      -DWITH_CYCLES_DEVICE_HIPRT=ON
    
      150                      -DHIP_ROOT_DIR=/opt/rocm
    
      151                      -DHIPRT_INCLUDE_DIR=/opt/rocm/include
    
      152                      -DHIPRT_COMPILER_PARALLEL_JOBS=$(nproc)
    
      153                      -DWITH_CYCLES_HYDRA_RENDER_DELEGATE=OFF
    
      154                    )
    
      155  else
    
      156      # Because some defaults are ON.
    
      157      _CMAKE_FLAGS+=( -DWITH_CYCLES_HIP_BINARIES=OFF
    
      158                      -DWITH_CYCLES_DEVICE_HIP=OFF
    
      159                      -DWITH_CYCLES_DEVICE_HIPRT=OFF
    
      160                    )
    
      161  fi
    
      162
    
      163  #default cmake flags
    
      164  _CMAKE_FLAGS+=(
    
      165                -C "${srcdir}/blender/build_files/cmake/config/blender_release.cmake"
    
      166                -G Ninja
    
      167                -DCMAKE_INSTALL_PREFIX=/usr
    
      168                -DCMAKE_INSTALL_PREFIX_WITH_CONFIG="${pkgdir}/usr"
    
      169                -DWITH_LINKER_MOLD=ON
    
      170                -DCMAKE_SKIP_INSTALL_RPATH=ON
    
      171                -DCMAKE_SKIP_BUILD_RPATH=ON
    
      172                -DCMAKE_BUILD_TYPE=Release
    
      173                -DWITH_INSTALL_PORTABLE=OFF
    
      174                -DWITH_LIBS_PRECOMPILED=OFF
    
      175                -DWITH_STATIC_LIBS=OFF
    
      176                -DXR_OPENXR_SDK_ROOT_DIR=/usr
    
      177                -DPYTHON_VERSION="${_pyver}"
    
      178  )
    
      179
    
      180
    
      181  USING_MAKEPKG_CG="$(systemctl --user -t slice | grep -o makepkg-cg-`id -u`-'[[:digit:]]\+'.slice'[[:space:]]\+'loaded'[[:space:]]\+'active)" || true
    
      182  MAKEPKG_CG_WARNING=\
    
      183'If you use systemd, consider trying `makepkg-cg`.
    
      184This build is otherwise very likely to use more RAM than
    
      185the system has, especially with a high `-j`!'
    
      186  [[ -z "$USING_MAKEPKG_CG" ]] && warning "$MAKEPKG_CG_WARNING"
    
      187  cmake -S blender -B build -G Ninja "${_CMAKE_FLAGS[@]}"
    
      188  cmake --build build ${MAKEFLAGS:--j1}
    
      189}
    
      190
    
      191package() {
    
      192  _suffix=${pkgver%%.r*}
    
      193  sed -e 's/\(file(INSTALL\)\(.*blender\.1"\))/#\1\2)/' \
    
      194      -e 's|/usr/lib/python/|/usr/lib64/python3.13/|g' \
    
      195      -i "$srcdir"/build/source/creator/cmake_install.cmake
    
      196  BLENDER_SYSTEM_RESOURCES="${pkgdir}/usr/share/blender/${_suffix}" DESTDIR="${pkgdir}" cmake --install build
    
      197
    
      198  cd blender
    
      199  install -Dm755 release/bin/blender-softwaregl "${pkgdir}/usr/bin/blender-softwaregl" || true
    
      200  install -Dm644 release/freedesktop/org.blender.Blender.metainfo.xml "${pkgdir}/usr/share/metainfo/org.blender.Blender.metainfo.xml"
    
      201  install -vDm 644 doc/license/{BSD-{2,3}-Clause,MIT,Zlib}-license.txt -t "$pkgdir/usr/share/licenses/blender/"
    
      202
    
      203  python -m compileall "${pkgdir}/usr/share/blender"
    
      204  python -O -m compileall "${pkgdir}/usr/share/blender"
    
      205
    
      206  # Move OneAPI AOT lib to proper place
    
      207  mkdir "${pkgdir}"/usr/lib/
    
      208  mv "${pkgdir}"/usr/share/blender/lib/libcycles_kernel_oneapi_aot.so "${pkgdir}"/usr/lib/ || warning "OneAPI missing from the build!"
    
      209
    
      210  if [[ -e "$pkgdir/usr/share/blender/${_suffix}/scripts/addons/cycles/lib/" ]] ; then
    
      211    # make sure the cuda kernels are not stripped
    
      212    chmod 444 "$pkgdir"/usr/share/blender/${_suffix}/scripts/addons/cycles/lib/*
    
      213  fi
    
      214}
    
      215
    
      216# vim: syntax=bash:et:ts=2:sw=2
    
      217

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2