meshmixer-wine

maintainer utsi · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt Windows executable (Autodesk Meshmixer installer) from archive.org rather than from the official Autodesk distribution channel. The file is extracted via 7z and its contents are installed to /opt and later executed via Wine. While sha256sums are provided (mitigating tampering risk somewhat), archive.org is not an authoritative distribution host for Autodesk software — the original Autodesk download links for Meshmixer are no longer available since Autodesk discontinued the product, which explains why archive.org is used. The executable content is ultimately run by end users via Wine, so a compromised or substituted archive would result in code execution. This is a genuine supply-chain concern (unofficial host for an executed binary), though not clearly malicious. The medium rating is appropriate: checksums provide some protection, but the source is not verifiable against an official vendor channel.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 https://archive.org/download/autodesk-meshmixer-v3.5-win64/Autodesk_Meshmixer_v${_pkgver}_Win64.exe)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Windows executable (Autodesk Meshmixer installer) from archive.org rather than from the official Autodesk distribution channel. The file is extracted via 7z and its contents are installed to /opt and later executed via Wine. While sha256sums are provided (mitigating tampering risk somewhat), archive.org is not an authoritative distribution host for Autodesk software — the original Autodesk download links for Meshmixer are no longer available since Autodesk discontinued the product, which explains why archive.org is used. The executable content is ultimately run by end users via Wine, so a compromised or substituted archive would result in code execution. This is a genuine supply-chain concern (unofficial host for an executed binary), though not clearly malicious. The medium rating is appropriate: checksums provide some protection, but the source is not verifiable against an official vendor channel.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Danijel Zlaus <danijel.zlaus@gmail.com>
    
      2
    
      3pkgname='meshmixer-wine'
    
      4pkgver=3.5
    
      5_pkgver=$(echo $pkgver | sed 's/\./p/g')
    
      6pkgrel=4
    
      7pkgdesc="Meshmixer is state-of-the-art software for working with triangle meshes"
    
      8arch=('x86_64')
    
      9url="http://www.meshmixer.com"
    
      10license=('proprietary')
    
      11provides=($pkgname)
    
      12depends=(wine winetricks)
    
      13makedepends=(p7zip imagemagick icoutils)
    
      14source=(meshmixer
    
      15	meshmixer.desktop
    
      16        https://archive.org/download/autodesk-meshmixer-v3.5-win64/Autodesk_Meshmixer_v${_pkgver}_Win64.exe)
    
      17sha256sums=('07bb0d678fc153c60f51a30176ca557d4533f6163b29a320855eeaf8afc45e93'
    
      18            '6bd305f5b9d05d33c15bedbdd9192a9856ee32b49bc39d0d62e4ffa71a79fdce'  
    
      19            '5d08cb6254e4d4280137d6d37ec689fc3f0c61dad08bbc978a451ac16b7f271c')
    
      20noextract=('Autodesk_Meshmixer_v${_pkgver}_Win64.exe')
    
      21options=(!strip)
    
      22
    
      23prepare() {
    
      24	7z x -aoa -o$pkgname Autodesk_Meshmixer_v${_pkgver}_Win64.exe > /dev/null
    
      25	wrestool -x -t 14 Autodesk_Meshmixer_v3p5_Win64.exe > icons.ico
    
      26}
    
      27
    
      28package() {
    
      29    mkdir -p "${pkgdir}/opt/${pkgname}"
    
      30    mkdir -p "${pkgdir}/usr/bin"
    
      31    mkdir -p "${pkgdir}/usr/share/applications"
    
      32    mkdir -p "${pkgdir}/usr/share/icons/hicolor"
    
      33
    
      34    cp -R $pkgname ${pkgdir}/opt
    
      35
    
      36    find ${pkgdir}/opt/${pkgname} -type d -exec chmod 755 "{}" \;
    
      37    find ${pkgdir}/opt/${pkgname} -type f -exec chmod 644 "{}" \;
    
      38
    
      39    install -m755 meshmixer $pkgdir/usr/bin/meshmixer
    
      40    install -m644 meshmixer.desktop $pkgdir/usr/share/applications
    
      41    #Extract icons
    
      42    IFS=$'\n'
    
      43    local cnt=0
    
      44    for i in $(identify icons.ico); do 
    
      45     dim=$(echo $i | gawk 'match($0, /([0-9]+)x[0-9]+/ , a) {print a[1]}')
    
      46     ico_dir=${pkgdir}/usr/share/icons/hicolor/${dim}x${dim}/apps
    
      47     mkdir -p "${ico_dir}"
    
      48     magick icons.ico[$cnt] -thumbnail ${dix}x${dim} -flatten ${ico_dir}/meshmixer.png
    
      49     cnt=$((cnt+1))
    
      50    done
    
      51}
    
      52
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2