o3de-nightly-bin

maintainer xaque · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

broken

Why flagged The domain o3debinaries.org is the official binary distribution host for the Open 3D Engine (Linux Foundation) project, not an unofficial or personal host, making the cheaper model's supply-chain concern a false positive. The PKGBUILD implements both SHA256 and PGP signature verification with a pinned GPG keyring hash (6b38139f...), providing a reasonable trust chain. However, the package() function attempts to extract data.tar.gz directly without first unpacking the .deb archive via 'ar x' or 'dpkg-deb --raw-extract', meaning the build will fail at that step — hence the 'broken' flag. The security posture is low-risk: official source, PGP-verified binary, pinned key hash.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 72%): The domain o3debinaries.org is the official binary distribution host for the Open 3D Engine (Linux Foundation) project, not an unofficial or personal host, making the cheaper model's supply-chain concern a false positive. The PKGBUILD implements both SHA256 and PGP signature verification with a pinned GPG keyring hash (6b38139f...), providing a reasonable trust chain. However, the package() function attempts to extract data.tar.gz directly without first unpacking the .deb archive via 'ar x' or 'dpkg-deb --raw-extract', meaning the build will fail at that step — hence the 'broken' flag. The security posture is low-risk: official source, PGP-verified binary, pinned key hash.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "https://o3debinaries.org/development/Latest/Linux/${_debname}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: xaque <xaque at duck dot com>
    
      2
    
      3_stablever=2505.1
    
      4_engver=4.2.0
    
      5_builddate="20250806"
    
      6_debname="o3de_latest.deb"
    
      7_binname="o3de-nightly"
    
      8
    
      9pkgname=o3de-nightly-bin
    
      10pkgver="${_stablever}_${_builddate}"
    
      11pkgrel=1
    
      12pkgdesc='Open 3D Engine - An open-source, real-time 3D development engine (Nightly build)'
    
      13arch=('x86_64')
    
      14license=('APACHE' "MIT")
    
      15url='https://o3de.org/'
    
      16depends=('clang' 'cmake' 'curl' 'fontconfig' 'gcc-libs' 'glibc' 'glu' 'libglvnd' 'libxau' 'libx11' 'libxcb' 'libxkbcommon' 'libxkbcommon-x11' 'mesa' 'openexr' 'openssl' 'qt5-base' 'sdl2' 'zlib')
    
      17optdepends=('ninja: Support for multiple build configurations per project')
    
      18makedepends=('icoutils')
    
      19options=('!strip')
    
      20provides=("${_binname}")
    
      21install="o3de.install"
    
      22source=("open-3d-engine-nightly.desktop"
    
      23        "https://o3debinaries.org/development/Latest/Linux/${_debname}"
    
      24        "https://o3debinaries.org/development/Latest/Linux/${_debname}.sha256"
    
      25        "https://o3debinaries.org/main/Latest/Linux/o3de-releases.gpg"
    
      26        "LICENSE.txt::https://raw.githubusercontent.com/o3de/o3de/development/LICENSE.txt"
    
      27        "LICENSE_MIT.txt::https://raw.githubusercontent.com/o3de/o3de/development/LICENSE_MIT.TXT"
    
      28        "LICENSE_APACHE2.txt::https://raw.githubusercontent.com/o3de/o3de/development/LICENSE_APACHE2.TXT")
    
      29sha256sums=('SKIP'
    
      30            'SKIP'
    
      31            'SKIP'
    
      32            '6b38139f1b8c05495312003b050ab6c2e5bcf7e019a8922bf3440a7d7fa561e5'
    
      33            'SKIP'
    
      34            'SKIP'
    
      35            'SKIP')
    
      36
    
      37pkgver() {
    
      38    # Look at modified date of gpg signature to determine build date
    
      39    _builddate=$(date -r ${srcdir}/_gpgbuilder "+%Y%m%d")
    
      40    echo "${_stablever}_${_builddate}"
    
      41}
    
      42
    
      43prepare() {
    
      44    echo -n "    Verifying checksum for ${_debname} ..."
    
      45    _expected=$(cut -d ' ' -f1 ${_debname}.sha256)
    
      46    _actual=$(sha256sum ${_debname} | cut -d ' ' -f1)
    
      47    [[ ${_expected} == ${_actual} ]]
    
      48    echo " Passed"
    
      49
    
      50    echo -n "    Verifying PGP for ${_debname} ..."
    
      51    gpgv --keyring "./o3de-releases.gpg" "${_debname}" >/dev/null 2>&1
    
      52    echo " Passed"
    
      53}
    
      54
    
      55package() {
    
      56    echo -n "    Extracting data to /opt/O3DE ."
    
      57    tar -xzf data.tar.gz -C "${pkgdir}" --checkpoint=.50000
    
      58    echo " Done"
    
      59
    
      60    if [ ! -d "${pkgdir}/opt/O3DE/${_engver}" ]; then
    
      61        echo "Expected O3DE ${_engver}. PKGBUILD may need to be updated for modified paths with a new major engine version. Aborting." 1>&2
    
      62        exit 1
    
      63    fi
    
      64
    
      65    # Symlink into /usr/bin
    
      66    mkdir -p "${pkgdir}/usr/bin"
    
      67    ln -s "/opt/O3DE/${_engver}/bin/Linux/profile/Default/o3de" "${pkgdir}/usr/bin/${_binname}"
    
      68
    
      69    # Extract .ico and install icons
    
      70    icotool -x "${pkgdir}"/opt/O3DE/${_engver}/cmake/Platform/Windows/Packaging/product_icon.ico -o .
    
      71    install -Dm644 "product_icon_1_256x256x64.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_binname}.png"
    
      72    iter=2
    
      73    for size in 128 64 48 32 16; do
    
      74        install -Dm644 "product_icon_${iter}_${size}x${size}x32.png" \
    
      75            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/${_binname}.png"
    
      76        ((iter++))
    
      77    done
    
      78
    
      79    # Install desktop file
    
      80    install -Dm644 open-3d-engine-nightly.desktop "${pkgdir}"/usr/share/applications/open-3d-engine-nightly.desktop
    
      81
    
      82    # Install license files
    
      83    install -Dm644 LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      84    install -Dm644 LICENSE_MIT.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE_MIT.txt"
    
      85    install -Dm644 LICENSE_APACHE2.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE_APACHE2.txt"
    
      86
    
      87    # Fix warning for mismatched /opt permissions
    
      88    chmod --reference /opt "${pkgdir}"/opt
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2