colmap-git

maintainer bartus · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host (demuc.de) hosts static vocabulary tree data files used by the application, not executable code; these are standard project assets, and the worst case of a swapped source is limited to data tampering, not remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host (demuc.de) hosts static vocabulary tree data files used by the application, not executable code; these are standard project assets, and the worst case of a swapped source is limited to data tampering, not remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 "vocabulary-tree-32K.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words32K.bin"

PKGBUILD

1 offending line(s) highlighted

      1#!/bin/hint/bash
    
      2# Maintainer : bartus <arch-user-repoᘓbartus.33mail.com>
    
      3
    
      4check_option "debug" "y" && BUILD_TYPE=Debug || BUID_TYPE=Release
    
      5
    
      6## Configuration env vars:
    
      7_BUILD_CUDA="${BUILD_CUDA:-ON}"
    
      8_CUDA_ARCHITECTURES="${CUDA_ARCH:-native}"
    
      9_fragment=${FRAGMENT:-#branch=main}
    
      10# Use CMAKE_FLAGS=xxx:yyy:zzz to define extra CMake flags
    
      11[[ -v CMAKE_FLAGS ]] && mapfile -t -d: _CMAKE_FLAGS < <(echo -n "$CMAKE_FLAGS")
    
      12
    
      13_name=colmap
    
      14#fragment="#commit=5bea89263bf5f3ed623b8e6e6a5f022a0ed9c1de"
    
      15pkgname=${_name}-git
    
      16pkgver=4.1.0.dev0.r64.gac6f952cb
    
      17pkgrel=1
    
      18pkgdesc="General-purpose Structure-from-Motion (SfM) and Multi-View Stereo (MVS) pipeline with a graphical and command-line interface."
    
      19arch=('i686' 'x86_64')
    
      20url="https://colmap.github.io/"
    
      21license=('GPL')
    
      22groups=()
    
      23provides=("$_name")
    
      24conflicts=("$_name")
    
      25depends=('cgal' 'ceres-solver' 'gflags' 'metis' 'openimageio' 'suitesparse' 'freeglut' 'glew' 'google-glog' 'freeimage' 'libjpeg' 'boost-libs' qt5-{base,svg} 'flann')
    
      26makedepends=('boost' 'cmake' 'eigen' 'git' 'ninja' 'python-sphinx' )
    
      27if [ "$_BUILD_CUDA" == "ON" ] ; then 
    
      28  depends+=('onnxruntime-cuda' 'protobuf')
    
      29  makedepends+=('cuda')
    
      30  optdepends+=('libcudart.so: required for dense reconstruction')
    
      31else
    
      32  depends+=('onnxruntime-cpu' 'protobuf')
    
      33fi
    
      34source=("${pkgname}::git+https://github.com/colmap/colmap.git${_fragment}"
    
      35        "vocabulary-tree-32K.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words32K.bin"
    
      36        "vocabulary-tree-256K.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words256K.bin"
    
      37        "vocabulary-tree-1M.bin::https://demuc.de/colmap/vocab_tree_flickr100K_words1M.bin"
    
      38        )
    
      39sha256sums=('SKIP'
    
      40            'd37d8f19ee0a49705c4c0b06967a08cedfed5cf86519eada3271497256732bc2'
    
      41            'd2055600452a531b5b0a62aa5943e1a07195273dc4eeebcf23d3a924d881d53a'
    
      42            'fb60f7ba8081ee5c278f03c62329a374d1b24136b374a49393b453db1529a8c6')
    
      43
    
      44pkgver() {
    
      45# git -C "$pkgname" describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      46  _blame=$(git -C "$pkgname" blame CMakeLists.txt|grep COLMAP_VERSION)
    
      47  _ver=$(grep -oP 'COLMAP_VERSION "\K.*(?=")' <<<"$_blame")
    
      48  _commit=$(grep -oE "^\w+" <<<"$_blame")
    
      49  _count=$(git -C "$pkgname" rev-list  $_commit.. --count)
    
      50  _head=$(git -C "$pkgname" rev-parse --short HEAD)
    
      51  printf  "%s.r%d.g%s" "$_ver" "$_count" "$_head"
    
      52}
    
      53
    
      54prepare() {
    
      55  sed -e '1 i\#include <cassert>' -i "${srcdir}"/${pkgname}/src/colmap/sfm/observation_manager.cc
    
      56}
    
      57
    
      58build() {
    
      59  # determine whether we can precompile CUDA kernels
    
      60    _CUDA_PKG=$(pacman -Qsq cuda 2>/dev/null) || true
    
      61    if [[ -n "$_CUDA_PKG" && "$_BUILD_CUDA" == "ON" ]]; then
    
      62  # determine whether we need to define cuda host compiler
    
      63      if _cuda_gcc=$(readlink /opt/cuda/bin/gcc) ; then
    
      64        [ -f "$_cuda_gcc" ] && export CUDAHOSTCXX="$_cuda_gcc"
    
      65      fi
    
      66      _CMAKE_FLAGS+=( -DCUDA_ENABLED=ON
    
      67                      -DCMAKE_CUDA_ARCHITECTURES=$_CUDA_ARCHITECTURES
    
      68                    )
    
      69    else
    
      70      _CMAKE_FLAGS+=( -DCUDA_ENABLED=OFF )
    
      71    fi
    
      72
    
      73  _CMAKE_FLAGS+=( -DTESTS_ENABLED=OFF
    
      74                  -DCMAKE_BUILD_TYPE=${BUILD_TYPE}
    
      75                  -DFETCH_ONNX=OFF
    
      76                  -DCMAKE_INSTALL_PREFIX=/usr )
    
      77  cmake "${_CMAKE_FLAGS[@]}" -G Ninja -S "$pkgname" -B build
    
      78# shellcheck disable=SC2046 # allow MAKEFLAGS to carry multiple flags.
    
      79  ninja -C "$srcdir/build" $(grep -oP -- '-+[A-z]+ ?[0-9]*'<<<"${MAKEFLAGS:--j1}")
    
      80}
    
      81
    
      82
    
      83package() {
    
      84  DESTDIR="${pkgdir}" ninja -C build install
    
      85
    
      86# build manpage
    
      87  make -C "${pkgname}/doc" man BUILDDIR="$PWD" && \
    
      88  install -Dm644 man/colmap.1 -t "${pkgdir}/usr/share/man/man1"
    
      89
    
      90  # install vocabulary trees for sequential,vocabulary matching
    
      91  install -d -m755 "${pkgdir}/usr/share/${_name}"
    
      92  for vocab_tree in "${srcdir}"/vocabulary-tree-*.bin ; do
    
      93    install -m644 "${vocab_tree}" "${pkgdir}/usr/share/${_name}/${vocab_tree##*/}"
    
      94  done
    
      95
    
      96  # install license
    
      97  install -Dm644 "${srcdir}/${pkgname}/COPYING.txt" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
    
      98}
    
      99# vim:set ts=2 sw=2 et:
    
      100

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2