o3de-bin

maintainer xaque · 13 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb binary and its checksum from a non-official, non-whitelisted host (o3debinaries.org), which is not the project's canonical release infrastructure; although PGP and SHA256 verification are performed, the source host's legitimacy is unverified, creating a potential supply-chain risk if the domain were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "https://o3debinaries.org/main/Latest/Linux/${_debname}"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary and its checksum from a non-official, non-whitelisted host (o3debinaries.org), which is not the project's canonical release infrastructure; although PGP and SHA256 verification are performed, the source host's legitimacy is unverified, creating a potential supply-chain risk if the domain were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: xaque <xaque at duck dot com>
    
      2
    
      3_stablever=2605.0
    
      4_engver=26.05
    
      5_builddate="20260524"
    
      6_debname="o3de_2605_0.deb"
    
      7_binname="o3de"
    
      8
    
      9pkgname=o3de-bin
    
      10pkgver="${_stablever}_${_builddate}"
    
      11pkgrel=1
    
      12pkgdesc='Open 3D Engine - An open-source, real-time 3D development engine'
    
      13arch=('x86_64')
    
      14license=('APACHE' "MIT")
    
      15url='https://o3de.org/'
    
      16depends=('clang' 'cmake' 'curl' 'fontconfig' 'gcc-libs' 'glibc' 'glu' 'libglvnd' 'libxau' 'libx11' 'libxcb' 'libxkbcommon' 'libxkbcommon-x11' 'libunwind' 'mesa' 'openexr' 'openssl' 'qt5-base' 'sdl2' 'zlib')
    
      17optdepends=('ninja: Support for multiple build configurations per project')
    
      18makedepends=('icoutils')
    
      19options=('!strip')
    
      20provides=("${_binname}")
    
      21install="o3de.install"
    
      22source=("open-3d-engine.desktop"
    
      23        "https://o3debinaries.org/main/Latest/Linux/${_debname}"
    
      24        "https://o3debinaries.org/main/Latest/Linux/${_debname}.sha256"
    
      25        "https://o3debinaries.org/main/Latest/Linux/o3de-releases.gpg"
    
      26        "LICENSE.txt::https://raw.githubusercontent.com/o3de/o3de/main/LICENSE.txt"
    
      27        "LICENSE_MIT.txt::https://raw.githubusercontent.com/o3de/o3de/main/LICENSE_MIT.TXT"
    
      28        "LICENSE_APACHE2.txt::https://raw.githubusercontent.com/o3de/o3de/main/LICENSE_APACHE2.TXT")
    
      29sha256sums=('SKIP'
    
      30            'SKIP'
    
      31            'SKIP'
    
      32            '1e791446f88f371a25813738f055ea8811031a2e388adeda126a1d0d9ea2eb74'
    
      33            'SKIP'
    
      34            'SKIP'
    
      35            'SKIP')
    
      36
    
      37pkgver() {
    
      38    # Look at modified date of gpg signature to determine build date
    
      39    _builddate=$(date -r ${srcdir}/_gpgbuilder "+%Y%m%d")
    
      40    echo "${_stablever}_${_builddate}"
    
      41}
    
      42
    
      43prepare() {
    
      44    echo -n "    Verifying checksum for ${_debname} ..."
    
      45    _expected=$(cut -d ' ' -f1 ${_debname}.sha256)
    
      46    _actual=$(sha256sum ${_debname} | cut -d ' ' -f1)
    
      47    [[ ${_expected} == ${_actual} ]]
    
      48    echo " Passed"
    
      49
    
      50    echo -n "    Verifying PGP for ${_debname} ..."
    
      51    gpgv --keyring "./o3de-releases.gpg" "${_debname}" >/dev/null 2>&1
    
      52    echo " Passed"
    
      53}
    
      54
    
      55package() {
    
      56    echo -n "    Extracting data to /opt/O3DE ."
    
      57    tar -xzf data.tar.gz -C "${pkgdir}" --checkpoint=.50000
    
      58    echo " Done"
    
      59
    
      60    if [ ! -d "${pkgdir}/opt/O3DE/${_engver}" ]; then
    
      61        echo "Expected O3DE ${_engver}. PKGBUILD may need to be updated for modified paths with a new major engine version. Aborting." 1>&2
    
      62        exit 1
    
      63    fi
    
      64
    
      65    # Symlink into /usr/bin
    
      66    mkdir -p "${pkgdir}/usr/bin"
    
      67    ln -s "/opt/O3DE/${_engver}/bin/Linux/profile/Default/o3de" "${pkgdir}/usr/bin/${_binname}"
    
      68
    
      69    # Extract .ico and install icons
    
      70    icotool -x "${pkgdir}"/opt/O3DE/${_engver}/cmake/Platform/Windows/Packaging/product_icon.ico -o .
    
      71    install -Dm644 "product_icon_1_256x256x64.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_binname}.png"
    
      72    iter=2
    
      73    for size in 128 64 48 32 16; do
    
      74        install -Dm644 "product_icon_${iter}_${size}x${size}x32.png" \
    
      75            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/${_binname}.png"
    
      76        ((iter++))
    
      77    done
    
      78
    
      79    # Install desktop file
    
      80    install -Dm644 open-3d-engine.desktop "${pkgdir}"/usr/share/applications/open-3d-engine.desktop
    
      81
    
      82    # Install license files
    
      83    install -Dm644 LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      84    install -Dm644 LICENSE_MIT.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE_MIT.txt"
    
      85    install -Dm644 LICENSE_APACHE2.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE_APACHE2.txt"
    
      86
    
      87    # Fix warning for mismatched /opt permissions
    
      88    chmod --reference /opt "${pkgdir}"/opt
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2