colmap

maintainer bartus · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host (demuc.de) hosts precomputed vocabulary tree data files used by COLMAP, which are static binary data files, not executable code; the worst case of a malicious swap would be denial-of-service or crashes, not remote code execution, and the primary source is the official GitHub repository built from git.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host (demuc.de) hosts precomputed vocabulary tree data files used by COLMAP, which are static binary data files, not executable code; the worst case of a malicious swap would be denial-of-service or crashes, not remote code execution, and the primary source is the official GitHub repository built from git.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 "vocabulary-tree-32K.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words32K.bin"

PKGBUILD

1 offending line(s) highlighted

      1#!/bin/hint/bash
    
      2# Maintainer : bartus <arch-user-repoᘓbartus.33mail.com>
    
      3
    
      4check_option "debug" "y" && BUILD_TYPE=Debug || BUID_TYPE=Release
    
      5
    
      6## Configuration env vars:
    
      7_ver=4.1.0
    
      8_BUILD_CUDA="${BUILD_CUDA:-ON}"
    
      9_CUDA_ARCH="${CUDA_ARCH:-native}"
    
      10_fragment=${FRAGMENT:-#tag=$_ver}
    
      11# Use CMAKE_FLAGS=xxx:yyy:zzz to define extra CMake flags
    
      12[[ -v CMAKE_FLAGS ]] && mapfile -t -d: _CMAKE_FLAGS < <(echo -n "$CMAKE_FLAGS")
    
      13
    
      14_name=colmap
    
      15#fragment="#commit=5bea89263bf5f3ed623b8e6e6a5f022a0ed9c1de"
    
      16pkgname=${_name}
    
      17pkgver=$_ver
    
      18pkgrel=3
    
      19pkgdesc="General-purpose Structure-from-Motion (SfM) and Multi-View Stereo (MVS) pipeline with a graphical and command-line interface."
    
      20arch=('i686' 'x86_64')
    
      21url="https://colmap.github.io/"
    
      22license=('GPL')
    
      23groups=()
    
      24depends=('cgal' 'ceres-solver' 'gflags' 'fmt' 'openimageio' 'suitesparse' 'freeglut' 'glew' 'google-glog' 'libjpeg' 'boost-libs' qt5-{base,svg} 'metis' 'flann')
    
      25makedepends=('boost' 'cmake' 'eigen' 'git' 'ninja' 'python-sphinx')
    
      26if [ "$_BUILD_CUDA" == "ON" ] ; then 
    
      27  depends+=('onnxruntime-cuda' 'protobuf')
    
      28  makedepends+=('cuda')
    
      29  optdepends+=('libcudart.so: required for dense reconstruction')
    
      30else
    
      31  depends+=('onnxruntime-cpu' 'protobuf')
    
      32fi
    
      33source=("${pkgname}::git+https://github.com/colmap/colmap.git${_fragment}"
    
      34        "vocabulary-tree-32K.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words32K.bin"
    
      35        "vocabulary-tree-256K.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words256K.bin"
    
      36        "vocabulary-tree-1M.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words1M.bin"
    
      37        )
    
      38sha256sums=('2d63490b0d44917ea7083cc41b541e911d81b304d78f077a614de04c8f7a4c64'
    
      39            'd37d8f19ee0a49705c4c0b06967a08cedfed5cf86519eada3271497256732bc2'
    
      40            'd2055600452a531b5b0a62aa5943e1a07195273dc4eeebcf23d3a924d881d53a'
    
      41            'fb60f7ba8081ee5c278f03c62329a374d1b24136b374a49393b453db1529a8c6')
    
      42
    
      43prepare() {
    
      44  sed -e '1 i\#include <cassert>' -i "${srcdir}"/${pkgname}/src/colmap/sfm/observation_manager.cc
    
      45}
    
      46
    
      47build() {
    
      48  # determine whether we can precompile CUDA kernels
    
      49    _CUDA_PKG=$(pacman -Qsq cuda 2>/dev/null) || true
    
      50    if [[ -n "$_CUDA_PKG" && "$_BUILD_CUDA" == "ON" ]]; then
    
      51  # determine whether we need to define cuda host compiler
    
      52      if _cuda_gcc=$(readlink /opt/cuda/bin/gcc) ; then
    
      53        [ -f "$_cuda_gcc" ] && export CUDAHOSTCXX="$_cuda_gcc"
    
      54      fi
    
      55      _CMAKE_FLAGS+=( -DCUDA_ENABLED=ON
    
      56                      -DCUDA_TOOLKIT_ROOT_DIR=/opt/cuda
    
      57                      -DCMAKE_CUDA_ARCHITECTURES="$_CUDA_ARCH"
    
      58                    )
    
      59    else
    
      60      _CMAKE_FLAGS+=( -DCUDA_ENABLED=OFF )
    
      61    fi
    
      62
    
      63  _CMAKE_FLAGS+=( -DTESTS_ENABLED=OFF
    
      64                  -DCMAKE_BUILD_TYPE=${BUILD_TYPE}
    
      65                  -DFETCH_ONNX=OFF
    
      66                  -DCMAKE_INSTALL_PREFIX=/usr )
    
      67  cmake "${_CMAKE_FLAGS[@]}" -G Ninja -S "$pkgname" -B build
    
      68# shellcheck disable=SC2046 # allow MAKEFLAGS to carry multiple flags.
    
      69  ninja -C "$srcdir/build" $(grep -oP -- '-+[A-z]+ ?[0-9]*'<<<"${MAKEFLAGS:--j1}")
    
      70}
    
      71
    
      72
    
      73package() {
    
      74  DESTDIR="${pkgdir}" ninja -C build install
    
      75
    
      76# build manpage
    
      77  make -C "${pkgname}/doc" man BUILDDIR="$PWD" && \
    
      78  install -Dm644 man/colmap.1 -t "${pkgdir}/usr/share/man/man1"
    
      79
    
      80  # install vocabulary trees for sequential,vocabulary matching
    
      81  install -d -m755 "${pkgdir}/usr/share/${_name}"
    
      82  for vocab_tree in "${srcdir}"/vocabulary-tree-*.bin ; do
    
      83    install -m644 "${vocab_tree}" "${pkgdir}/usr/share/${_name}/${vocab_tree##*/}"
    
      84  done
    
      85
    
      86  # install license
    
      87  install -Dm644 "${srcdir}/${pkgname}/COPYING.txt" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
    
      88}
    
      89# vim:set ts=2 sw=2 et:
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2