luxcorerender
maintainer bartus
· 15 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The PKGBUILD runs `pipx install conan` during the build phase, which fetches and executes the 'conan' C++ package manager from PyPI at build time. This is a real supply-chain concern: the conan package version is not pinned, no hash is verified, and PyPI is an external index that could serve a compromised or typosquatted package. Conan itself then drives `make deps` which fetches additional third-party C++ dependencies from the internet with no integrity verification visible in the PKGBUILD. This is a genuine medium-severity supply-chain risk — executed code pulled from an external package manager without version pinning or hash verification — not a false positive. However, conan is a well-known, legitimate C++ package manager on PyPI, so this is sloppy/non-standard packaging rather than an active attack, keeping it at medium rather than high.
Triggered rules
MEDIUM
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:72
pipx install conan
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD runs `pipx install conan` during the build phase, which fetches and executes the 'conan' C++ package manager from PyPI at build time. This is a real supply-chain concern: the conan package version is not pinned, no hash is verified, and PyPI is an external index that could serve a compromised or typosquatted package. Conan itself then drives `make deps` which fetches additional third-party C++ dependencies from the internet with no integrity verification visible in the PKGBUILD. This is a genuine medium-severity supply-chain risk — executed code pulled from an external package manager without version pinning or hash verification — not a false positive. However, conan is a well-known, legitimate C++ package manager on PyPI, so this is sloppy/non-standard packaging rather than an active attack, keeping it at medium rather than high.
PKGBUILD
1 offending line(s) highlighted
1
#!/hint/bash
2
# Maintainer : bartus <arch-user-repoᘓbartus.33mail.com>
3
4
# Configuration
5
# shellcheck disable=SC2015
6
((DISABLE_OPENCL)) && {
7
CMAKE_FLAGS+=("-DLUXRAYS_DISABLE_OPENCL=ON")
8
} || {
9
depends+=(opencl-icd-loader)
10
makedepends+=(opencl-headers)
11
optdepends+=("opencl-driver: for gpu acceleration")
12
}
13
# shellcheck disable=SC2015
14
((DISABLE_CUDA||DISABLE_OPENCL)) && {
15
CMAKE_FLAGS+=("-DLUXRAYS_DISABLE_CUDA=ON")
16
} || {
17
makedepends+=(cuda-sdk)
18
}
19
20
pkgname=luxcorerender
21
pkgver=2.10.1
22
_rel=""
23
[ -n "${_rel}" ] && _pkgver=${pkgver}${_rel} && pkgver+=".${_rel}" || _pkgver=${pkgver}
24
_commit=e030b7ba13ba497c4407276c718d84347ab12569
25
_name=LuxCore-${_commit}
26
pkgrel=1
27
epoch=2
28
pkgdesc="Physically correct, unbiased rendering engine."
29
arch=('x86_64')
30
url="https://www.luxcorerender.org/"
31
license=('Apache-2.0')
32
depends+=(
33
"libglvnd"
34
"libxcb"
35
"libfontenc"
36
"libice"
37
"libsm"
38
"libxaw"
39
"libxdamage"
40
"libxcomposite"
41
"libxcursor"
42
"libxtst"
43
"libxinerama"
44
"libxkbfile"
45
"libxrandr"
46
"libxres"
47
"libxss"
48
"libxv"
49
"xcb-util-wm"
50
"xcb-util-image"
51
"xcb-util-keysyms"
52
"xcb-util-renderutil"
53
"xcb-util-cursor"
54
"gcc-libs"
55
"glibc"
56
)
57
makedepends+=(cmake python-pipx ninja)
58
source=(
59
"https://github.com/LuxCoreRender/LuxCore/archive/${_commit}.tar.gz"
60
luxcoreconsole_wrap.sh
61
luxcoreui_wrap.sh
62
)
63
sha256sums=('8789cefb2555067e9c1cc4177718439b4575e1b3a85e33c197731e51cd597b65'
64
'b9ecff89a10e1948e20170c5e2ee7fed1c2597c2e1e5a40c55874384d17384e9'
65
'2d597631c7e6637ed056d2e6d2a0bc8447d00fb49410a8ed6047eff433570815')
66
b2sums=('3873ca2dd9cadef24e04d8288341e4efabb45135fa798bd37872484a2783280f08e5433d5f09d35656f150a5be69d67555924281d5b268a72bf7ae733f07bac3'
67
'12e2c5bd9472389cda1d484e0c84a65c83447599dfc8f426f5d64db025ea17b18f352a93115141f73d465c0953052a4d4afa16aff82667716150f1047ead394f'
68
'612ded329cd2978d99e071bd48c68aea0d98db9c61f2005465a2bf7a1690c7ff514c23439223706181810c40b820299ddd64fc3042bb1aca7848dd315e9acf13')
69
70
71
build() {
72
pipx install conan
73
pipx ensurepath
74
source ~/.bashrc
75
76
export LUX_BUILD_TYPE=Release
77
export LUXCORE_VERSION=${pkgver}
78
cd ${srcdir}/${_name}
79
make deps
80
make luxcore
81
export LD_LIBRARY_PATH=${srcdir}/${_name}/out/install/Release/lib:$LD_LIBRARY_PATH
82
make luxcoreui
83
make luxcoreconsole
84
}
85
86
package() {
87
cd "${srcdir}"/"${_name}"/out/install/Release
88
89
# Main app
90
install -d -m755 "${pkgdir}"/usr/lib/luxcorerender/{bin,lib}
91
install -m755 bin/* "${pkgdir}"/usr/lib/luxcorerender/bin
92
install -m644 lib/* "${pkgdir}"/usr/lib/luxcorerender/lib
93
94
# Wrapper scripts
95
install -D -m755 "${srcdir}"/luxcoreconsole_wrap.sh -T "${pkgdir}/usr/bin/luxcoreconsole"
96
install -D -m755 "${srcdir}"/luxcoreui_wrap.sh -T "${pkgdir}/usr/bin/luxcoreui"
97
}
98
# vim:set ts=2 sw=2 et:
99
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |