usd-fbx

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt FBX SDK installer binary from autodesk.net (damassets.autodesk.net), which is Autodesk's official CDN/asset delivery domain. The URL pattern matches Autodesk's known FBX SDK distribution URLs. However, the binary is an executable installer that is run directly in prepare() with 'printf yes|n | ./fbx..._linux', meaning an untrusted binary is executed during the build. The sha512sum for the git source is SKIP'd (non-ideal but common for VCS sources), while the FBX tarball does have a checksum. The real concern is: (1) the FBX SDK installer is a prebuilt binary executed at build time, and (2) while damassets.autodesk.net is Autodesk's legitimate CDN, it is not a standard distribution channel like a distro mirror, and the URL could change or be redirected. The checksum on the tarball mitigates the supply-chain risk somewhat. This is a genuine medium: an executed prebuilt binary from a vendor CDN with a checksum but from an unofficial packaging perspective. It is not high because the host is Autodesk's own CDN and a checksum is present, but it is not clean because a prebuilt binary installer is executed during the build process.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "https://damassets.autodesk.net/content/dam/autodesk/www/adn/fbx/${_fbxver//./-}/fbx${_fbxver//./}_fbxsdk_linux.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt FBX SDK installer binary from autodesk.net (damassets.autodesk.net), which is Autodesk's official CDN/asset delivery domain. The URL pattern matches Autodesk's known FBX SDK distribution URLs. However, the binary is an executable installer that is run directly in prepare() with 'printf yes|n | ./fbx..._linux', meaning an untrusted binary is executed during the build. The sha512sum for the git source is SKIP'd (non-ideal but common for VCS sources), while the FBX tarball does have a checksum. The real concern is: (1) the FBX SDK installer is a prebuilt binary executed at build time, and (2) while damassets.autodesk.net is Autodesk's legitimate CDN, it is not a standard distribution channel like a distro mirror, and the URL could change or be redirected. The checksum on the tarball mitigates the supply-chain risk somewhat. This is a genuine medium: an executed prebuilt binary from a vendor CDN with a checksum but from an unofficial packaging perspective. It is not high because the host is Autodesk's own CDN and a checksum is present, but it is not clean because a prebuilt binary installer is executed during the build process.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Adrià Cabello <adro.cc79 at protonmail dot com>
    
      2
    
      3_fbxver=2020.3.4
    
      4
    
      5pkgname=usd-fbx
    
      6pkgver=0.1
    
      7pkgrel=2
    
      8pkgdesc='FBX plugin for USD'
    
      9arch=(x86_64)
    
      10url='https://github.com/Remedy-Entertainment/usdFBX'
    
      11license=('Apache')
    
      12depends=(usd
    
      13         python
    
      14         boost
    
      15         gcc)
    
      16makedepends=(cmake)
    
      17options=(!lto)
    
      18
    
      19source=("git+$url.git"
    
      20        "https://damassets.autodesk.net/content/dam/autodesk/www/adn/fbx/${_fbxver//./-}/fbx${_fbxver//./}_fbxsdk_linux.tar.gz"
    
      21       )
    
      22sha512sums=('SKIP'
    
      23            '3cacaf23f43887942366a6cdc1d60bcca813bc1e137b3f9b0870ca80f4e505f4dc1f093f8a625075ba610318e09cb5f74d9fd94c53a05310ac3938b3c9e03d35')
    
      24
    
      25prepare() {
    
      26    cd "${srcdir}"
    
      27
    
      28    #FBX SDK
    
      29    mkdir -p fbx-sdk
    
      30    printf "yes\nn\n" | "${srcdir}/fbx${_fbxver//./}_fbxsdk_linux" "${srcdir}/fbx-sdk"
    
      31}
    
      32
    
      33build() {
    
      34    _CMAKE_FLAGS+=(
    
      35        -DCMAKE_INSTALL_PREFIX=/usr/lib/usd/plugin
    
      36        -DUSD_CONFIG_FILE=/usr/lib/cmake/pxr/pxrConfig.cmake
    
      37        -DADSK_FBX_LOCATION="${srcdir}"/fbx-sdk
    
      38        -DUSDFBX_BUILD_TESTS=ON
    
      39    )
    
      40
    
      41    cmake -S usdFBX -B build -G Ninja "${_CMAKE_FLAGS[@]}"
    
      42
    
      43    ninja -C build ${MAKEFLAGS:--j12}
    
      44}
    
      45
    
      46package() {
    
      47    mkdir -p "${pkgdir}"/usr/lib/usd/plugin
    
      48    cp -r "${srcdir}"/build/plugins/usdFbx "${pkgdir}"/usr/lib/usd/plugin/usdFbx
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2