colmap
LOW
maintainer bartus
7 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads vocabulary tree data files from a non-whitelisted but project-associated host (demuc.de, the author's domain); these are static data files, not executable code, used for feature matching in COLMAP, and the downloads are checksum-verified.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads vocabulary tree data files from a non-whitelisted but project-associated host (demuc.de, the author's domain); these are static data files, not executable code, used for feature matching in COLMAP, and the downloads are checksum-verified.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:36
"vocabulary-tree-32K.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words32K.bin"
PKGBUILD
1 offending line(s) highlighted
1
#!/bin/hint/bash
2
# Maintainer : bartus <arch-user-repoᘓbartus.33mail.com>
3
# to.do:
4
# *use aur/faiss _CMAKE_FLAGS+=(-DFETCH_FAISS=OFF)
5
6
check_option "debug" "y" && BUILD_TYPE=Debug || BUILD_TYPE=Release
7
8
## Configuration env vars:
9
_ver=4.2.0
10
_BUILD_CUDA="${BUILD_CUDA:-ON}"
11
_CUDA_ARCH="${CUDA_ARCH:-native}"
12
_fragment=${FRAGMENT:-#tag=$_ver}
13
# Use CMAKE_FLAGS=xxx:yyy:zzz to define extra CMake flags
14
[[ -v CMAKE_FLAGS ]] && mapfile -t -d: _CMAKE_FLAGS < <(echo -n "$CMAKE_FLAGS")
15
16
_name=colmap
17
#fragment="#commit=5bea89263bf5f3ed623b8e6e6a5f022a0ed9c1de"
18
pkgname=${_name}
19
pkgver=$_ver
20
pkgrel=4
21
pkgdesc="General-purpose Structure-from-Motion (SfM) and Multi-View Stereo (MVS) pipeline with a graphical and command-line interface."
22
arch=('i686' 'x86_64')
23
url="https://colmap.github.io/"
24
license=('GPL')
25
groups=()
26
depends=('cgal' 'ceres-solver' 'gflags' 'metis' 'openimageio' 'suitesparse' 'freeglut' 'glew' 'google-glog' 'libjpeg-turbo' 'boost-libs' qt5-{base,svg} 'flann')
27
makedepends=('boost' 'cmake' 'eigen' 'git' 'ninja' 'python-sphinx')
28
if [ "$_BUILD_CUDA" == "ON" ] ; then
29
depends+=('onnxruntime-cuda' 'protobuf')
30
makedepends+=('cuda')
31
optdepends+=('libcudart.so: required for dense reconstruction')
32
else
33
depends+=('onnxruntime-cpu' 'protobuf')
34
fi
35
source=("${pkgname}::git+https://github.com/colmap/colmap.git${_fragment}"
36
"vocabulary-tree-32K.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words32K.bin"
37
"vocabulary-tree-256K.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words256K.bin"
38
"vocabulary-tree-1M.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words1M.bin"
39
)
40
sha256sums=('939d6d410feabaf7f36b4750ec1d36165a2653186bfc6b6fe48cad28e9beeddf'
41
'd37d8f19ee0a49705c4c0b06967a08cedfed5cf86519eada3271497256732bc2'
42
'd2055600452a531b5b0a62aa5943e1a07195273dc4eeebcf23d3a924d881d53a'
43
'fb60f7ba8081ee5c278f03c62329a374d1b24136b374a49393b453db1529a8c6')
44
45
prepare() {
46
sed -e '1 i\#include <cassert>' -i "${srcdir}"/${pkgname}/src/colmap/sfm/observation_manager.cc
47
}
48
49
build() {
50
# determine whether we can precompile CUDA kernels
51
_CUDA_PKG=$(pacman -Qsq cuda 2>/dev/null) || true
52
if [[ -n "$_CUDA_PKG" && "$_BUILD_CUDA" == "ON" ]]; then
53
# determine whether we need to define cuda host compiler
54
if _cuda_gcc=$(readlink /opt/cuda/bin/gcc) ; then
55
[ -f "$_cuda_gcc" ] && export CUDAHOSTCXX="$_cuda_gcc"
56
fi
57
_CMAKE_FLAGS+=( -DCUDA_ENABLED=ON
58
-DCUDA_TOOLKIT_ROOT_DIR=/opt/cuda
59
-DCMAKE_CUDA_ARCHITECTURES="$_CUDA_ARCH"
60
)
61
else
62
_CMAKE_FLAGS+=( -DCUDA_ENABLED=OFF )
63
fi
64
65
_CMAKE_FLAGS+=( -DTESTS_ENABLED=OFF
66
-DCMAKE_BUILD_TYPE=${BUILD_TYPE}
67
-DFETCH_ONNX=OFF
68
-DCMAKE_INSTALL_PREFIX=/usr )
69
cmake "${_CMAKE_FLAGS[@]}" -G Ninja -S "$pkgname" -B build
70
# shellcheck disable=SC2046 # allow MAKEFLAGS to carry multiple flags.
71
ninja -C "$srcdir/build" $(grep -oP -- '-+[A-z]+ ?[0-9]*'<<<"${MAKEFLAGS:--j1}")
72
}
73
74
75
package() {
76
DESTDIR="${pkgdir}" ninja -C build install
77
78
# build manpage
79
make -C "${pkgname}/doc" man BUILDDIR="$PWD" && \
80
install -Dm644 man/colmap.1 -t "${pkgdir}/usr/share/man/man1"
81
82
# install vocabulary trees for sequential,vocabulary matching
83
install -d -m755 "${pkgdir}/usr/share/${_name}"
84
for vocab_tree in "${srcdir}"/vocabulary-tree-*.bin ; do
85
install -m644 "${vocab_tree}" "${pkgdir}/usr/share/${_name}/${vocab_tree##*/}"
86
done
87
88
# install license
89
install -Dm644 "${srcdir}/${pkgname}/COPYING.txt" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
90
}
91
# vim:set ts=2 sw=2 et:
92
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |