zed-sdk-bin

maintainer Bink · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from a non-whitelisted but plausibly official vendor host (digitaloceanspaces.com) used by the upstream project, and performs privileged filesystem operations typical for SDKs, but does not execute untrusted remote code or perform self-updates.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from a non-whitelisted but plausibly official vendor host (digitaloceanspaces.com) used by the upstream project, and performs privileged filesystem operations typical for SDKs, but does not execute untrusted remote code or perform self-updates.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 "${pkgname}-${pkgver}.run::https://stereolabs.sfo2.cdn.digitaloceanspaces.com/zedsdk/${pkgver%.*}/ZED_SDK_Ubuntu26_cuda13.2_tensorrt10.13_v${pkgver}.zstd.run"

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:96 chmod 2775 "${pkgdir}/opt/zed/resources"

PKGBUILD

2 offending line(s) highlighted

      1pkgname=zed-sdk-bin
    
      2pkgver=5.4.0
    
      3pkgrel=1
    
      4pkgdesc="Stereolabs advanced scalable and customizable AI Vision framework"
    
      5arch=('x86_64')
    
      6url="https://www.stereolabs.com/developers/release"
    
      7license=('LicenseRef-ZED-SDK')
    
      8install="${pkgname}.install"
    
      9provides=("zed-sdk=${pkgver}")
    
      10conflicts=('zed-sdk')
    
      11options=(!strip !debug)
    
      12depends=(
    
      13    'cuda>=13.2'
    
      14    'cudnn'
    
      15    'gcc-libs'
    
      16    'glibc'
    
      17    'libglvnd'
    
      18    'libusb'
    
      19    'libx11'
    
      20    'patchelf'
    
      21    'qt5-svg' # Needed by ZED_Explorer
    
      22    'qt6-base'
    
      23    'zlib'
    
      24)
    
      25makedepends=(
    
      26    'zstd'
    
      27)
    
      28optdepends=(
    
      29    'python: Python API support'
    
      30    'python-pip: Python API installation'
    
      31    'python-requests: required for Python API installation script'
    
      32    'opencv: OpenCV integration for samples'
    
      33)
    
      34# NOTE: Using Ubuntu 26 build; no Arch-specific build is provided by upstream.
    
      35
    
      36# AUR TRUST: As StereoLabs has the official binary package hosted on a different domain, digitaloceanspaces.com
    
      37# and not stereolabs.com, as good AUR practice, I encourage you to instead manually download it from:
    
      38# https://www.stereolabs.com/en-fr/developers
    
      39#
    
      40# Then, at the very least confirm the b2sum matches what's in this PKGBUILD and/or place it in the PKGBUILD directory and build.
    
      41
    
      42source=(
    
      43    "${pkgname}-${pkgver}.run::https://stereolabs.sfo2.cdn.digitaloceanspaces.com/zedsdk/${pkgver%.*}/ZED_SDK_Ubuntu26_cuda13.2_tensorrt10.13_v${pkgver}.zstd.run"
    
      44)
    
      45noextract=("${pkgname}-${pkgver}.run")
    
      46b2sums=('5221f8d3afad8f3dd1a1e8a33c2128aaaf15bec817f7fc9ef6f73b75352fd33847c1616c9256817131e80c84f9d42e652f020d7a3ea44a1b4fcb0dc3ba941d73')
    
      47
    
      48prepare() {
    
      49    chmod +x "${srcdir}/${pkgname}-${pkgver}.run"
    
      50    "${srcdir}/${pkgname}-${pkgver}.run" --noexec --target "${srcdir}/extracted"
    
      51
    
      52    # Fix CMake config paths (upstream defaults to /usr/local/zed)
    
      53    sed -i 's|/usr/local/zed|/opt/zed|g' "${srcdir}/extracted/zed-config.cmake"
    
      54}
    
      55
    
      56package() {
    
      57    local extracted="${srcdir}/extracted"
    
      58
    
      59    # Install SDK subdirectories to /opt/zed (selective, excluding Ubuntu-specific installer artifacts)
    
      60    mkdir -p "${pkgdir}/opt/zed"
    
      61    for dir in lib include tools firmware samples resources dependencies; do
    
      62        if [ -d "${extracted}/${dir}" ]; then
    
      63            cp -a "${extracted}/${dir}" "${pkgdir}/opt/zed/"
    
      64        fi
    
      65    done
    
      66
    
      67    # Create symlinks for libnvinfer_builder_resource
    
      68    ln -sf libnvinfer_builder_resource.so.10.13.2 \
    
      69        "${pkgdir}/opt/zed/dependencies/ai_dependencies/lib/libnvinfer_builder_resource.so.10"
    
      70    ln -sf libnvinfer_builder_resource.so.10.13.2 \
    
      71        "${pkgdir}/opt/zed/dependencies/ai_dependencies/lib/libnvinfer_builder_resource.so"
    
      72
    
      73    # Install root-level SDK files
    
      74    install -Dm644 "${extracted}/zed-config.cmake" \
    
      75        "${pkgdir}/opt/zed/zed-config.cmake"
    
      76    install -Dm644 "${extracted}/zed-config-version.cmake" \
    
      77        "${pkgdir}/opt/zed/zed-config-version.cmake"
    
      78    install -Dm755 "${extracted}/get_python_api.py" \
    
      79        "${pkgdir}/opt/zed/get_python_api.py"
    
      80
    
      81    # Install CMake config to standard path
    
      82    install -Dm644 "${extracted}/zed-config.cmake" \
    
      83        "${pkgdir}/usr/lib/cmake/zed/zed-config.cmake"
    
      84    install -Dm644 "${extracted}/zed-config-version.cmake" \
    
      85        "${pkgdir}/usr/lib/cmake/zed/zed-config-version.cmake"
    
      86
    
      87    # Set proper permissions
    
      88    chmod -R a+rX "${pkgdir}/opt/zed"
    
      89    find "${pkgdir}/opt/zed/tools" -type f -exec chmod 755 {} \;
    
      90    find "${pkgdir}/opt/zed" -name "*.sh" -exec chmod 755 {} \;
    
      91
    
      92    # Allow members of the 'video' group to write models/configs that the ZED
    
      93    # tools download at runtime. The setgid bit (2775) ensures files created in
    
      94    # these directories inherit the 'video' group.
    
      95    chown root:video "${pkgdir}/opt/zed/resources"
    
      96    chmod 2775 "${pkgdir}/opt/zed/resources"
    
      97    chgrp -R video "${pkgdir}/opt/zed/resources"
    
      98    chmod -R g+w "${pkgdir}/opt/zed/resources"
    
      99
    
      100    install -dm2775 "${pkgdir}/opt/zed/settings"
    
      101    chown root:video "${pkgdir}/opt/zed/settings"
    
      102
    
      103    # Fix RUNPATH for all binaries to point to correct library paths
    
      104    for bin in "${pkgdir}/opt/zed/tools/"*; do
    
      105        if [ -f "$bin" ]; then
    
      106            patchelf --set-rpath '/opt/zed/lib:/opt/zed/dependencies/ai_dependencies/lib:/opt/cuda/lib64' "$bin" 2>/dev/null || true
    
      107        fi
    
      108    done
    
      109
    
      110    # AI deps need own RUNPATH: libnvinfer dlopen()s by filename with no RUNPATH,
    
      111    # and ldconfig can't resolve it due to deliberately poisoned SONAMEs
    
      112    for lib in "${pkgdir}/opt/zed/dependencies/ai_dependencies/lib/"*.so*; do
    
      113        if [ -f "$lib" ] && [ ! -L "$lib" ]; then
    
      114            patchelf --set-rpath '/opt/zed/dependencies/ai_dependencies/lib:/opt/cuda/lib64' "$lib" 2>/dev/null || true
    
      115        fi
    
      116    done
    
      117
    
      118    # Patch RUNPATH on SDK libraries (libsl_ai.so, libsl_zed.so)
    
      119    for lib in "${pkgdir}/opt/zed/lib/"*.so*; do
    
      120        if [ -f "$lib" ] && [ ! -L "$lib" ]; then
    
      121            patchelf --set-rpath '/opt/zed/lib:/opt/zed/dependencies/ai_dependencies/lib:/opt/cuda/lib64' "$lib" 2>/dev/null || true
    
      122        fi
    
      123    done
    
      124
    
      125    # Create LD library path configuration (covers both SDK libs and bundled AI libs)
    
      126    mkdir -p "${pkgdir}/etc/ld.so.conf.d"
    
      127    printf '/opt/zed/lib\n/opt/zed/dependencies/ai_dependencies/lib\n' \
    
      128        > "${pkgdir}/etc/ld.so.conf.d/zed-sdk.conf"
    
      129
    
      130    # Create wrapper scripts in /usr/bin for all tools
    
      131    mkdir -p "${pkgdir}/usr/bin"
    
      132    for tool in "${pkgdir}/opt/zed/tools/"*; do
    
      133        if [ -x "$tool" ]; then
    
      134            local toolname
    
      135            toolname=$(basename "$tool")
    
      136            cat > "${pkgdir}/usr/bin/${toolname}" << EOF
    
      137#!/bin/bash
    
      138exec /opt/zed/tools/${toolname} "\$@"
    
      139EOF
    
      140            chmod 755 "${pkgdir}/usr/bin/${toolname}"
    
      141        fi
    
      142    done
    
      143
    
      144    # Install udev rules
    
      145    install -Dm644 "${extracted}/99-slabs.rules" \
    
      146        "${pkgdir}/usr/lib/udev/rules.d/99-slabs.rules"
    
      147
    
      148    # Fix upstream bug: hidraw rules hardcode busnum==1, should match any bus
    
      149    sed -i 's/ATTRS{busnum}=="1", //g' "${pkgdir}/usr/lib/udev/rules.d/99-slabs.rules"
    
      150
    
      151    # Install modprobe.d config for USBFS memory buffer (works when usbcore is a module)
    
      152    install -dm755 "${pkgdir}/usr/lib/modprobe.d"
    
      153    cat > "${pkgdir}/usr/lib/modprobe.d/zed-usbfs.conf" << 'EOF'
    
      154# Increase USBFS memory buffer for ZED stereo cameras
    
      155# Default 16MB is too low for high-bandwidth USB 3.0 cameras
    
      156# 256MB is sufficient for one ZED camera. For multi-camera setups,
    
      157# increase proportionally (e.g., 512 for 2 cameras) or set to 0 for unlimited.
    
      158options usbcore usbfs_memory_mb=256
    
      159EOF
    
      160
    
      161    # Install tmpfiles.d rule to set USBFS memory buffer at boot via sysfs
    
      162    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/tmpfiles.d/zed-usbfs.conf" << 'EOF'
    
      163# Set USBFS memory buffer for ZED stereo cameras (applied at boot)
    
      164w /sys/module/usbcore/parameters/usbfs_memory_mb - - - - 256
    
      165EOF
    
      166
    
      167    # Install sysctl configuration
    
      168    install -Dm644 "${extracted}/60-zed-buffers.conf" \
    
      169        "${pkgdir}/usr/lib/sysctl.d/60-zed-buffers.conf"
    
      170
    
      171    # Install desktop files
    
      172    for desktop in "${extracted}/desktop/"*.desktop; do
    
      173        install -Dm644 "$desktop" \
    
      174            "${pkgdir}/usr/share/applications/$(basename "$desktop")"
    
      175    done
    
      176
    
      177    # Install icon
    
      178    install -Dm644 "${extracted}/icons/stereolabs-zed.png" \
    
      179        "${pkgdir}/usr/share/pixmaps/stereolabs-zed.png"
    
      180
    
      181    # Install license files
    
      182    install -Dm644 "${extracted}/doc/license/LICENSE.txt" \
    
      183        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      184    install -Dm644 "${extracted}/doc/license/LICENSE_3rdparty.txt" \
    
      185        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE_3rdparty.txt"
    
      186    install -Dm644 "${extracted}/doc/license/LICENSE_Qt_Tools.txt" \
    
      187        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE_Qt_Tools.txt"
    
      188}
    
      189

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3