Patch for Python 3.15 (fix RHBZ#2433881)

- Fixes CVE-2026-34378 / GHSA-v76p-4qvv-vh4g; closes RHBZ#2455493
- Fixes CVE-2026-34380 / GHSA-q3v8-hw4m-59w5; closes RHBZ#2455534
- Fixes CVE-2026-34588 / GHSA-588r-cr5c-w6hf; closes RHBZ#2455505
- Fixes CVE-2026-34589 / GHSA-p8xc-w3q4-h64x; closes RHBZ#2455501
- Fixes CVE-2026-34379 / GHSA-w88v-vqhq-5p24; closes RHBZ#2455497

.gitignore

@@ -1,2 +1,26 @@
 /usd-21.05.tar.gz
 /usd-21.08.tar.gz
+/usd-21.11.tar.gz
+/usd-22.03.tar.gz
+/usd-22.05.tar.gz
+/usd-22.05a.tar.gz
+/usd-22.05b.tar.gz
+/usd-22.08.tar.gz
+/usd-22.11.tar.gz
+/usd-23.02.tar.gz
+/usd-23.05.tar.gz
+/OpenUSD-23.08.tar.gz
+/OpenUSD-23.11.tar.gz
+/OpenUSD-24.03.tar.gz
+/OpenUSD-24.05.tar.gz
+/OpenUSD-24.08.tar.gz
+/OpenUSD-24.11.tar.gz
+/OpenUSD-25.02.tar.gz
+/OpenUSD-25.02a.tar.gz
+/OpenUSD-25.05.tar.gz
+/OpenUSD-25.05.01.tar.gz
+/OpenUSD-25.08.tar.gz
+/OpenUSD-25.11.tar.gz
+/OpenUSD-26.03.tar.gz
+/OpenUSD-26.05.tar.gz
+/OpenUSD-26.08.tar.gz

0001-Downstream-only-add-an-SONAME-version.patch

@@ -0,0 +1,87 @@
+From ee4e9b30e14133e35c23821d3dc7aa93df354a38 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Fri, 27 Oct 2023 12:56:58 -0400
+Subject: [PATCH] Downstream-only: add an SONAME version
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Upstream was asked about .so versioning and setting SONAME properly and
+seemed unprepared to handle the request:
+https://github.com/PixarAnimationStudios/USD/issues/1259#issuecomment-657120216
+
+A patch was offered:
+https://github.com/PixarAnimationStudios/USD/issues/1387
+but it was not sufficient for the general case, since (1) it only handled the
+monolithic build, and (2) it derived the .so version from PXR_MAJOR_VERSION,
+which is *not* reliably bumped on API or ABI changes, and currently is still
+zero.
+
+We will therefore probably need to keep doing downstream .so versioning for
+the foreseeable future. Currently we are assuming that the ABI is likely to
+change on every release (an appropriate assumption for a large C++ project
+with no ABI stability policy), so we build the .so version from the project
+version. Note that the “hidden” major version is zero, so this complies with
+the “0.” prefix recommended in the packaging guidelines.
+
+https://docs.fedoraproject.org/en-US/packaging-guidelines/#_downstream_so_name_versioning
+
+A known defect of this patch is that it causes the hdTiny.so example plugin
+to be versioned as well, which is undesired. This is not a serious problem
+because we do not want to package the built plugin anyway. (It should not be
+built with -DPXR_BUILD_EXAMPLES=OFF, but it is.)
+---
+ cmake/defaults/Version.cmake | 6 ++++++
+ cmake/macros/Private.cmake   | 1 +
+ cmake/macros/Public.cmake    | 2 ++
+ 3 files changed, 9 insertions(+)
+
+diff --git a/cmake/defaults/Version.cmake b/cmake/defaults/Version.cmake
+index c31b5e8d9..fabb45397 100644
+--- a/cmake/defaults/Version.cmake
++++ b/cmake/defaults/Version.cmake
+@@ -10,3 +10,9 @@ set(PXR_MINOR_VERSION "26")
+ set(PXR_PATCH_VERSION "8") # NOTE: Must not have leading 0 for single digits
+ 
+ math(EXPR PXR_VERSION "${PXR_MAJOR_VERSION} * 10000 + ${PXR_MINOR_VERSION} * 100 + ${PXR_PATCH_VERSION}")
++
++set(PXR_DOWNSTREAM_SOVERSION "${PXR_MAJOR_VERSION}.${PXR_MINOR_VERSION}.${PXR_PATCH_VERSION}"
++    CACHE
++    STRING
++    "Downstream shared object version"
++)
+diff --git a/cmake/macros/Private.cmake b/cmake/macros/Private.cmake
+index cddb4e095..5e4b4603a 100644
+--- a/cmake/macros/Private.cmake
++++ b/cmake/macros/Private.cmake
+@@ -1355,6 +1355,7 @@ function(_pxr_library NAME)
+             FOLDER "${folder}"
+             POSITION_INDEPENDENT_CODE ON
+             IMPORT_PREFIX "${args_PREFIX}"            
++            SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
+             PREFIX "${args_PREFIX}"
+             SUFFIX "${args_SUFFIX}"
+     )
+diff --git a/cmake/macros/Public.cmake b/cmake/macros/Public.cmake
+index 5f6a5456b..553b645ec 100644
+--- a/cmake/macros/Public.cmake
++++ b/cmake/macros/Public.cmake
+@@ -415,6 +415,7 @@ function(pxr_library NAME)
+         TYPE "${args_TYPE}"
+         PREFIX "${prefix}"
+         SUFFIX "${suffix}"
++        SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
+         SUBDIR "${subdir}"
+         CPPFILES "${args_CPPFILES};${${NAME}_CPPFILES}"
+         PUBLIC_HEADERS "${args_PUBLIC_HEADERS};${${NAME}_PUBLIC_HEADERS}"
+@@ -1213,6 +1214,7 @@ function(pxr_toplevel_prologue)
+                     PREFIX "${libPrefix}"
+                     IMPORT_PREFIX "${libPrefix}"
+                     OUTPUT_NAME ${libName}
++                    SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
+             )
+             _get_install_dir("lib" libInstallPrefix)
+             install(
+-- 
+2.55.0
+

0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch

@@ -0,0 +1,65 @@
+From 817e23674f1b4ba62481c4e9794f0665a44d83f8 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Fri, 1 Aug 2025 08:47:41 -0400
+Subject: [PATCH] Downstream-only: use Valgrind macro instead of inline
+ assembly
+
+Upstream already has a plan to make this change, but is waiting to be
+able to add a build dependency on valgrind-devel. We have no such
+obstacle, and this change fixes the inline assembly failing to compile
+on aarch64.
+---
+ pxr/exec/vdf/executorDataVector.cpp | 28 +++-------------------------
+ 1 file changed, 3 insertions(+), 25 deletions(-)
+
+diff --git a/pxr/exec/vdf/executorDataVector.cpp b/pxr/exec/vdf/executorDataVector.cpp
+index 96dacca06..7e5625678 100644
+--- a/pxr/exec/vdf/executorDataVector.cpp
++++ b/pxr/exec/vdf/executorDataVector.cpp
+@@ -11,40 +11,18 @@
+ #include "pxr/base/tf/stl.h"
+ #include "pxr/base/trace/trace.h"
+ 
++#include <valgrind/memcheck.h>
++
+ PXR_NAMESPACE_OPEN_SCOPE
+ 
+ 
+ /// Issue a magic instruction sequence which Valgrind will intercept and mark
+ /// the specified memory defined for memcheck.
+ ///
+-/// XXX: We should replace this with the VALGRIND_MAKE_MEM_DEFINED macro
+-///      from memcheck.h, once we can establish a build dependency on
+-///      valgrind-devel.
+-///
+ static inline void
+ Vdf_ExecutorDataVector_ValgrindMakeDefined(void *ptr, size_t size)
+ {
+-#if defined(ARCH_OS_LINUX) && defined(ARCH_CPU_INTEL)
+-    // Pass a result and a pointer to some arguments via registers
+-    volatile unsigned long long int result;
+-    volatile unsigned long long int args[6] = {
+-        0x4D430002,                  // Memcheck: MAKE_MEM_DEFINED
+-        (uintptr_t)(ptr),            // Memory address
+-        size,                        // Size in bytes
+-        0, 0, 0                      // Remaining unused arguments
+-    };
+-
+-    // Magical instruction sequence which Valgrind will interpret as an
+-    // annotation (see valgrind.h)
+-    __asm__ volatile(
+-        "rolq $3,  %%rdi ; rolq $13, %%rdi\n\t"
+-        "rolq $61, %%rdi ; rolq $51, %%rdi\n\t"
+-        "xchgq %%rbx, %%rbx"
+-        : "=d" (result)
+-        : "a" (&args[0]), "0" (0)
+-        : "cc", "memory"
+-    );
+-#endif
++    VALGRIND_MAKE_MEM_DEFINED(ptr, size);
+ }
+ 
+ Vdf_ExecutorDataVector::~Vdf_ExecutorDataVector()
+-- 
+2.55.0
+

0001-Downstream-only-use-the-system-double-conversion-lib.patch

@@ -0,0 +1,46 @@
+From 2d851f23e912d8312f2ea6818963150a8c484138 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Wed, 28 Aug 2024 10:42:48 -0400
+Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library
+
+---
+ pxr/base/tf/CMakeLists.txt | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt
+index 4294f2cb5..b45df65b8 100644
+--- a/pxr/base/tf/CMakeLists.txt
++++ b/pxr/base/tf/CMakeLists.txt
+@@ -105,11 +105,14 @@ function(add_py_dll_link_test)
+ 
+ endfunction()
+ 
++find_library(double-conversion_LIBRARY NAMES double-conversion REQUIRED)
++
+ pxr_library(tf
+     LIBRARIES
+         arch
+         ${WINLIBS}
+         TBB::tbb
++	${double-conversion_LIBRARY}
+ 
+     PUBLIC_CLASSES
+         anyUniquePtr
+@@ -276,14 +279,6 @@ pxr_library(tf
+ 
+     CPPFILES
+         initConfig.cpp
+-        pxrDoubleConversion/bignum-dtoa.cc
+-        pxrDoubleConversion/bignum.cc
+-        pxrDoubleConversion/cached-powers.cc
+-        pxrDoubleConversion/double-to-string.cc
+-        pxrDoubleConversion/fast-dtoa.cc
+-        pxrDoubleConversion/fixed-dtoa.cc
+-        pxrDoubleConversion/string-to-double.cc
+-        pxrDoubleConversion/strtod.cc
+         pxrLZ4/lz4.cpp
+ 
+     PYMODULE_CPPFILES
+-- 
+2.55.0
+

0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch

@@ -0,0 +1,110 @@
+From f3e9600db6086e834c0503cdaf30b5ba7ed53ceb Mon Sep 17 00:00:00 2001
+From: Anonymous Coward <nobody@redhat.com>
+Date: Sun, 26 Jul 2026 16:13:18 +0200
+Subject: [PATCH] Replace PyWeakref_GetObject with PyWeakref_GetRef
+
+PyWeakref_GetObject was removed in Python 3.15. Replace all four call
+sites with PyWeakref_GetRef, which returns a strong reference instead
+of a borrowed one, and adjust reference counting accordingly.
+
+In Tf_PyIdHandle::Ptr(), return Py_None when the referent is dead to
+match the original behaviour (previously returned NULL erroneously).
+
+In Tf_PyWeakObject::GetObject(), explicitly return a Python None object
+on failure, matching the original semantics exactly.
+
+Fixes: https://github.com/PixarAnimationStudios/OpenUSD/issues/3966
+
+Assisted-by: Claude Opus 4.6
+Reviewed-by: OpenUSD Maintainers <usd-maintainers@fedoraproject.org>
+---
+ pxr/base/tf/pyFunction.h     | 13 +++++++++----
+ pxr/base/tf/pyIdentity.cpp   | 10 +++++++++-
+ pxr/base/tf/pyWeakObject.cpp | 12 +++++++++---
+ 3 files changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/pxr/base/tf/pyFunction.h b/pxr/base/tf/pyFunction.h
+index 85af943b2..f77b5b71b 100644
+--- a/pxr/base/tf/pyFunction.h
++++ b/pxr/base/tf/pyFunction.h
+@@ -49,11 +49,13 @@ struct TfPyFunctionFromPython<Ret (Args...)>
+             using namespace pxr_boost::python;
+             // Attempt to get the referenced callable object.
+             TfPyLock lock;
+-            object callable(handle<>(borrowed(PyWeakref_GetObject(weak.ptr()))));
+-            if (TfPyIsNone(callable)) {
++            PyObject *rawCallable = NULL;
++            if (PyWeakref_GetRef(weak.ptr(), &rawCallable) <= 0) {
+                 TF_WARN("Tried to call an expired python callback");
+                 return Ret();
+             }
++            // PyWeakref_GetRef returns a strong reference; handle<> steals it.
++            object callable{handle<>(rawCallable)};
+             return TfPyCall<Ret>(callable)(args...);
+         }
+     };
+@@ -68,12 +70,15 @@ struct TfPyFunctionFromPython<Ret (Args...)>
+             // Attempt to get the referenced self parameter, then build a new
+             // instance method and call it.
+             TfPyLock lock;
+-            PyObject *self = PyWeakref_GetObject(weakSelf.ptr());
+-            if (self == Py_None) {
++            PyObject *self = NULL;
++            if (PyWeakref_GetRef(weakSelf.ptr(), &self) <= 0) {
+                 TF_WARN("Tried to call a method on an expired python instance");
+                 return Ret();
+             }
++            // PyWeakref_GetRef returns a strong reference to self; PyMethod_New
++            // takes its own reference, so release ours afterward.
+             object method(handle<>(PyMethod_New(func.ptr(), self)));
++            Py_DECREF(self);
+             return TfPyCall<Ret>(method)(args...);
+         }
+     };
+diff --git a/pxr/base/tf/pyIdentity.cpp b/pxr/base/tf/pyIdentity.cpp
+index 5389d8f25..06b7f9b0c 100644
+--- a/pxr/base/tf/pyIdentity.cpp
++++ b/pxr/base/tf/pyIdentity.cpp
+@@ -136,7 +136,15 @@ PyObject *
+ Tf_PyIdHandle::Ptr() const {
+     if (_weakRef) {
+         TfPyLock lock;
+-        return PyWeakref_GetObject(_weakRef);
++        PyObject *obj = NULL;
++        if (PyWeakref_GetRef(_weakRef, &obj) > 0) {
++            // Return a borrowed-style reference: decrement so the caller
++            // does not need to release. Safe because the GIL is held by
++            // all callers.
++            Py_DECREF(obj);
++            return obj;
++        }
++        return Py_None;   // dead referent → match original behaviour
+     }
+     return 0;
+ }
+diff --git a/pxr/base/tf/pyWeakObject.cpp b/pxr/base/tf/pyWeakObject.cpp
+index 8cfddc729..ecdd7f705 100644
+--- a/pxr/base/tf/pyWeakObject.cpp
++++ b/pxr/base/tf/pyWeakObject.cpp
+@@ -115,9 +115,15 @@ Tf_PyWeakObject::GetOrCreate(pxr_boost::python::object const &obj)
+ pxr_boost::python::object
+ Tf_PyWeakObject::GetObject() const
+ {
+-    return pxr_boost::python::object
+-        (pxr_boost::python::handle<>
+-         (pxr_boost::python::borrowed(PyWeakref_GetObject(_weakRef.get()))));
++    PyObject *obj = NULL;
++    if (PyWeakref_GetRef(_weakRef.get(), &obj) > 0) {
++        // PyWeakref_GetRef returns a strong reference; handle<> steals it.
++        return pxr_boost::python::object(
++            pxr_boost::python::handle<>(obj));
++    }
++    // Dead referent: return Py_None explicitly, as the original did.
++    return pxr_boost::python::object(
++        pxr_boost::python::handle<>(pxr_boost::python::borrowed(Py_None)));
+ }
+ 
+ void
+-- 
+2.55.0
+

0002-Downstream-only-use-the-system-lz4-library.patch

@@ -0,0 +1,44 @@
+From 9fd6089b3e95bb882199ee359fbba83f7c4bb410 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Thu, 29 Aug 2024 13:30:18 -0400
+Subject: [PATCH 2/6] Downstream-only: use the system lz4 library
+
+---
+ pxr/base/tf/CMakeLists.txt | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt
+index b45df65b8..5e6de96da 100644
+--- a/pxr/base/tf/CMakeLists.txt
++++ b/pxr/base/tf/CMakeLists.txt
+@@ -106,6 +106,8 @@ function(add_py_dll_link_test)
+ endfunction()
+ 
+ find_library(double-conversion_LIBRARY NAMES double-conversion REQUIRED)
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(LZ4 REQUIRED liblz4)
+ 
+ pxr_library(tf
+     LIBRARIES
+@@ -113,6 +115,10 @@ pxr_library(tf
+         ${WINLIBS}
+         TBB::tbb
+ 	${double-conversion_LIBRARY}
++	${LZ4_LIBRARIES}
++
++    INCLUDE_DIRS
++        ${LZ4_INCLUDE_DIRS}
+ 
+     PUBLIC_CLASSES
+         anyUniquePtr
+@@ -279,7 +285,6 @@ pxr_library(tf
+ 
+     CPPFILES
+         initConfig.cpp
+-        pxrLZ4/lz4.cpp
+ 
+     PYMODULE_CPPFILES
+         module.cpp
+-- 
+2.55.0
+

0003-Downstream-only-use-the-system-pugixml-library.patch

@@ -0,0 +1,39 @@
+From 73637a9bf67b3f7afe5070e5d56b07524e14a073 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Fri, 30 Aug 2024 09:32:08 -0400
+Subject: [PATCH 3/6] Downstream-only: use the system pugixml library
+
+---
+ third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt b/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt
+index 244f27aa8..1e00413c4 100644
+--- a/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt
++++ b/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt
+@@ -1,6 +1,8 @@
+ set(PXR_PREFIX "")
+ set(PXR_PACKAGE rmanArgsParser)
+ 
++find_library(pugixml_LIBRARY NAMES pugixml REQUIRED)
++
+ pxr_plugin(rmanArgsParser
+     LIBRARIES
+         arch
+@@ -9,12 +11,10 @@ pxr_plugin(rmanArgsParser
+         vt
+         ar
+         sdr
++	${pugixml_LIBRARY}
+ 
+     PRIVATE_CLASSES
+         rmanArgsParser
+-
+-    CPPFILES
+-        pugixml/pugixml.cpp
+     
+     PRIVATE_HEADERS
+         api.h
+-- 
+2.55.0
+

0004-Downstream-only-use-the-system-rapidjson-library.patch

@@ -0,0 +1,63 @@
+From f331a476a66e41e93d83b7a2e438d3ee7f12ea32 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Sat, 31 Aug 2024 11:08:18 -0400
+Subject: [PATCH 4/6] Downstream-only: use the system rapidjson library
+
+---
+ pxr/base/js/CMakeLists.txt | 40 --------------------------------------
+ 1 file changed, 40 deletions(-)
+
+diff --git a/pxr/base/js/CMakeLists.txt b/pxr/base/js/CMakeLists.txt
+index 8cbda8c52..ec8f3c249 100644
+--- a/pxr/base/js/CMakeLists.txt
++++ b/pxr/base/js/CMakeLists.txt
+@@ -15,46 +15,6 @@ pxr_library(js
+         converter.h
+         types.h
+ 
+-    PRIVATE_HEADERS
+-        rapidjson/allocators.h
+-        rapidjson/cursorstreamwrapper.h
+-        rapidjson/document.h
+-        rapidjson/encodedstream.h
+-        rapidjson/encodings.h
+-        rapidjson/error/en.h
+-        rapidjson/error/error.h
+-        rapidjson/filereadstream.h
+-        rapidjson/filewritestream.h
+-        rapidjson/fwd.h
+-        rapidjson/internal/biginteger.h
+-        rapidjson/internal/clzll.h
+-        rapidjson/internal/diyfp.h
+-        rapidjson/internal/dtoa.h
+-        rapidjson/internal/ieee754.h
+-        rapidjson/internal/itoa.h
+-        rapidjson/internal/meta.h
+-        rapidjson/internal/pow10.h
+-        rapidjson/internal/regex.h
+-        rapidjson/internal/stack.h
+-        rapidjson/internal/strfunc.h
+-        rapidjson/internal/strtod.h
+-        rapidjson/internal/swap.h
+-        rapidjson/istreamwrapper.h
+-        rapidjson/memorybuffer.h
+-        rapidjson/memorystream.h
+-        rapidjson/msinttypes/inttypes.h
+-        rapidjson/msinttypes/stdint.h
+-        rapidjson/ostreamwrapper.h
+-        rapidjson/pointer.h
+-        rapidjson/prettywriter.h
+-        rapidjson/rapidjson.h
+-        rapidjson/reader.h
+-        rapidjson/schema.h
+-        rapidjson/stream.h
+-        rapidjson/stringbuffer.h
+-        rapidjson/uri.h
+-        rapidjson/writer.h
+-
+     DOXYGEN_FILES
+         overview.dox
+ )
+-- 
+2.55.0
+

0005-Downstream-only-use-the-system-libdeflate.patch

@@ -0,0 +1,76 @@
+From a537b44edabe942380d2e87ea7069bdf32b93dbc Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Sun, 1 Sep 2024 21:30:11 -0400
+Subject: [PATCH 5/6] Downstream-only: use the system libdeflate
+
+---
+ pxr/imaging/hio/CMakeLists.txt                       |  7 +++++++
+ .../hioOpenEXR/OpenEXR/OpenEXRCore/compression.c     |  3 +--
+ .../plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h     | 12 ------------
+ 3 files changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/pxr/imaging/hio/CMakeLists.txt b/pxr/imaging/hio/CMakeLists.txt
+index e61fc7c54..7cfbe9d70 100644
+--- a/pxr/imaging/hio/CMakeLists.txt
++++ b/pxr/imaging/hio/CMakeLists.txt
+@@ -1,6 +1,9 @@
+ set(PXR_PREFIX pxr/imaging)
+ set(PXR_PACKAGE hio)
+ 
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(DEFLATE REQUIRED libdeflate)
++
+ pxr_library(hio
+     LIBRARIES
+         arch
+@@ -11,6 +14,10 @@ pxr_library(hio
+         trace
+         ar
+         hf
++	${DEFLATE_LIBRARIES}
++
++    INCLUDE_DIRS
++	${DEFLATE_INCLUDE_DIRS}
+ 
+     PUBLIC_CLASSES
+         fieldTextureData
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c
+index a672e833b..1d2eaea56 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c
+@@ -8,8 +8,7 @@
+ #include "internal_memory.h"
+ #include "internal_structs.h"
+ 
+-// pxr #include <libdeflate.h>
+-#include "../deflate/libdeflate.h"
++#include <libdeflate.h>
+ 
+ #if (                                                                          \
+     LIBDEFLATE_VERSION_MAJOR > 1 ||                                            \
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h
+index 7481a346e..71bdde9cc 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h
+@@ -8,18 +8,6 @@
+ 
+ #include "OpenEXRCore/openexr_config.h"
+ 
+-#include "deflate/lib/lib_common.h"
+-#include "deflate/common_defs.h"
+-#include "deflate/lib/utils.c"
+-#include "deflate/lib/arm/cpu_features.c"
+-#include "deflate/lib/x86/cpu_features.c"
+-#include "deflate/lib/deflate_compress.c"
+-#undef BITBUF_NBITS
+-#include "deflate/lib/deflate_decompress.c"
+-#include "deflate/lib/adler32.c"
+-#include "deflate/lib/zlib_compress.c"
+-#include "deflate/lib/zlib_decompress.c"
+-
+ #include "openexr-c.h"
+ 
+ #include "OpenEXRCore/attributes.c"
+-- 
+2.55.0
+

0006-Downstream-only-use-the-system-libavif.patch

@@ -0,0 +1,241 @@
+From f2a3615238a691e11a4029c33498e7f21a34fff9 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Wed, 4 Sep 2024 11:09:47 -0400
+Subject: [PATCH 6/6] Downstream-only: use the system libavif
+
+---
+ pxr/imaging/plugin/hioAvif/AVIFImage.cpp  |   2 +-
+ pxr/imaging/plugin/hioAvif/CMakeLists.txt | 194 +---------------------
+ 2 files changed, 7 insertions(+), 189 deletions(-)
+
+diff --git a/pxr/imaging/plugin/hioAvif/AVIFImage.cpp b/pxr/imaging/plugin/hioAvif/AVIFImage.cpp
+index b56369ee5..c6fcb4a6c 100644
+--- a/pxr/imaging/plugin/hioAvif/AVIFImage.cpp
++++ b/pxr/imaging/plugin/hioAvif/AVIFImage.cpp
+@@ -30,7 +30,7 @@ ARCH_PRAGMA_UNUSED_FUNCTION
+ #include "pxr/base/tf/stringUtils.h"
+ #include "pxr/base/tf/type.h"
+ 
+-#include "pxr/imaging/plugin/hioAvif/AVIF/src/avif/avif.h"
++#include <avif/avif.h>
+ 
+ PXR_NAMESPACE_OPEN_SCOPE
+ 
+diff --git a/pxr/imaging/plugin/hioAvif/CMakeLists.txt b/pxr/imaging/plugin/hioAvif/CMakeLists.txt
+index 1ac2683f6..7d583c137 100644
+--- a/pxr/imaging/plugin/hioAvif/CMakeLists.txt
++++ b/pxr/imaging/plugin/hioAvif/CMakeLists.txt
+@@ -1,6 +1,9 @@
+ set(PXR_PREFIX pxr/imaging)
+ set(PXR_PACKAGE hioAvif)
+ 
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(AVIF REQUIRED libavif)
++
+ pxr_plugin(hioAvif
+     LIBRARIES
+         ar
+@@ -8,197 +11,12 @@ pxr_plugin(hioAvif
+         gf
+         hio
+         tf
++	${AVIF_LIBRARIES}
+ 
+-    PRIVATE_HEADERS
+-        aom/aom.h
+-        aom/aom_codec.h
+-        aom/aom_decoder.h
+-        aom/aom_encoder.h
+-        aom/aom_frame_buffer.h
+-        aom/aom_image.h
+-        aom/aom_integer.h
+-        aom/aomdx.h
+-        aom/aom_external_partition.h
+-        aom/internal/aom_codec_internal.h
+-        aom/internal/aom_image_internal.h
+-        aom_dsp/aom_dsp_common.h
+-        aom_dsp/aom_filter.h
+-        aom_dsp/binary_codes_reader.h
+-        aom_dsp/bitreader.h
+-        aom_dsp/bitreader_buffer.h
+-        aom_dsp/blend.h
+-        aom_dsp/entcode.h
+-        aom_dsp/entdec.h
+-        aom_dsp/flow_estimation/corner_detect.h
+-        aom_dsp/flow_estimation/flow_estimation.h
+-        aom_dsp/grain_params.h
+-        aom_dsp/grain_table.h
+-        aom_dsp/intrapred_common.h
+-        aom_dsp/odintrin.h
+-        aom_dsp/prob.h
+-        aom_dsp/pyramid.h
+-        aom_dsp/recenter.h
+-        aom_dsp/txfm_common.h
+-        aom_mem/aom_mem.h
+-        aom_mem/include/aom_mem_intrnl.h
+-        aom_ports/aom_once.h
+-        aom_ports/aom_timer.h
+-        aom_ports/bitops.h
+-        aom_ports/mem.h
+-        aom_ports/mem_ops.h
+-        aom_ports/mem_ops_aligned.h
+-        aom_ports/sanitizer.h
+-        aom_scale/yv12config.h
+-        aom_util/aom_thread.h
+-        aom_util/aom_pthread.h
+-        av1/av1_iface_common.h
+-        av1/common/alloccommon.h
+-        av1/common/av1_common_int.h
+-        av1/common/av1_inv_txfm1d.h
+-        av1/common/av1_inv_txfm1d_cfg.h
+-        av1/common/av1_loopfilter.h
+-        av1/common/av1_txfm.h
+-        av1/common/blockd.h
+-        av1/common/cdef.h
+-        av1/common/cdef_block.h
+-        av1/common/cfl.h
+-        av1/common/common.h
+-        av1/common/common_data.h
+-        av1/common/convolve.h
+-        av1/common/entropy.h
+-        av1/common/entropymode.h
+-        av1/common/entropymv.h
+-        av1/common/enums.h
+-        av1/common/filter.h
+-        av1/common/frame_buffers.h
+-        av1/common/idct.h
+-        av1/common/mv.h
+-        av1/common/mvref_common.h
+-        av1/common/obmc.h
+-        av1/common/obu_util.h
+-        av1/common/pred_common.h
+-        av1/common/quant_common.h
+-        av1/common/reconinter.h
+-        av1/common/reconinter_template.inc
+-        av1/common/reconintra.h
+-        av1/common/resize.h
+-        av1/common/restoration.h
+-        av1/common/scale.h
+-        av1/common/scan.h
+-        av1/common/seg_common.h
+-        av1/common/thread_common.h
+-        av1/common/tile_common.h
+-        av1/common/timing.h
+-        av1/common/token_cdfs.h
+-        av1/common/txb_common.h
+-        av1/common/warped_motion.h
+-        av1/decoder/decodeframe.h
+-        av1/decoder/decodemv.h
+-        av1/decoder/decoder.h
+-        av1/decoder/decodetxb.h
+-        av1/decoder/detokenize.h
+-        av1/decoder/dthread.h
+-        av1/decoder/grain_synthesis.h
+-        av1/decoder/obu.h
+-        common/args_helper.h
+-        AVIF/src/avif/avif.h
+-        AVIF/src/avif/internal.h
+-        AVIF/src/src-libyuv/libyuv/basic_types.h
+-        AVIF/src/src-libyuv/libyuv.h
+-        AVIF/src/src-libyuv/libyuv/planar_functions.h
+-        AVIF/src/src-libyuv/libyuv/row.h
+-        AVIF/src/src-libyuv/libyuv/scale.h
+-        AVIF/src/src-libyuv/libyuv/scale_row.h
+-        AVIF/src/src-libyuv/libyuv/version.h
++    INCLUDE_DIRS
++	${AVIF_INCLUDE_DIRS}
+ 
+     CPPFILES
+-        aom/src/aom_codec.c
+-        aom/src/aom_decoder.c
+-        aom/src/aom_image.c
+-        aom/src/aom_integer.c
+-        aom_dsp/aom_convolve.c
+-        aom_dsp/aom_dsp_rtcd.c
+-        aom_dsp/binary_codes_reader.c
+-        aom_dsp/bitreader.c
+-        aom_dsp/bitreader_buffer.c
+-        aom_dsp/blend_a64_hmask.c
+-        aom_dsp/blend_a64_mask.c
+-        aom_dsp/blend_a64_vmask.c
+-        aom_dsp/entcode.c
+-        aom_dsp/entdec.c
+-        aom_dsp/intrapred.c
+-        aom_dsp/loopfilter.c
+-        aom_dsp/odintrin.c
+-        aom_dsp/pyramid.c
+-        aom_mem/aom_mem.c
+-        aom_scale/aom_scale_rtcd.c
+-        aom_scale/generic/yv12config.c
+-        aom_scale/generic/yv12extend.c
+-        aom_util/aom_thread.c
+-        av1/av1_dx_iface.c
+-        av1/common/alloccommon.c
+-        av1/common/av1_inv_txfm1d.c
+-        av1/common/av1_inv_txfm2d.c
+-        av1/common/av1_loopfilter.c
+-        av1/common/av1_rtcd.c
+-        av1/common/av1_txfm.c
+-        av1/common/blockd.c
+-        av1/common/cdef.c
+-        av1/common/cdef_block.c
+-        av1/common/cfl.c
+-        av1/common/common_data.c
+-        av1/common/convolve.c
+-        av1/common/entropy.c
+-        av1/common/entropymode.c
+-        av1/common/entropymv.c
+-        av1/common/frame_buffers.c
+-        av1/common/idct.c
+-        av1/common/mvref_common.c
+-        av1/common/obu_util.c
+-        av1/common/pred_common.c
+-        av1/common/quant_common.c
+-        av1/common/reconinter.c
+-        av1/common/reconintra.c
+-        av1/common/resize.c
+-        av1/common/restoration.c
+-        av1/common/scale.c
+-        av1/common/scan.c
+-        av1/common/seg_common.c
+-        av1/common/thread_common.c
+-        av1/common/tile_common.c
+-        av1/common/timing.c
+-        av1/common/txb_common.c
+-        av1/common/warped_motion.c
+-        av1/decoder/decodeframe.c
+-        av1/decoder/decodemv.c
+-        av1/decoder/decoder.c
+-        av1/decoder/decodetxb.c
+-        av1/decoder/detokenize.c
+-        av1/decoder/grain_synthesis.c
+-        av1/decoder/obu.c
+-        AVIF/src/alpha.c
+-        AVIF/src/avif.c
+-        AVIF/src/codec_aom.c
+-        AVIF/src/colr.c
+-        AVIF/src/diag.c
+-        AVIF/src/exif.c
+-        AVIF/src/io.c
+-        AVIF/src/mem.c
+-        AVIF/src/avif_obu.c
+-        AVIF/src/rawdata.c
+-        AVIF/src/read.c
+-        AVIF/src/reformat.c
+-        AVIF/src/reformat_libsharpyuv.c
+-        AVIF/src/reformat_libyuv.c
+-        AVIF/src/avif-scale.c
+-        AVIF/src/stream.c
+-        AVIF/src/utils.c
+-        AVIF/src/write.c
+-        AVIF/src/src-libyuv/planar_functions.c
+-        AVIF/src/src-libyuv/row_common.c
+-        AVIF/src/src-libyuv/yuv_scale.c
+-        AVIF/src/src-libyuv/scale_any.c
+-        AVIF/src/src-libyuv/scale_common.c
+         AVIFImage.cpp
+ 
+     RESOURCE_FILES
+-- 
+2.55.0
+

3903.patch

@@ -0,0 +1,83 @@
+From 3e51fb244dd264b09179999d29dc7c5afd7e71e3 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Tue, 2 Dec 2025 10:43:31 +0000
+Subject: [PATCH] Backport fixes for CVE-2025-64181 etc. in OpenEXRCore
+
+---
+ .../hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c    | 20 ++++++++++++++++---
+ .../OpenEXR/OpenEXRCore/internal_util.h       |  4 ++--
+ .../OpenEXR/OpenEXRCore/parse_header.c        |  4 +++-
+ 3 files changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c
+index cfe80b4cd68..e11209fe660 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c
+@@ -1292,6 +1292,16 @@ exr_read_tile_chunk_info (
+         return pctxt->report_error (
+             pctxt, EXR_ERR_INVALID_ARGUMENT, "Invalid packed size of 0");
+ 
++    if (part->comp_type == EXR_COMPRESSION_NONE &&
++       cinfo->packed_size != cinfo->unpacked_size)
++    {
++         return pctxt->print_error (
++             pctxt,
++             EXR_ERR_BAD_CHUNK_LEADER,
++             "Mismatch between unpacked and packed size with uncompressed data: packed is %" PRIu64 "; unpacked is %" PRIu64,
++             cinfo->packed_size, cinfo->unpacked_size);
++    }
++
+     return EXR_ERR_SUCCESS;
+ }
+ 
+@@ -1350,11 +1360,15 @@ exr_read_chunk (
+         rv    = pctxt->do_read (
+             pctxt, packed_data, toread, &dataoffset, &nread, rmode);
+ 
+-        if (rmode == EXR_ALLOW_SHORT_READ && nread < (int64_t) toread)
++        if (rmode == EXR_ALLOW_SHORT_READ &&
++            nread >= 0 &&
++            nread < (int64_t) toread)
++        {
+             memset (
+                 ((uint8_t*) packed_data) + nread,
+-                0,
+-                toread - (uint64_t) (nread));
++                    0,
++            (size_t)(toread - (uint64_t)nread));
++        }
+     }
+     else
+         rv = EXR_ERR_SUCCESS;
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h
+index 3c6f02786cc..e0fa3933d92 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h
+@@ -31,10 +31,10 @@ compute_sampled_height (int height, int y_sampling, int start_y)
+         else
+             start = start_y;
+         end = start_y + height - 1;
+-        end -= (end < 0) ? (-end % y_sampling) : (end % y_sampling);
++        end -= (end < 0 ? -end : end) % y_sampling;
+ 
+         if (start > end)
+-            nlines = 0;
++            nlines = start == start_y ? 1 : 0;
+         else
+             nlines = (end - start) / y_sampling + 1;
+     }
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c
+index d7230392693..8b6cf78cc59 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c
+@@ -2293,7 +2293,9 @@ internal_exr_compute_chunk_offset_size (struct _internal_exr_part* curpart)
+ 
+     w = (uint64_t) (((int64_t) dw.max.x) - ((int64_t) dw.min.x) + 1);
+ 
+-    if (curpart->tiles)
++    if (curpart->storage_mode != EXR_STORAGE_SCANLINE &&
++       curpart->storage_mode != EXR_STORAGE_DEEP_SCANLINE &&
++       curpart->tiles)
+     {
+         const exr_attr_tiledesc_t* tiledesc  = curpart->tiles->tiledesc;
+         int64_t                    tilecount = 0;

USD-20.05-soversion.patch

@@ -1,11 +0,0 @@
-diff -up USD-20.05/cmake/macros/Public.cmake.sover USD-20.05/cmake/macros/Public.cmake
---- USD-20.05/cmake/macros/Public.cmake.sover	2020-09-16 16:40:05.489056637 +0200
-+++ USD-20.05/cmake/macros/Public.cmake	2020-09-16 16:38:43.784595457 +0200
-@@ -926,6 +926,7 @@ function(pxr_toplevel_prologue)
-                     FOLDER "${folder}"
-                     PREFIX "${PXR_LIB_PREFIX}"
-                     IMPORT_PREFIX "${PXR_LIB_PREFIX}"
-+                    SOVERSION ${PXR_MAJOR_VERSION}
-             )
-             _get_install_dir("lib" libInstallPrefix)
-             install(

USD-21.08-OpenEXR3.patch

@@ -1,186 +0,0 @@
-diff -Naur USD-21.08-original/cmake/defaults/Packages.cmake USD-21.08/cmake/defaults/Packages.cmake
---- USD-21.08-original/cmake/defaults/Packages.cmake	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/cmake/defaults/Packages.cmake	2021-08-10 10:41:05.317624337 -0400
-@@ -188,6 +188,7 @@
-     # --OpenImageIO
-     if (PXR_BUILD_OPENIMAGEIO_PLUGIN)
-         find_package(OpenEXR REQUIRED)
-+	find_package(Imath REQUIRED)
-         find_package(OpenImageIO REQUIRED)
-         add_definitions(-DPXR_OIIO_PLUGIN_ENABLED)
-     endif()
-@@ -254,7 +255,7 @@
-     endif()
-     # --OpenVDB
-     if (PXR_ENABLE_OPENVDB_SUPPORT)
--        find_package(OpenEXR REQUIRED)
-+        find_package(Imath REQUIRED)
-         find_package(OpenVDB REQUIRED)
-         add_definitions(-DPXR_OPENVDB_SUPPORT_ENABLED)
-     endif()
-@@ -283,7 +284,7 @@
- 
- if (PXR_BUILD_ALEMBIC_PLUGIN)
-     find_package(Alembic REQUIRED)
--    find_package(OpenEXR REQUIRED)
-+    find_package(Imath REQUIRED)
-     if (PXR_ENABLE_HDF5_SUPPORT)
-         find_package(HDF5 REQUIRED
-             COMPONENTS
-@@ -305,6 +306,7 @@
- if(PXR_ENABLE_OSL_SUPPORT)
-     find_package(OSL REQUIRED)
-     find_package(OpenEXR REQUIRED)
-+    find_package(Imath REQUIRED)
-     add_definitions(-DPXR_OSL_SUPPORT_ENABLED)
- endif()
- 
-diff -Naur USD-21.08-original/cmake/modules/FindOpenEXR.cmake USD-21.08/cmake/modules/FindOpenEXR.cmake
---- USD-21.08-original/cmake/modules/FindOpenEXR.cmake	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/cmake/modules/FindOpenEXR.cmake	1969-12-31 19:00:00.000000000 -0500
-@@ -1,101 +0,0 @@
--#
--# Copyright 2016 Pixar
--#
--# Licensed under the Apache License, Version 2.0 (the "Apache License")
--# with the following modification; you may not use this file except in
--# compliance with the Apache License and the following modification to it:
--# Section 6. Trademarks. is deleted and replaced with:
--#
--# 6. Trademarks. This License does not grant permission to use the trade
--#    names, trademarks, service marks, or product names of the Licensor
--#    and its affiliates, except as required to comply with Section 4(c) of
--#    the License and to reproduce the content of the NOTICE file.
--#
--# You may obtain a copy of the Apache License at
--#
--#     http://www.apache.org/licenses/LICENSE-2.0
--#
--# Unless required by applicable law or agreed to in writing, software
--# distributed under the Apache License with the above modification is
--# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
--# KIND, either express or implied. See the Apache License for the specific
--# language governing permissions and limitations under the Apache License.
--#
--
--find_path(OPENEXR_INCLUDE_DIR
--    OpenEXR/half.h
--HINTS
--    "${OPENEXR_LOCATION}"
--    "$ENV{OPENEXR_LOCATION}"
--PATH_SUFFIXES
--    include/
--DOC
--    "OpenEXR headers path"
--)
--
--if(OPENEXR_INCLUDE_DIR)
--  set(openexr_config_file "${OPENEXR_INCLUDE_DIR}/OpenEXR/OpenEXRConfig.h")
--  if(EXISTS ${openexr_config_file})
--      file(STRINGS
--           ${openexr_config_file}
--           TMP
--           REGEX "#define OPENEXR_VERSION_STRING.*$")
--      string(REGEX MATCHALL "[0-9.]+" OPENEXR_VERSION ${TMP})
--
--      file(STRINGS
--           ${openexr_config_file}
--           TMP
--           REGEX "#define OPENEXR_VERSION_MAJOR.*$")
--      string(REGEX MATCHALL "[0-9]" OPENEXR_MAJOR_VERSION ${TMP})
--
--      file(STRINGS
--           ${openexr_config_file}
--           TMP
--           REGEX "#define OPENEXR_VERSION_MINOR.*$")
--      string(REGEX MATCHALL "[0-9]" OPENEXR_MINOR_VERSION ${TMP})
--  endif()
--endif()
--
--foreach(OPENEXR_LIB
--    Half
--    Iex
--    Imath
--    IlmImf
--    IlmThread
--    IlmImfUtil
--    IexMath
--    )
--
--    # OpenEXR libraries may be suffixed with the version number, so we search
--    # using both versioned and unversioned names.
--    find_library(OPENEXR_${OPENEXR_LIB}_LIBRARY
--        NAMES
--            ${OPENEXR_LIB}-${OPENEXR_MAJOR_VERSION}_${OPENEXR_MINOR_VERSION}
--            ${OPENEXR_LIB}
--        HINTS
--            "${OPENEXR_LOCATION}"
--            "$ENV{OPENEXR_LOCATION}"
--        PATH_SUFFIXES
--            lib/
--        DOC
--            "OPENEXR's ${OPENEXR_LIB} library path"
--    )
--
--    if(OPENEXR_${OPENEXR_LIB}_LIBRARY)
--        list(APPEND OPENEXR_LIBRARIES ${OPENEXR_${OPENEXR_LIB}_LIBRARY})
--    endif()
--endforeach(OPENEXR_LIB)
--
--# So #include <half.h> works
--list(APPEND OPENEXR_INCLUDE_DIRS ${OPENEXR_INCLUDE_DIR})
--list(APPEND OPENEXR_INCLUDE_DIRS ${OPENEXR_INCLUDE_DIR}/OpenEXR)
--
--include(FindPackageHandleStandardArgs)
--find_package_handle_standard_args(OpenEXR
--    REQUIRED_VARS
--        OPENEXR_INCLUDE_DIRS
--        OPENEXR_LIBRARIES
--    VERSION_VAR
--        OPENEXR_VERSION
--)
--
-diff -Naur USD-21.08-original/pxr/imaging/hioOpenVDB/CMakeLists.txt USD-21.08/pxr/imaging/hioOpenVDB/CMakeLists.txt
---- USD-21.08-original/pxr/imaging/hioOpenVDB/CMakeLists.txt	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/pxr/imaging/hioOpenVDB/CMakeLists.txt	2021-08-10 10:39:27.478207730 -0400
-@@ -14,7 +14,7 @@
-         hio
-         tf
-         usd
--        ${OPENEXR_Half_LIBRARY}
-+	${IMATH_LIBRARIES}
-         ${OPENVDB_LIBRARY}
- 
-     INCLUDE_DIRS
-diff -Naur USD-21.08-original/pxr/imaging/plugin/hioOiio/CMakeLists.txt USD-21.08/pxr/imaging/plugin/hioOiio/CMakeLists.txt
---- USD-21.08-original/pxr/imaging/plugin/hioOiio/CMakeLists.txt	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/pxr/imaging/plugin/hioOiio/CMakeLists.txt	2021-08-10 10:39:31.578183423 -0400
-@@ -17,6 +17,7 @@
-         tf
-         ${OIIO_LIBRARIES}
-         ${OPENEXR_LIBRARIES}
-+	${IMATH_LIBRARIES}
- 
-     INCLUDE_DIRS
-         ${OIIO_INCLUDE_DIRS}
-diff -Naur USD-21.08-original/pxr/usd/plugin/usdAbc/CMakeLists.txt USD-21.08/pxr/usd/plugin/usdAbc/CMakeLists.txt
---- USD-21.08-original/pxr/usd/plugin/usdAbc/CMakeLists.txt	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/pxr/usd/plugin/usdAbc/CMakeLists.txt	2021-08-10 11:55:33.840880041 -0400
-@@ -23,15 +23,12 @@
-         usd
-         usdGeom
-         ${ALEMBIC_LIBRARIES}
--        ${OPENEXR_Half_LIBRARY} 
--        ${OPENEXR_Imath_LIBRARY} 
--        ${OPENEXR_Iex_LIBRARY} 
--        ${OPENEXR_IexMath_LIBRARY}
-+	${IMATH_LIBRARIES}
-         ${optionalLibs}
- 
-     INCLUDE_DIRS
-         ${ALEMBIC_INCLUDE_DIR}
--        ${OPENEXR_INCLUDE_DIRS}
-+	${IMATH_INCLUDE_DIRS}
-         ${optionalIncludeDirs}
- 
-     PRIVATE_CLASSES

changelog

@@ -1,50 +1,92 @@
-* Sun Aug 01 2021 Luya Tshimbalanga <luya@fedoraproject.org> 21.08-1
-- Update to 21.08 (#1982974)
-- Temporarily disable oiio and ocio due to broken openexr path
-- Resolves rhbz#1982974
-- Uses autorelease and autochangelog macros
+* Sat Oct 08 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.05b-11
+- Fix rpmautospec changelog problems
 
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 21.05-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+* Fri Oct 07 2022 Richard Shaw <hobbes1069@gmail.com> 22.05b-10
+- Rebuild for OpenImageIO 2.4.4.2.
 
-* Sun Jun 6 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.05-5
-- Disable open shading language support
+* Wed Aug 03 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.05b-9
+- Revert "Update to 22.08 (.so version bump); close RHBZ#2110024"
 
-* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 21.05-4
-- Rebuilt for Python 3.10
+* Tue Aug 02 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.08-1
+- Update to 22.08 (.so version bump); close RHBZ#2110024
+- The monolithic library is also renamed from libusd_usd_ms.so to
+  libusd_ms.so.
 
-* Fri May 21 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.05-3
-- Rebuild for ptex 2.4.0
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> 22.05b-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 
-* Fri May 7 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.05-2
-- Multiple fixes based on packaging review 
-- Add comment for multiple licenses
-- Add requires for python subpackage
-- Resolves rhbz#1895567
+* Wed Jul 06 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.05b-7
+- Re-enable usdview now that RHBZ#2025599 is fixed
 
-* Fri Apr 9 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.05-1
-- Update to 21.05
-- Multiple fixes based on packaging review 
-- Drop forced out of source build line
+* Mon Jul 04 2022 Luya Tshimbalanga <luya@fedoraproject.org> 22.05b-6
+- Rebuild for embree 3.13.3
 
-* Fri Apr 9 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.02-4
-- Multiple fixes based on package review
+* Thu Jun 30 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.05b-5
+- Updated (cleaner) patch in upstream PR#1928
 
-* Fri Feb 05 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.02-3
-- Patch for system header position causin the build to fail
+* Tue Jun 28 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.05b-4
+- Updated patch for upstream PR#1928
 
-* Mon Jan 25 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.02-2
-- Update c++ requirement to 17
+* Tue Jun 28 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.05b-3
+- Temporarily disable usdview (close RHBZ#2099184)
+- It can be re-enabled when pyside2 is ready for Python 3.11 (RHBZ#2025599)
 
-* Wed Jan 20 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.02-1
-- Update to 21.02
-- Move isa to devel subpackage
-- Drop glew dependency
+* Tue Jun 28 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.05b-2
+- Fix a Python 3.11 incompatibility
+- Apply upstream PR#1928 “Do not access PyFrameObject fields directly on
+  Python 3.10+”
 
-* Thu Nov 12 2020 Luya Tshimbalanga <luya@fedoraproject.org> - 20.11-2
-- Add missing isa for arch specific
-- Strip the Carriage Returns on NOTICE.txt
+* Wed Jun 15 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.05b-1
+- Update to 22.05b (close RHBZ#2097211)
 
-* Thu Oct 22 2020 Luya Tshimbalanga <luya@fedoraproject.org> - 20.11-1
-- Initial package
+* Fri May 27 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.05a-1
+- Update to 22.05a (close RHBZ#2078041)
+- For working around deprecated/removed glibc malloc hooks, switch to
+  upstream PR#1830, which has similar effect to our pre-existing patch, but
+  is a little tidier
+- Move usdview/testusdview binaries to python3-usd subpackage
+- New downstream .so version 0.22.5
 
+* Wed May 04 2022 Thomas Rodgers <trodgers@redhat.com> 22.03-9
+- Rebuilt for Boost 1.78
+
+* Wed Apr 20 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.03-8
+- Security fix for CVE-2022-28041
+
+* Fri Apr 01 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.03-7
+- Do not package pxrConfig.cmake (close RHBZ#2055414)
+
+* Fri Apr 01 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.03-6
+- Apply a patch that would be required to build the tests
+
+* Fri Apr 01 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.03-5
+- Move bundled library virtual Provides to -libs
+
+* Fri Apr 01 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.03-4
+- No need to explicitly disable in-source build on Fedora
+
+* Fri Apr 01 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.03-3
+- Stop using jemalloc
+
+* Wed Mar 30 2022 Benjamin A. Beasley <code@musicinmybrain.net> 22.03-2
+- Change downstream .so version scheme
+- Use the entire version number in the .so version to reflect the lack of
+  an upstream ABI stability policy.
+- Use a separate .so version macro in the spec file rather than deducing it
+  from the package version. Having to manually change the .so version macro
+  on updates is a valuable reminder of the need to rebuild dependent
+  packages.
+- Also support versioning shared libraries in non-monolithic builds.
+
+* Mon Feb 21 2022 Luya Tshimbalanga <luya@fedoraproject.org> 22.03-1
+- New upstream release 22.03 This update adds workaround removing
+  depreciated glibc mallocHock
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> 21.11-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Sun Nov 28 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> 21.11-4
+- empty commit to fix upgrade path from F35
+
+* Sat Nov 13 2021 Luya Tshimbalanga <luya@fedoraproject.org> 21.11-3
+- RPMAUTOSPEC: unresolvable merge

org.openusd.usdview.desktop

@@ -1,7 +1,7 @@
 [Desktop Entry]
 Name=USD view
 GenericName=Universal Scene Description Viewer
-Comment=Open .cbr & .cbz files
+Comment=Visualize USD files
 Exec=usdview
 Icon=applications-graphics
 Terminal=false

sources

@@ -1 +1 @@
-SHA512 (usd-21.08.tar.gz) = 3001312c2d89110a6d6eb9d9cd29fa22c2c29f2ea467b7a828f0f35897e3784f10bd4e00341fc3874fc0cae8bfdf09a4470cd1a19e4ae70ad0a9774052a62d28
+SHA512 (OpenUSD-26.08.tar.gz) = 82f7bb4f77b295be79cd36f591f242276d36c0d589b0fca383344c27e70daf7e29151bf587528bb2fc2b2a8b974387a253993ace3caf5f79ae70f9ebbc71cf1a

usd.spec

@@ -1,130 +1,276 @@
-%global         __cmake_in_source_build 0
-%global         libmajor 0
-%global         srcname  USD
-%bcond_without  alembic
-%bcond_with     documentation
-%bcond_without  embree
-%bcond_without  imaging
-# We must keep jemalloc enabled to work around
-# https://github.com/PixarAnimationStudios/USD/issues/1592.
-%bcond_without  jemalloc
-%bcond_with     openshading
-%bcond_with     openvdb
-%bcond_with     ocio
-%bcond_with     oiio
-%bcond_without  python3
-%bcond_with     test
+# We hard-code the ABI version here, even though it can be derived from the
+# package version, as a reminder of the need to rebuild dependent packages on
+# every update. See additional notes near the downstream ABI versioning patch.
+# It should be 0.MAJOR.MINOR without leading zeros, e.g. 22.03 → 0.22.3.
+%global downstream_so_version 0.26.8
+
+%bcond alembic       1
+%bcond draco         1
+%bcond embree        1
+%bcond jemalloc      0
+%bcond materialx     1
+# Default "UNIX Makefiles" backend for CMake would also work fine; ninja is a
+# bit faster. We conditionalize it just in case there are backend-specific
+# issues in the future.
+%bcond ninja         1
+%bcond openshading   1
+%bcond openvdb       1
+%bcond ocio          1
+%bcond oiio          1
+%bcond ptex          1
+%bcond usdview       1
+# TODO: Figure out how to re-enable the tests. Currently these want to install
+# into /usr/tests, and there are issues with the launchers finding the
+# command-line tools in the buildroot.
+%bcond test          0
 
 Name:           usd
-Version:        21.08
+Version:        26.08
 Release:        %autorelease
 Summary:        3D VFX pipeline interchange file format
 
-# The entire source is ASL 2.0 except:
+# The entire source is Pixar except:
 #
-# BSD:
+# Apache-2.0:
+#   - pxr/imaging/hgiVulkan/spirv_reflect.{cpp,h}
+#   - pxr/imaging/plugin/hdEmbree/pxrPbrt/pbrtUtils.h
+#   - pxr/imaging/plugin/hdEmbree/pxrIES/pxr-IES.patch
+#   - pxr/imaging/plugin/hdEmbree/pxrIES/ies.{cpp,h}
+# BSD-3-Clause:
 #   - pxr/base/gf/ilmbase_*
-#   - pxr/base/js/rapidjson/msinttypes/
-#   - pxr/base/tf/pxrDoubleConversion/
-#   - pxr/base/tf/pxrLZ4/
+#   - pxr/base/js/rapidjson/msinttypes/ (removed in %%prep)
+#   - pxr/base/tf/pxrCLI11/ (removed in %%prep)
+#   - pxr/base/tf/pxrDoubleConversion/ (removed in %%prep)
+#   - pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/
+#   - pxr/imaging/plugin/hioAvif/AVIF/src/src-libyuv/
+# BSD-2-Clause:
+#   - pxr/base/tf/pxrLZ4/ (removed in %%prep)
+#   - pxr/imaging/plugin/hioAvif/AVIF/, except
+#     pxr/imaging/plugin/hioAvif/AVIF/src/src-libyuv/;
+#     pxr/imaging/plugin/hioAvif/AVIF/src/avif_obu.c has a different copyright
+#   - pxr/imaging/plugin/hioAvif/aom/
+# BSL-1.0:
+#   - pxr/external/boost/
 # MIT:
+#   - docs/doxygen/doxygen-awesome-css/ (removed in %%prep)
+#   - pxr/base/js/rapidjson/, except pxr/base/js/rapidjson/msinttypes/ (both
+#     removed in %%prep)
+#   - pxr/base/pegtl/
+#   - pxr/base/tf/pxrTslRobinMap/
 #   - pxr/imaging/garch/khrplatform.h
-#   - pxr/base/js/rapidjson/, except pxr/base/js/rapidjson/msinttypes/
-#   - pxr/base/tf/pyLock.cpp (only some sections; most of the file is
-#     ASL 2.0)
-#   - third_party/renderman-23/plugin/rmanArgsParser/pugixml/
-# MIT or Unlicense:
+#   - pxr/imaging/hgiVulkan/vk_mem_alloc.h
+#   - pxr/imaging/plugin/hioOpenEXR/OpenEXR/deflate/ (removed in %%prep)
+#   - third_party/renderman/plugin/rmanArgsParser/pugixml/ (removed in %%prep)
+# MIT OR Unlicense:
 #   - pxr/imaging/hio/stb/
+# Pixar AND GPL-3.0-or-later WITH Bison-exception-2.2:
+#   - pxr/usd/sdf/path.tab.{cpp,h}
+#   - pxr/usd/sdf/textFileFormat.tab.{cpp,h}
+#   - third_party/renderman/plugin/hdPrman/virtualStructConditionalGrammar.tab.{cpp,h}
 #
-# (Certain build system files are also under licenses other than ASL 2.0, but
+# Additionally, the following would be listed above but are removed in %%prep:
+#
+# Apache-2.0:
+#   - pxr/usdImaging/usdviewq/fonts/Roboto_Mono/
+#   - pxr/usdImaging/usdviewq/fonts/Roboto/
+# MIT:
+#   - docs/doxygen/doxygen-awesome-css/ (except doxygen-awesome-darkmode-toggle.js)
+# MIT AND Apache-2.0:
+#   - docs/doxygen/doxygen-awesome-css/doxygen-awesome-darkmode-toggle.js
+#
+# (Certain build system files are also under licenses other than Apache-2.0, but
 # do not contribute their license terms to the built RPMs.)
-License:        ASL 2.0 and BSD and MIT and (MIT or Unlicense)
+#
+# Note that the license assigned the SPDX identifier Pixar was later officially
+# named Tomorrow Open Source Technology License 1.0, TOST-1.0, with no change
+# to its terms.
+License:        %{shrink:
+                Pixar AND
+                Apache-2.0 AND
+                BSD-3-Clause AND
+                BSD-2-Clause AND
+                BSL-1.0 AND
+                MIT AND
+                (MIT OR Unlicense) AND
+                (Pixar AND GPL-3.0-or-later WITH Bison-exception-2.2)
+                }
 URL:            http://www.openusd.org/
-Source0:         https://github.com/PixarAnimationStudios/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
-Source1:        org.open%{name}.%{name}view.desktop
+%global forgeurl https://github.com/PixarAnimationStudios/OpenUSD
+Source0:        %{forgeurl}/archive/v%{version}/OpenUSD-%{version}.tar.gz
+Source1:        org.openusd.usdview.desktop
 
+# Downstream-only: add an SONAME version
+#
+# Upstream was asked about .so versioning and setting SONAME properly and
+# seemed unprepared to handle the request:
+# https://github.com/PixarAnimationStudios/USD/issues/1259#issuecomment-657120216
+#
+# A patch was offered:
 # https://github.com/PixarAnimationStudios/USD/issues/1387
-Patch1:         %{srcname}-20.05-soversion.patch
+# but it was not sufficient for the general case, since (1) it only handled the
+# monolithic build, and (2) it derived the .so version from PXR_MAJOR_VERSION,
+# which is *not* reliably bumped on API or ABI changes, and currently is still
+# zero.
+#
+# We will therefore probably need to keep doing downstream .so versioning for
+# the foreseeable future. Currently we are assuming that the ABI is likely to
+# change on every release (an appropriate assumption for a large C++ project
+# with no ABI stability policy), so we build the .so version from the project
+# version. Note that the “hidden” major version is zero, so this complies with
+# the “0.” prefix recommended in the packaging guidelines.
+#
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_downstream_so_name_versioning
+#
+# A known defect of this patch is that it causes the hdTiny.so example plugin
+# to be versioned as well, which is undesired. This is not a serious problem
+# because we do not want to package the built plugin anyway. (It should not be
+# built with -DPXR_BUILD_EXAMPLES=OFF, but it is.)
+Patch:          0001-Downstream-only-add-an-SONAME-version.patch
 
-# https://github.com/PixarAnimationStudios/USD/issues/1591
-Patch2:         USD-21.08-OpenEXR3.patch
+# Downstream-only: use Valgrind macro instead of inline assembly
+#
+# Upstream already has a plan to make this change, but is waiting to be
+# able to add a build dependency on valgrind-devel. We have no such
+# obstacle, and this change fixes the inline assembly failing to compile
+# on aarch64.
+Patch:          0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch
+
+# Downstream-only: use the system double-conversion library
+Patch:          0001-Downstream-only-use-the-system-double-conversion-lib.patch
+# Downstream-only: use the system lz4 library
+Patch:          0002-Downstream-only-use-the-system-lz4-library.patch
+# Downstream-only: use the system pugixml library
+Patch:          0003-Downstream-only-use-the-system-pugixml-library.patch
+# Downstream-only: use the system rapidjson library
+Patch:          0004-Downstream-only-use-the-system-rapidjson-library.patch
+# Downstream-only: use the system libdeflate library
+Patch:          0005-Downstream-only-use-the-system-libdeflate.patch
+# Downstream-only: use the system libavif library
+Patch:          0006-Downstream-only-use-the-system-libavif.patch
+
+# Backport fixes for CVE-2025-64181 etc. in OpenEXRCore
+# https://github.com/PixarAnimationStudios/OpenUSD/pull/3903
+Patch:          %{forgeurl}/pull/3903.patch
+
+# Replace PyWeakref_GetObject with PyWeakref_GetRef
+# Fixes RHBZ#2433881. This patch is LLM-generated and needs expert human
+# review, but it at least builds. See discussion in
+# https://bugzilla.redhat.com/show_bug.cgi?id=2433881.
+# Mentioned upstream in
+# https://github.com/PixarAnimationStudios/OpenUSD/issues/3966#issuecomment-5128542913.
+Patch:          0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch
 
 # Base
-BuildRequires:  boost-devel
-BuildRequires:  boost-program-options
-BuildRequires:  cmake
-BuildRequires:  dos2unix
 BuildRequires:  gcc-c++
-BuildRequires:  pkgconfig(blosc)
-BuildRequires:  pkgconfig(tbb)
 
-# Documentation
-%if %{with documentation}
-BuildRequires:  doxygen
-BuildRequires:  graphviz
+BuildRequires:  cmake
+%if %{with ninja}
+BuildRequires:  ninja-build
+%endif
+
+BuildRequires:  dos2unix
+BuildRequires:  help2man
+
+BuildRequires:  pkgconfig(blosc)
+BuildRequires:  pkgconfig(dri)
+BuildRequires:  hdf5-devel
+BuildRequires:  cmake(OpenSubdiv)
+BuildRequires:  pkgconfig(tbb)
+# This seems to be an indirect dependency, probably through OpenSubdiv.
+# Ideally, everything would take care of its own dependencies, and we wouldn’t
+# have to specify it directly, but we haven’t studied the problem closely
+# enough to propose a fix.
+BuildRequires:  pkgconfig(OpenCL)
+# Unbundled:
+BuildRequires:  cmake(double-conversion)
+BuildRequires:  pkgconfig(liblz4)
+BuildRequires:  cli11-devel cli11-static
+BuildRequires:  cmake(pugixml)
+BuildRequires:  rapidjson-devel rapidjson-static
+BuildRequires:  robin-map-devel robin-map-static
+BuildRequires:  pkgconfig(libdeflate)
+# Unbundling this means we also use external versions of libaom and libyuv.
+BuildRequires:  pkgconfig(libavif)
+
+BuildRequires:  cmake(Imath) >= 3.0
+
+# Introduced by 0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch
+BuildRequires:  valgrind-devel
+
+%if %{with alembic}
+BuildRequires:  cmake(Alembic)
+%endif
+
+%if %{with draco}
+BuildRequires:  draco-devel
 %endif
 
-# For imaging and usd imaging
-%if %{with imaging}
 %if %{with embree}
 BuildRequires:  embree-devel
 %endif
+
+%if %{with jemalloc}
+BuildRequires:  pkgconfig(jemalloc)
+%endif
+
+%if %{with materialx}
+BuildRequires:  cmake(materialx)
+BuildRequires:  materialx-data
+BuildRequires:  pkgconfig(xt)
+BuildRequires:  python3-materialx
+%endif
+
+%if %{with ocio}
+BuildRequires:  cmake(OpenColorIO)
+%endif
+
+%if %{with oiio}
+BuildRequires:  cmake(OpenImageIO)
+%endif
+
 %if %{with openshading}
 BuildRequires:  openshadinglanguage
 BuildRequires:  pkgconfig(oslexec)
 %endif
-BuildRequires:  opensubdiv-devel
+
 %if %{with openvdb}
 BuildRequires:  openvdb-devel
 %endif
-BuildRequires:  pkgconfig(dri)
-%if %{with jemalloc}
-BuildRequires:  pkgconfig(jemalloc)
-%endif
-%if %{with ocio}
-# usd is not yet compatible with OpenColorIO 2 so use compat package.
-BuildRequires:  pkgconfig(OpenColorIO) < 2
-%endif
-%if %{with oiio}
-BuildRequires:  pkgconfig(OpenImageIO)
-%endif
-BuildRequires:  cmake(OpenEXR)
-BuildRequires:  cmake(Imath)
-BuildRequires:  pkgconfig(Ptex)
-%endif
-%if %{with alembic}
-BuildRequires:  cmake(Alembic)
-BuildRequires:  hdf5-devel
+
+%if %{with ptex}
+BuildRequires:  cmake(ptex)
 %endif
 
 # Header-only library: -static is for tracking per guidelines
-BuildRequires:  stb_image_resize-devel
-BuildRequires:  stb_image_resize-static
+#
+# Enforce the the minimum EVR to contain fixes for all of:
+# CVE-2021-28021
+# CVE-2021-42715
+# CVE-2021-42716
+# CVE-2022-28041
+# CVE-2023-43898
+# CVE-2023-45661
+# CVE-2023-45662
+# CVE-2023-45663
+# CVE-2023-45664
+# CVE-2023-45666
+# CVE-2023-45667
+# https://github.com/nothings/stb/issues/1860
+# https://github.com/nothings/stb/issues/1861
+BuildRequires:  stb_image-static >= 2.30^20251025gitf1c79c0-2
+BuildRequires:  stb_image_write-static >= 1.16
+BuildRequires:  stb_image_resize-static >= 0.97
 
-Requires:       %{name}-libs%{?_isa} = %{version}-%{release}
-%if %{with python3}
-Requires:       python3-%{name}%{?_isa} = %{version}-%{release}
-%endif
-
-# Upstream bundles
-# Filed ticket to convince upstream to use system libraries
-# https://github.com/PixarAnimationStudios/USD/issues/1490
-Provides:       bundled(double-conversion) = 2.0.0
-Provides:       bundled(ilmbase) = 2.5.3
-Provides:       bundled(lz4) = 1.9.2
-Provides:       bundled(pugixml) = 1.9
-Provides:       bundled(rapidjson) = 1.0.2
-Provides:       bundled(SPIRV-Reflect) = 1.0
-Provides:       bundled(VulkanMemoryAllocator) = 3.0.0~development
-# Both of these are packaged in Fedora, but USD uses patched versions, so they
-# must be bundled.
-Provides:       bundled(stb_image) = 2.19
-Provides:       bundled(stb_image_write) = 1.09
+Requires:       usd-libs%{?_isa} = %{version}-%{release}
+Requires:       python3-usd%{?_isa} = %{version}-%{release}
 
 # This package is only available for x86_64 and aarch64
 # Will fail to build on other architectures
 # https://bugzilla.redhat.com/show_bug.cgi?id=1960848
-ExclusiveArch:  aarch64 x86_64
+#
+# Note that pxr/base/arch/assumptions.cpp explicitly tests the machine is not
+# big-endian, and pxr/base/arch/defines.h explicitly enforces x86_64 or ARM64.
+ExclusiveArch:  %{arm64} %{x86_64}
 
 %description
 Universal Scene Description (USD) is a time-sampled scene
@@ -133,6 +279,130 @@ description for interchange between graphics applications.
 %package        libs
 Summary:        Universal Scene Description library
 
+# Filed ticket to convince upstream to use system libraries
+#   Use system libraries instead of bundling them when possible
+#   https://github.com/PixarAnimationStudios/USD/issues/1490
+# See also:
+#   Path to using external/system copies of OpenEXRCore and libdeflate?
+#   https://github.com/PixarAnimationStudios/OpenUSD/issues/2619
+# Version from: pxr/base/gf/ilmbase_half.README
+#
+# This is difficult to unbundle even in the manner of double-conversion: code
+# that uses the half type is compatible with ilmbase version 2 (as packaged in
+# openexr2) rather than version 3 (as packaged in the ilmbase package).
+# Unfortunately, we need cmake(Imath) elsewhere in the package, and this comes
+# from the imath package (version 3), which conflicts with the imath version 2
+# libraries included with openexr2. So this will not be possible until the
+# surrounding code is patched (upstream or downstream) for compatibility with
+# ilmbase version 3, something we’re currently not willing to attempt.
+Provides:       bundled(ilmbase) = 2.5.3
+# Version from: pxr/base/pegtl/pegtl/version.hpp
+# Currently, Fedora’s PEGTL is too old:
+# https://bugzilla.redhat.com/show_bug.cgi?id=1902427
+Provides:       bundled(PEGTL) = 3.2.7
+# Version from
+# pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/openexr_version.h
+# From pxr/imaging/plugin/hioOpenEXR/OpenEXR/README.md:
+#   A few changes are still in progress to upstreamed to the OpenEXR project,
+#   but these are minor, and otherwise, almost all differences between the
+#   interred OpenEXRCore and the official OpenEXR repo are consolidated to the
+#   openexr_conf.h header. The remaining differences are removing an extern
+#   marking from the few global data tables.
+# This suggests that it may not be entirely safe to unbundle this.
+Provides:       bundled(openexr) = 3.2.0
+# Version from the message for the commit
+# e7a8d718c7c113e1c653ee31dc52421f17e09b42 that introduced pxr/external/boost/:
+#
+#   python: Initial import of boost::python from boost 1.85.0
+#   This change just brings boost::python into the tree as a starting point for
+#   the pxr_boost::python implementation. The src/ and test/ directories are
+#   placed next to the public headers since we don't have separate
+#   public/private directory hierarchies like boost, but the code itself is
+#   unchanged and not included in the build.
+#
+#   We use boost 1.85.0 as the starting point even though we're currently on
+#   VFX Reference Platform 2022, which specifies boost 1.76.0. This is because
+#   later versions of boost are needed for other platforms and versions of
+#   Python that OpenUSD supports. For example Python 3.11 requires boost
+#   1.82.0+.
+#
+# This is not a candidate for unbundling because upstream has explicitly forked
+# boost::python and modified it to work without the rest of Boost as part of an
+# effort to remove the Boost dependency. While pxr_boost::python is derived
+# from boost::python, it is not intended to remain compatible with it.
+Provides:       bundled(boost) = 1.85.0
+# From LICENSE.txt:
+# ===========================================================
+# PBRT (Sampling functions)
+# ============================================================
+# USD includes code derived from the pbrt-v4 library, retrieved from
+# https://github.com/mmp/pbrt-v4/tree/8c19f304558fd7681e2fef2c395a689d0106fb05, which was
+# provided subject to the unmodified Apache 2.0 license. For details, see
+# https://github.com/mmp/pbrt-v4/blob/8c19f304558fd7681e2fef2c395a689d0106fb05/LICENSE.txt
+#
+# The bundled routines in pxr/imaging/plugin/hdEmbree/pxrPbrt/pbrtUtils.h are
+# just a handful of small internal utility functions. It would not be
+# reasonable to add a dependency on the full pbrt ray tracer even if these were
+# exposed in a public API.
+Provides:       bundled(pbrt-v4) = 4~20251208.8c19f30
+# From LICENSE.txt:
+# ============================================================
+# Cycles (IES reader)
+# ============================================================
+# USD includes classes from the Blender Foundation's Cycles project, retrieved from
+# https://projects.blender.org/blender/cycles/src/commit/0be21d452506ec90259b9063c28b5a6fc1cac6a1,
+# which was provided subject to the unmodified Apache 2.0 license. For details, see
+# https://projects.blender.org/blender/cycles/src/commit/0be21d452506ec90259b9063c28b5a6fc1cac6a1/LICENSE
+#
+# These are not a candidate for unbundling because they are internal utility
+# functions not available in the public API. There are also some minor
+# modifications for OpenUSD, documented in
+# pxr/imaging/plugin/hdEmbree/pxrIES/pxr-IES.patch.
+#
+# Is this commit a post-release snapshot of 4.5.0, or a pre-release snapshot of
+# 5.0.0? How can we tell? There doesn’t seem to be a project version number
+# embedded in the source tree. Since this commit hash is only two commits ahead
+# of the v4.5.0 tag, we consider it a 4.5.0 post-release.
+Provides:       bundled(cycles) = 4.5.0^20251210.0be21d4
+
+# We are currently able to unbundle these and use system libraries, but we
+# retain the virtual Provides, commented out, as documentation and in case we
+# ever have to switch back to the bundled versions.
+#
+# Version from: pxr/base/tf/pxrDoubleConversion/README
+# Provides:       bundled(double-conversion) = 3.3.0
+# Version from: pxr/base/tf/pxrLZ4/lz4.h (LZ4_VERSION_{MAJOR,MINOR_PATCH})
+# Provides:       bundled(lz4) = 1.9.2
+# Version from: pxr/base/tf/pxrCLI11/README.md
+# Provides:       bundled(cli11) = 2.3.1
+# Version from:
+# third_party/renderman/plugin/rmanArgsParser/pugixml/pugiconfig.hpp
+# (header comment)
+# Provides:       bundled(pugixml) = 1.9
+# Version from: pxr/base/js/rapidjson/rapidjson.h
+# (RAPIDJSON_{MAJOR,MINOR,PATCH}_VERSION)
+# Provides:       bundled(rapidjson) = 1.1.0
+# Version from: pxr/base/tf/pxrTslRobinMap/robin_growth_policy.h
+# (PXR_TSL_RH_VERSION_{MAJOR,MINOR,PATCH})
+# Provides:       bundled(robin-map) = 1.3.0
+# Version from pxr/imaging/plugin/hioOpenEXR/OpenEXR/deflate/libdeflate.h
+# Provides:       bundled(libdeflate) = 1.18
+# Version from pxr/imaging/plugin/hioAvif/AVIF/src/avif/avif.h
+#   We actually have a post-release snapshot of libavif, because
+#   AVIF_VERSION_DEVEL is nonzero, but it’s not easy to determine which commit
+#   hash it was copied from.
+# Provides:       bundled(libavif) = 1.0.1
+# Version from pxr/imaging/plugin/hioAvif/AVIF/src/src-libyuv/libyuv/version.h
+# LIBYUV_VERSION is a “serial number” version, e.g. 1895, that gets incremented
+# every time changes are dumped into git from an internal VCS; the libyuv
+# package in Fedora is considered to have version 0 and uses snapshot
+# versioning. We can dig through
+# https://chromium.googlesource.com/libyuv/libyuv and find the commit hash that
+# corresponds to a particular serial number.
+# LIBYUV_VERSION 1895 = commit a97746349b244efd54ab1eb0c0a7366717b33f39
+# Provides:       bundled(libyuv) = 0^20240812.a977463
+# Version from pxr/imaging/plugin/hioAvif/config/aom_version.h
+# Provides:       bundled(aom) = 3.0.0
 
 %description libs
 Universal Scene Description (USD) is an efficient, scalable system for
@@ -141,57 +411,59 @@ interchange between graphics applications.
 
 %package        devel
 Summary:        Development files for USD
-Requires:       cmake-filesystem
-Requires:       %{name}-libs%{?_isa} = %{version}-%{release}
+Requires:       usd-libs%{?_isa} = %{version}-%{release}
+
+# Unbundled, and exposed in the API:
+Requires:       cli11-devel cli11-static
+Requires:       robin-map-devel robin-map-static
+# Needed by cmake config
+Requires:       cmake(OpenSubdiv)
+%if %{with materialx}
+Requires:       cmake(materialx)
+%endif
 
 %description devel
 This package contains the C++ header files and symbolic links to the shared
-libraries for %{name}. If you would like to develop programs using %{name},
-you will need to install %{name}-devel.
+libraries for usd. If you would like to develop programs using usd,
+you will need to install usd-devel.
 
-# For usdview
-%if %{with python3}
-%package -n python3-%{name}
+# For usdview, usdcompress
+%package -n python3-usd
 Summary: %{summary}
 
-BuildRequires:  desktop-file-utils
 BuildRequires:  pkgconfig(python3)
-BuildRequires:  pkgconfig(Qt5)
 BuildRequires:  python3dist(jinja2)
-BuildRequires:  python3dist(pyside2)
+%if %{with usdview}
+BuildRequires:  desktop-file-utils
+BuildRequires:  python3dist(pyside6)
+BuildRequires:  pyside6-tools
 BuildRequires:  python3dist(pyopengl)
+%endif
 Requires:       font(roboto)
 Requires:       font(robotoblack)
 Requires:       font(robotolight)
 Requires:       font(robotomono)
 Requires:       python3dist(jinja2)
-Requires:       python3dist(pyside2)
+%if %{with usdview}
+Requires:       python3dist(pyside6)
 Requires:       python3dist(pyopengl)
+%endif
+
+Requires:       usd-libs%{?_isa} = %{version}-%{release}
+
 %py_provides    python3-pxr
 
-%description -n python3-%{name}
+%description -n python3-usd
 Python language bindings for the Universal Scene Description (USD) C++ API
-%endif
-
-%if %{with documentation}
-%package        doc
-Summary:        Documentation for usd
-BuildArch:      noarch
-
-%description doc
-Documentation for the Universal Scene Description (USD) C++ API
-%endif
 
 %prep
-%autosetup -p1 -n %{srcname}-%{version}
+%autosetup -p1 -n OpenUSD-%{version}
 
 # Convert NOTICE.txt from CRNL line encoding
 dos2unix NOTICE.txt
 
-%if %{with python3}
 # Fix all Python shebangs recursively in .
 %py3_shebang_fix .
-%endif
 
 # Further drop shebangs line for some py files
 sed -r -i '1{/^#!/d}' \
@@ -205,94 +477,174 @@ ln -s %{_datadir}/fonts/google-roboto pxr/usdImaging/usdviewq/fonts/Roboto
 ln -s %{_datadir}/fonts/google-roboto-mono \
     pxr/usdImaging/usdviewq/fonts/Roboto_Mono
 
-# Unbundle stb_image_resize:
-ln -svf %{_includedir}/stb_image_resize.h pxr/imaging/hio/stb/
+# Unbundle stb_image, stb_image_write, stb_image_resize:
+pushd pxr/imaging/hio/stb
+cp -p %{_usr}/include/stb_image.h .
+patch -p1 < stb_image.patch
+ln -svf %{_usr}/include/stb_image_resize.h \
+    %{_usr}/include/stb_image_write.h ./
+popd
+
+# Remove bundled doxygen-awesome-css (CSS and JS files) since we are not
+# building Doxygen-generated HTML documentation.
+rm -rf docs/doxygen/doxygen-awesome-css/
+
+# Remove the bundled copy of double-conversion.
+#
+# From pxr/base/tf/pxrDoubleConversion/README, the upstream double-conversion
+# is patched with pxr/base/tf/pxrDoubleConversion/pxr-double-conversion.patch;
+# examination of that patch shows that it merely adds namespaces and renames
+# symbols, rather than making functional changes, so using the system library
+# should be safe.
+find pxr/base/tf/pxrDoubleConversion -type f ! -name '*.h' -print -delete
+for hdr in pxr/base/tf/pxrDoubleConversion/*.h
+do
+  cat > "${hdr}" <<EOF
+#include <double-conversion/$(basename "${hdr}")>
+namespace pxr_double_conversion = double_conversion;
+EOF
+done
+# Similarly, remove the bundled copy of lz4. Change in the bundled copy can be
+# identified by source-code comments, and appear to be limited to adding
+# namespaces and removing C linkage.
+rm -v pxr/base/tf/pxrLZ4/*
+cat > pxr/base/tf/pxrLZ4/lz4.h <<'EOF'
+#include <lz4.h>
+// System LZ4 has C linkage; this just allows "using namespace"
+namespace pxr_lz4 {}
+EOF
+# Remove the bundled copy of cli11.
+rm -v pxr/base/tf/pxrCLI11/*
+cat > pxr/base/tf/pxrCLI11/CLI11.h <<'EOF'
+#include <CLI/CLI.hpp>
+namespace pxr_CLI = CLI;
+EOF
+# Remove the bundled copy of pugixml.
+find third_party/renderman/plugin/rmanArgsParser/pugixml/ \
+    -type f ! -name '*.hpp' -print -delete
+for hdr in third_party/renderman/plugin/rmanArgsParser/pugixml/*.hpp
+do
+  cat > "${hdr}" <<EOF
+#include <$(basename "${hdr}")>
+EOF
+done
+# Remove the bundled copy of rapidjson. It does not seem to have been modified
+# or forked at all.
+rm -rv pxr/base/js/rapidjson/
+# Remove the bundled copy of robin-map. There are several macros that are
+# renamed from TSL_*/tsl_* to PXR_TSL_*/pxr_tsl_* in the bundled copy, and we
+# could “alias” these if necessary to avoid patching call sites, but for now
+# are not used outside the library headers and we can get by with merely
+# aliasing the namespace.
+find pxr/base/tf/pxrTslRobinMap -type f ! -name '*.h' -print -delete
+for hdr in pxr/base/tf/pxrTslRobinMap/*.h
+do
+  cat > "${hdr}" <<EOF
+#include <tsl/$(basename "${hdr}")>
+namespace pxr_tsl = tsl;
+EOF
+done
+# Remove the bundled copy of libdeflate.
+rm -rv pxr/imaging/plugin/hioOpenEXR/OpenEXR/deflate/
+# Remove the bundled copies of libavif, along with the associated libaom and
+# the libyuv that is in the libavif sources.
+rm -rv pxr/imaging/plugin/hioAvif/aom/ \
+    pxr/imaging/plugin/hioAvif/AVIF/
 
 # Use c++17 standard otherwise build fails
 sed -i 's|set(CMAKE_CXX_STANDARD 14)|set(CMAKE_CXX_STANDARD 17)|g' \
         cmake/defaults/CXXDefaults.cmake
 
 # Fix libdir installation
-sed -i 's|lib/usd|%{_libdir}/usd|g' cmake/macros/Private.cmake
-sed -i 's|"lib"|%{_libdir}|g' cmake/macros/Private.cmake
+sed -i 's|lib/usd|%{_libdir}/usd|g' \
+        cmake/macros/{Private,Public}.cmake
 sed -i 's|plugin/usd|%{_libdir}/usd/plugin|g' \
-        cmake/macros/Private.cmake
+        cmake/macros/{Private,Public}.cmake
+sed -i 's|"lib"|%{_libdir}|g' \
+        cmake/macros/{Private,Public}.cmake
 sed -i 's|/python|/python%{python3_version}/site-packages|g' \
-        cmake/macros/Private.cmake
-sed -i 's|lib/usd|%{_libdir}/usd|g' cmake/macros/Public.cmake
-sed -i 's|"lib"|%{_libdir}|g' cmake/macros/Public.cmake
-sed -i 's|plugin/usd|%{_libdir}/usd/plugin|g' \
-        cmake/macros/Public.cmake
+        cmake/macros/{Private,Public}.cmake pxr/usdImaging/usdviewq/CMakeLists.txt
+sed -i 's|/pxrConfig.cmake|%{_libdir}/cmake/pxr/pxrConfig.cmake|g' \
+        pxr/CMakeLists.txt
+sed -i 's|"cmake"|"%{_libdir}/cmake/pxr"|g' \
+        pxr/CMakeLists.txt
+sed -i 's|${PXR_CMAKE_DIR}/cmake|${PXR_CMAKE_DIR}|g' \
+        pxr/pxrConfig.cmake.in
+sed -i 's|${PXR_CMAKE_DIR}/include|/usr/include|g' \
+        pxr/pxrConfig.cmake.in
+sed -i 's|EXACT COMPONENTS|COMPONENTS|g' \
+        pxr/pxrConfig.cmake.in
 
 # Fix cmake directory destination
 sed -i 's|"${CMAKE_INSTALL_PREFIX}"|%{_libdir}/cmake/pxr|g' pxr/CMakeLists.txt
 
+# Use Embree4 instead of Embree3. The find-then-modify pattern preserves mtimes
+# on sources that did not need to be modified.
+find . -type f -exec gawk '/embree3/ { print FILENAME }' '{}' '+' |
+  xargs -r sed -r -i 's/(embree)3/\14/'
+
 
 %build
-# Fix uic-qt5 use
-cat > uic-wrapper <<'EOF'
-#!/bin/sh
-exec uic-qt5 -g python "$@"
-EOF
-chmod +x uic-wrapper
+# The necessary include path for Imath is not set everywhere it’s needed. It’s
+# not immediately clear exactly why this is happening here or what should be
+# changed upstream.
+extra_flags="${extra_flags-} $(pkgconf --cflags Imath)"
 
-# Fix python3 support
-# https://github.com/PixarAnimationStudios/USD/issues/1419
-
-flags="%{optflags} -Wl,--as-needed -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1" \
-# Patch2 was not good enough to get the include path for Imath everywhere it
-# was needed. Add it globally.
-# https://github.com/PixarAnimationStudios/USD/issues/1591
-flags="${flags} $(pkgconf --cflags Imath)"
+# Suppress deprecation warnings from TBB; upstream should act on them
+# eventually, but they just add noise here.
+extra_flags="${extra_flags-} -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1"
 
 %cmake \
-     -DCMAKE_CXX_FLAGS_RELEASE="${flags}" \
-     -DCMAKE_C_FLAGS_RELEASE="${flags}" \
-     -DCMAKE_CXX_STANDARD=17 \
-     -DCMAKE_EXE_LINKER_FLAGS="-pie" \
-     -DCMAKE_SKIP_RPATH=ON \
-     -DCMAKE_SKIP_INSTALL_RPATH=ON \
-     -DCMAKE_VERBOSE_MAKEFILE=ON \
-     -DPXR_BUILD_USDVIEW=ON \
-%if %{with documentation}
-     -DPXR_BUILD_DOCUMENTATION=TRUE \
+%if %{with ninja}
+     -GNinja \
 %endif
-     -DPXR_BUILD_EXAMPLES=OFF \
-     -DPXR_BUILD_TUTORIALS=OFF \
-     -DPXR_BUILD_TESTS=%{?with_test:ON}%{!?with_test:OFF} \
-%if %{with openvdb}
-     -DPXR_ENABLE_OPENVDB_SUPPORT=ON \
-%endif
-     -DPXR_INSTALL_LOCATION="%{_libdir}/%{name}/plugin" \
 %if %{with jemalloc}
      -DPXR_MALLOC_LIBRARY="%{_libdir}/libjemalloc.so" \
 %endif
-%if %{with alembic}
-     -DOPENEXR_LOCATION=%{_includedir} \
-     -DPXR_BUILD_ALEMBIC_PLUGIN=ON \
-%endif
-%if %{with embree}
-     -DPXR_BUILD_EMBREE_PLUGIN=ON \
-     -DEMBREE_LOCATION=%{_prefix} \
-%endif
-%if %{with ocio}
-     -DPXR_BUILD_OPENCOLORIO_PLUGIN=ON \
-%endif
-%if %{with oiio}
-     -DPXR_BUILD_OPENIMAGEIO_PLUGIN=ON \
-%endif
-%if %{with openshading}
-     -DPXR_ENABLE_OSL_SUPPORT=ON \
-%endif
-     -DPYTHON_EXECUTABLE=%{python3} \
-%if %{with python3}
-     -DPXR_USE_PYTHON_3=ON \
+     \
+     -DCMAKE_CXX_FLAGS_RELEASE="${CXXFLAGS-} ${extra_flags}" \
+     -DCMAKE_CXX_STANDARD=17 \
+     -DCMAKE_C_FLAGS_RELEASE="${CFLAGS-} ${extra_flags}" \
+     -DCMAKE_EXE_LINKER_FLAGS="${LDFLAGS}" \
+     -DCMAKE_SHARED_LINKER_FLAGS="${LDFLAGS}" \
+     -DCMAKE_SKIP_INSTALL_RPATH=ON \
+     -DCMAKE_SKIP_RPATH=ON \
+     -DCMAKE_VERBOSE_MAKEFILE=ON \
+     \
+     -DPXR_BUILD_HTML_DOCUMENTATION=FALSE \
+     -DPXR_BUILD_PYTHON_DOCUMENTATION=FALSE \
+     -DPXR_BUILD_EXAMPLES=OFF \
+     -DPXR_BUILD_IMAGING=ON \
+     -DPXR_BUILD_MONOLITHIC=ON \
+     -DPXR_BUILD_TESTS=%{expr:%{with test}?"ON":"OFF"} \
+     -DPXR_BUILD_TUTORIALS=OFF \
+     -DPXR_BUILD_USD_IMAGING=ON \
+     -DPXR_BUILD_EXEC=ON \
+     -DPXR_BUILD_USD_TOOLS=ON \
+     -DPXR_BUILD_USDVIEW=%{expr:%{with usdview}?"ON":"OFF"} \
+     \
+     -DPXR_BUILD_ALEMBIC_PLUGIN=%{expr:%{with alembic}?"ON":"OFF"} \
+     -DPXR_BUILD_DRACO_PLUGIN=%{expr:%{with draco}?"ON":"OFF"} \
+     -DPXR_BUILD_EMBREE_PLUGIN=%{expr:%{with embree}?"ON":"OFF"} \
+     -DPXR_BUILD_OPENCOLORIO_PLUGIN=%{expr:%{with ocio}?"ON":"OFF"} \
+     -DPXR_BUILD_OPENIMAGEIO_PLUGIN=%{expr:%{with oiio}?"ON":"OFF"} \
+     -DPXR_BUILD_PRMAN_PLUGIN=OFF \
+     \
+     -DPXR_ENABLE_OPENVDB_SUPPORT=%{expr:%{with openvdb}?"ON":"OFF"} \
+     -DPXR_ENABLE_HDF5_SUPPORT=ON \
+     -DPXR_ENABLE_PTEX_SUPPORT=%{expr:%{with ptex}?"ON":"OFF"} \
+     -DPXR_ENABLE_OSL_SUPPORT=%{expr:%{with openshading}?"ON":"OFF"} \
+     -DPXR_ENABLE_MALLOCHOOK_SUPPORT=OFF \
+     -DPXR_ENABLE_MATERIALX_SUPPORT=%{expr:%{with materialx}?"ON":"OFF"} \
+     -DPXR_ENABLE_PYTHON_SUPPORT=ON \
+     \
+     -DPXR_INSTALL_LOCATION="%{_libdir}/usd/plugin" \
+     \
+     -DPXR_VALIDATE_GENERATED_CODE=OFF \
+     \
+     -DPYSIDEUICBINARY:PATH=pyside6-uic \
      -DPYSIDE_AVAILABLE=ON \
-     -DPYSIDEUICBINARY:PATH=${PWD}/uic-wrapper \
-%else
-     -DPXR_ENABLE_PYTHON_SUPPORT=OFF \
-%endif
-     -DPXR_BUILD_MONOLITHIC=ON
+     -DPYTHON_EXECUTABLE=%{python3}
 %cmake_build
 
 %install
@@ -302,56 +654,135 @@ flags="${flags} $(pkgconf --cflags Imath)"
 mkdir -p %{buildroot}%{python3_sitearch}
 mv %{buildroot}%{python3_sitelib}/* %{buildroot}%{python3_sitearch}
 
+# Upstream may expect to use this as a script in development, but we install it
+# without executable permissions, so we remove the shebang.
+sed -r -i '1{/^#!/d}' '%{buildroot}%{python3_sitearch}/pxr/Usd/usdGenSchema.py'
+
+%if %{with usdview}
 # Install a desktop icon for usdview
 desktop-file-install                                    \
 --dir=%{buildroot}%{_datadir}/applications              \
 %{SOURCE1}
+%endif
 
-# Remove arch-specific code in /usr/share
-find %{buildroot}%{_datadir}/%{name}/examples -name '*.so' -print -delete
+# Little hack until this issue is resolved
+# https://github.com/PixarAnimationStudios/OpenUSD/issues/3310
+sed -i 's|OpenGL::GL|${OPENGL_gl_LIBRARY}|g' \
+        %{buildroot}%{_libdir}/cmake/pxr/pxrTargets.cmake
 
-# Fix installation path for some files
-mv %{buildroot}%{_prefix}/lib/python/pxr/*.* \
-        %{buildroot}%{python3_sitearch}/pxr/
-mv %{buildroot}%{_prefix}/lib/python/pxr/Usdviewq/* \
-        %{buildroot}%{python3_sitearch}/pxr/Usdviewq/
+# Remove examples that were built and installed even though we set
+# -DPXR_BUILD_EXAMPLES=OFF.
+rm -vrf '%{buildroot}%{_datadir}/usd/examples'
+
+# Generate and install man pages. While generating the man pages might more
+# properly go in %%build, it is generally much easier to do this here in a
+# single step, using the entry points installed into the buildroot. This is
+# especially true for the entry points that are Python scripts.
+install -d '%{buildroot}%{_mandir}/man1'
+for cmd in %{buildroot}%{_bindir}/*
+do
+  PYTHONPATH='%{buildroot}%{python3_sitearch}' \
+  LD_LIBRARY_PATH='%{buildroot}%{_libdir}' \
+      help2man \
+      --no-info --no-discard-stderr --version-string='%{version}' \
+      --output="%{buildroot}%{_mandir}/man1/$(basename "${cmd}").1" \
+      "${cmd}"
+done
 
 %check
-desktop-file-validate %{buildroot}%{_datadir}/applications/org.open%{name}.%{name}view.desktop
+%if %{with usdview}
+desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.desktop
+%endif
 %{?with_test:%ctest}
 
 %files
 %doc NOTICE.txt README.md
-%{_bindir}/*
-%dir %{_datadir}/%{name}
-%dir %{_datadir}/%{name}/examples/
-%{_datadir}/%{name}/examples/*
 
-%if %{with python3}
-%files -n python3-%{name}
-%{_datadir}/applications/org.open%{name}.%{name}view.desktop
-%{python3_sitearch}/pxr
+%{_bindir}/hdGenSchema
+%{_bindir}/sdfdump
+%{_bindir}/sdffilter
+%if %{with materialx}
+%{_bindir}/usdBakeMaterialX
 %endif
+%{_bindir}/usdGenSchema
+%{_bindir}/usdInitSchema
+%{_bindir}/usdcat
+%{_bindir}/usdchecker
+%if %{with draco}
+%{_bindir}/usdcompress
+%endif
+%{_bindir}/usddiff
+%{_bindir}/usddumpcrate
+%{_bindir}/usdedit
+%{_bindir}/usdfixbrokenpixarschemas
+%{_bindir}/usdgenschemafromsdr
+%{_bindir}/usdmeasureperformance
+%{_bindir}/usdrecord
+%{_bindir}/usdresolve
+%{_bindir}/usdstitch
+%{_bindir}/usdstitchclips
+%{_bindir}/usdtree
+%{_bindir}/usdupdatecrate
+%{_bindir}/usdzip
+%if %{with usdview}
+%{_datadir}/applications/org.openusd.usdview.desktop
+%{_bindir}/testusdview
+%{_bindir}/usdview
+%endif
+
+%{_mandir}/man1/hdGenSchema.1*
+%{_mandir}/man1/sdfdump.1*
+%{_mandir}/man1/sdffilter.1*
+%if %{with materialx}
+%{_mandir}/man1/usdBakeMaterialX.1*
+%endif
+%{_mandir}/man1/usdGenSchema.1*
+%{_mandir}/man1/usdInitSchema.1*
+%{_mandir}/man1/usdcat.1*
+%{_mandir}/man1/usdchecker.1*
+%if %{with draco}
+%{_mandir}/man1/usdcompress.1*
+%endif
+%{_mandir}/man1/usddiff.1*
+%{_mandir}/man1/usddumpcrate.1*
+%{_mandir}/man1/usdedit.1*
+%{_mandir}/man1/usdfixbrokenpixarschemas.1*
+%{_mandir}/man1/usdgenschemafromsdr.1*
+%{_mandir}/man1/usdmeasureperformance.1*
+%{_mandir}/man1/usdrecord.1*
+%{_mandir}/man1/usdresolve.1*
+%{_mandir}/man1/usdstitch.1*
+%{_mandir}/man1/usdstitchclips.1*
+%{_mandir}/man1/usdtree.1*
+%{_mandir}/man1/usdupdatecrate.1*
+%{_mandir}/man1/usdzip.1*
+%if %{with usdview}
+%{_mandir}/man1/testusdview.1*
+%{_mandir}/man1/usdview.1*
+%endif
+
+%files -n python3-usd
+%{python3_sitearch}/pxr/
 
 %files libs
 %license LICENSE.txt
 %doc NOTICE.txt README.md
-%{_libdir}/lib%{name}_ms.so.%{libmajor}
-%{_libdir}/%{name}
-%exclude %{_libdir}/%{name}/%{name}/resources/codegenTemplates
+%{_libdir}/libusd_ms.so.%{downstream_so_version}
+# While headers normally go in -devel packages, those in
+# %%{_libdir}/usd/usd/resources/codegenTemplates/ are used as data (templates
+# for generated code), and it makes sense to package them with the rest of the
+# library resources. (Technically, these are currently used only by the
+# usdGenSchema command-line tool, so they could be moved to the base package,
+# but this is probably too fussy.)
+%{_libdir}/usd/
 
 %files devel
 %doc BUILDING.md CHANGELOG.md VERSIONS.md
 %{_includedir}/pxr/
-%{_libdir}/cmake/*
-%{_libdir}/lib%{name}_ms.so
-%{_libdir}/%{name}/%{name}/resources/codegenTemplates/
-
-%if %{with documentation}
-%files doc
-%license LICENSE.txt
-%{_docdir}/%{name}
-%endif
+%{_libdir}/libusd_ms.so
+%{_libdir}/cmake/pxr/pxrConfig.cmake
+%{_libdir}/cmake/pxr/pxrTargets.cmake
+%{_libdir}/cmake/pxr/pxrTargets-release.cmake
 
 %changelog
 %autochangelog