usd-fbx

MEDIUM

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt FBX SDK installer binary from autodesk.net (damassets.autodesk.net), which is Autodesk's official CDN/asset delivery domain. The URL pattern matches Autodesk's known FBX SDK distribution URLs. However, the binary is an executable installer that is run directly in prepare() with 'printf yes|n | ./fbx..._linux', meaning an untrusted binary is executed during the build. The sha512sum for the git source is SKIP'd (non-ideal but common for VCS sources), while the FBX tarball does have a checksum. The real concern is: (1) the FBX SDK installer is a prebuilt binary executed at build time, and (2) while damassets.autodesk.net is Autodesk's legitimate CDN, it is not a standard distribution channel like a distro mirror, and the URL could change or be redirected. The checksum on the tarball mitigates the supply-chain risk somewhat. This is a genuine medium: an executed prebuilt binary from a vendor CDN with a checksum but from an unofficial packaging perspective. It is not high because the host is Autodesk's own CDN and a checksum is present, but it is not clean because a prebuilt binary installer is executed during the build process.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "https://damassets.autodesk.net/content/dam/autodesk/www/adn/fbx/${_fbxver//./-}/fbx${_fbxver//./}_fbxsdk_linux.tar.gz"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt FBX SDK installer binary from autodesk.net (damassets.autodesk.net), which is Autodesk's official CDN/asset delivery domain. The URL pattern matches Autodesk's known FBX SDK distribution URLs. However, the binary is an executable installer that is run directly in prepare() with 'printf yes|n | ./fbx..._linux', meaning an untrusted binary is executed during the build. The sha512sum for the git source is SKIP'd (non-ideal but common for VCS sources), while the FBX tarball does have a checksum. The real concern is: (1) the FBX SDK installer is a prebuilt binary executed at build time, and (2) while damassets.autodesk.net is Autodesk's legitimate CDN, it is not a standard distribution channel like a distro mirror, and the URL could change or be redirected. The checksum on the tarball mitigates the supply-chain risk somewhat. This is a genuine medium: an executed prebuilt binary from a vendor CDN with a checksum but from an unofficial packaging perspective. It is not high because the host is Autodesk's own CDN and a checksum is present, but it is not clean because a prebuilt binary installer is executed during the build process.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Adrià Cabello <adro.cc79 at protonmail dot com>
    
      2
    
      3_fbxver=2020.3.4
    
      4
    
      5pkgname=usd-fbx
    
      6pkgver=0.1
    
      7pkgrel=2
    
      8pkgdesc='FBX plugin for USD'
    
      9arch=(x86_64)
    
      10url='https://github.com/Remedy-Entertainment/usdFBX'
    
      11license=('Apache')
    
      12depends=(usd
    
      13         python
    
      14         boost
    
      15         gcc)
    
      16makedepends=(cmake)
    
      17options=(!lto)
    
      18
    
      19source=("git+$url.git"
    
      20        "https://damassets.autodesk.net/content/dam/autodesk/www/adn/fbx/${_fbxver//./-}/fbx${_fbxver//./}_fbxsdk_linux.tar.gz"
    
      21       )
    
      22sha512sums=('SKIP'
    
      23            '3cacaf23f43887942366a6cdc1d60bcca813bc1e137b3f9b0870ca80f4e505f4dc1f093f8a625075ba610318e09cb5f74d9fd94c53a05310ac3938b3c9e03d35')
    
      24
    
      25prepare() {
    
      26    cd "${srcdir}"
    
      27
    
      28    #FBX SDK
    
      29    mkdir -p fbx-sdk
    
      30    printf "yes\nn\n" | "${srcdir}/fbx${_fbxver//./}_fbxsdk_linux" "${srcdir}/fbx-sdk"
    
      31}
    
      32
    
      33build() {
    
      34    _CMAKE_FLAGS+=(
    
      35        -DCMAKE_INSTALL_PREFIX=/usr/lib/usd/plugin
    
      36        -DUSD_CONFIG_FILE=/usr/lib/cmake/pxr/pxrConfig.cmake
    
      37        -DADSK_FBX_LOCATION="${srcdir}"/fbx-sdk
    
      38        -DUSDFBX_BUILD_TESTS=ON
    
      39    )
    
      40
    
      41    cmake -S usdFBX -B build -G Ninja "${_CMAKE_FLAGS[@]}"
    
      42
    
      43    ninja -C build ${MAKEFLAGS:--j12}
    
      44}
    
      45
    
      46package() {
    
      47    mkdir -p "${pkgdir}"/usr/lib/usd/plugin
    
      48    cp -r "${srcdir}"/build/plugins/usdFbx "${pkgdir}"/usr/lib/usd/plugin/usdFbx
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2