Patch for Python 3.15 (fix RHBZ#2433881)

- Fixes CVE-2026-34378 / GHSA-v76p-4qvv-vh4g; closes RHBZ#2455493
- Fixes CVE-2026-34380 / GHSA-q3v8-hw4m-59w5; closes RHBZ#2455534
- Fixes CVE-2026-34588 / GHSA-588r-cr5c-w6hf; closes RHBZ#2455505
- Fixes CVE-2026-34589 / GHSA-p8xc-w3q4-h64x; closes RHBZ#2455501
- Fixes CVE-2026-34379 / GHSA-w88v-vqhq-5p24; closes RHBZ#2455497

.gitignore

@@ -11,3 +11,16 @@
 /usd-23.05.tar.gz
 /OpenUSD-23.08.tar.gz
 /OpenUSD-23.11.tar.gz
+/OpenUSD-24.03.tar.gz
+/OpenUSD-24.05.tar.gz
+/OpenUSD-24.08.tar.gz
+/OpenUSD-24.11.tar.gz
+/OpenUSD-25.02.tar.gz
+/OpenUSD-25.02a.tar.gz
+/OpenUSD-25.05.tar.gz
+/OpenUSD-25.05.01.tar.gz
+/OpenUSD-25.08.tar.gz
+/OpenUSD-25.11.tar.gz
+/OpenUSD-26.03.tar.gz
+/OpenUSD-26.05.tar.gz
+/OpenUSD-26.08.tar.gz

0001-Downstream-only-add-an-SONAME-version.patch

@@ -1,4 +1,4 @@
-From 7bb13a999b2d3afe13ddad0a7bd8da1e4f99ff09 Mon Sep 17 00:00:00 2001
+From ee4e9b30e14133e35c23821d3dc7aa93df354a38 Mon Sep 17 00:00:00 2001
 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
 Date: Fri, 27 Oct 2023 12:56:58 -0400
 Subject: [PATCH] Downstream-only: add an SONAME version
@@ -33,15 +33,15 @@ built with -DPXR_BUILD_EXAMPLES=OFF, but it is.)
 ---
  cmake/defaults/Version.cmake | 6 ++++++
  cmake/macros/Private.cmake   | 1 +
- cmake/macros/Public.cmake    | 1 +
- 3 files changed, 8 insertions(+)
+ cmake/macros/Public.cmake    | 2 ++
+ 3 files changed, 9 insertions(+)
 
 diff --git a/cmake/defaults/Version.cmake b/cmake/defaults/Version.cmake
-index 1406ac2a9..197377ff2 100644
+index c31b5e8d9..fabb45397 100644
 --- a/cmake/defaults/Version.cmake
 +++ b/cmake/defaults/Version.cmake
-@@ -27,3 +27,9 @@ set(PXR_MINOR_VERSION "23")
- set(PXR_PATCH_VERSION "11") # NOTE: Must not have leading 0 for single digits
+@@ -10,3 +10,9 @@ set(PXR_MINOR_VERSION "26")
+ set(PXR_PATCH_VERSION "8") # NOTE: Must not have leading 0 for single digits
  
  math(EXPR PXR_VERSION "${PXR_MAJOR_VERSION} * 10000 + ${PXR_MINOR_VERSION} * 100 + ${PXR_PATCH_VERSION}")
 +
@@ -51,29 +51,37 @@ index 1406ac2a9..197377ff2 100644
 +    "Downstream shared object version"
 +)
 diff --git a/cmake/macros/Private.cmake b/cmake/macros/Private.cmake
-index 21606d4d6..4cf8aeeb6 100644
+index cddb4e095..5e4b4603a 100644
 --- a/cmake/macros/Private.cmake
 +++ b/cmake/macros/Private.cmake
-@@ -1299,6 +1299,7 @@ function(_pxr_library NAME)
+@@ -1355,6 +1355,7 @@ function(_pxr_library NAME)
+             FOLDER "${folder}"
+             POSITION_INDEPENDENT_CODE ON
              IMPORT_PREFIX "${args_PREFIX}"            
++            SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
              PREFIX "${args_PREFIX}"
              SUFFIX "${args_SUFFIX}"
-+	    SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
      )
- 
-     target_compile_definitions(${NAME}
 diff --git a/cmake/macros/Public.cmake b/cmake/macros/Public.cmake
-index 2080d7a36..2642b603f 100644
+index 5f6a5456b..553b645ec 100644
 --- a/cmake/macros/Public.cmake
 +++ b/cmake/macros/Public.cmake
-@@ -1007,6 +1007,7 @@ function(pxr_toplevel_prologue)
-                     FOLDER "${folder}"
+@@ -415,6 +415,7 @@ function(pxr_library NAME)
+         TYPE "${args_TYPE}"
+         PREFIX "${prefix}"
+         SUFFIX "${suffix}"
++        SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
+         SUBDIR "${subdir}"
+         CPPFILES "${args_CPPFILES};${${NAME}_CPPFILES}"
+         PUBLIC_HEADERS "${args_PUBLIC_HEADERS};${${NAME}_PUBLIC_HEADERS}"
+@@ -1213,6 +1214,7 @@ function(pxr_toplevel_prologue)
                      PREFIX "${libPrefix}"
                      IMPORT_PREFIX "${libPrefix}"
-+		    SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
+                     OUTPUT_NAME ${libName}
++                    SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
              )
              _get_install_dir("lib" libInstallPrefix)
              install(
 -- 
-2.41.0
+2.55.0
 

0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch

@@ -0,0 +1,65 @@
+From 817e23674f1b4ba62481c4e9794f0665a44d83f8 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Fri, 1 Aug 2025 08:47:41 -0400
+Subject: [PATCH] Downstream-only: use Valgrind macro instead of inline
+ assembly
+
+Upstream already has a plan to make this change, but is waiting to be
+able to add a build dependency on valgrind-devel. We have no such
+obstacle, and this change fixes the inline assembly failing to compile
+on aarch64.
+---
+ pxr/exec/vdf/executorDataVector.cpp | 28 +++-------------------------
+ 1 file changed, 3 insertions(+), 25 deletions(-)
+
+diff --git a/pxr/exec/vdf/executorDataVector.cpp b/pxr/exec/vdf/executorDataVector.cpp
+index 96dacca06..7e5625678 100644
+--- a/pxr/exec/vdf/executorDataVector.cpp
++++ b/pxr/exec/vdf/executorDataVector.cpp
+@@ -11,40 +11,18 @@
+ #include "pxr/base/tf/stl.h"
+ #include "pxr/base/trace/trace.h"
+ 
++#include <valgrind/memcheck.h>
++
+ PXR_NAMESPACE_OPEN_SCOPE
+ 
+ 
+ /// Issue a magic instruction sequence which Valgrind will intercept and mark
+ /// the specified memory defined for memcheck.
+ ///
+-/// XXX: We should replace this with the VALGRIND_MAKE_MEM_DEFINED macro
+-///      from memcheck.h, once we can establish a build dependency on
+-///      valgrind-devel.
+-///
+ static inline void
+ Vdf_ExecutorDataVector_ValgrindMakeDefined(void *ptr, size_t size)
+ {
+-#if defined(ARCH_OS_LINUX) && defined(ARCH_CPU_INTEL)
+-    // Pass a result and a pointer to some arguments via registers
+-    volatile unsigned long long int result;
+-    volatile unsigned long long int args[6] = {
+-        0x4D430002,                  // Memcheck: MAKE_MEM_DEFINED
+-        (uintptr_t)(ptr),            // Memory address
+-        size,                        // Size in bytes
+-        0, 0, 0                      // Remaining unused arguments
+-    };
+-
+-    // Magical instruction sequence which Valgrind will interpret as an
+-    // annotation (see valgrind.h)
+-    __asm__ volatile(
+-        "rolq $3,  %%rdi ; rolq $13, %%rdi\n\t"
+-        "rolq $61, %%rdi ; rolq $51, %%rdi\n\t"
+-        "xchgq %%rbx, %%rbx"
+-        : "=d" (result)
+-        : "a" (&args[0]), "0" (0)
+-        : "cc", "memory"
+-    );
+-#endif
++    VALGRIND_MAKE_MEM_DEFINED(ptr, size);
+ }
+ 
+ Vdf_ExecutorDataVector::~Vdf_ExecutorDataVector()
+-- 
+2.55.0
+

0001-Downstream-only-use-the-system-double-conversion-lib.patch

@@ -0,0 +1,46 @@
+From 2d851f23e912d8312f2ea6818963150a8c484138 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Wed, 28 Aug 2024 10:42:48 -0400
+Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library
+
+---
+ pxr/base/tf/CMakeLists.txt | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt
+index 4294f2cb5..b45df65b8 100644
+--- a/pxr/base/tf/CMakeLists.txt
++++ b/pxr/base/tf/CMakeLists.txt
+@@ -105,11 +105,14 @@ function(add_py_dll_link_test)
+ 
+ endfunction()
+ 
++find_library(double-conversion_LIBRARY NAMES double-conversion REQUIRED)
++
+ pxr_library(tf
+     LIBRARIES
+         arch
+         ${WINLIBS}
+         TBB::tbb
++	${double-conversion_LIBRARY}
+ 
+     PUBLIC_CLASSES
+         anyUniquePtr
+@@ -276,14 +279,6 @@ pxr_library(tf
+ 
+     CPPFILES
+         initConfig.cpp
+-        pxrDoubleConversion/bignum-dtoa.cc
+-        pxrDoubleConversion/bignum.cc
+-        pxrDoubleConversion/cached-powers.cc
+-        pxrDoubleConversion/double-to-string.cc
+-        pxrDoubleConversion/fast-dtoa.cc
+-        pxrDoubleConversion/fixed-dtoa.cc
+-        pxrDoubleConversion/string-to-double.cc
+-        pxrDoubleConversion/strtod.cc
+         pxrLZ4/lz4.cpp
+ 
+     PYMODULE_CPPFILES
+-- 
+2.55.0
+

0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch

@@ -0,0 +1,110 @@
+From f3e9600db6086e834c0503cdaf30b5ba7ed53ceb Mon Sep 17 00:00:00 2001
+From: Anonymous Coward <nobody@redhat.com>
+Date: Sun, 26 Jul 2026 16:13:18 +0200
+Subject: [PATCH] Replace PyWeakref_GetObject with PyWeakref_GetRef
+
+PyWeakref_GetObject was removed in Python 3.15. Replace all four call
+sites with PyWeakref_GetRef, which returns a strong reference instead
+of a borrowed one, and adjust reference counting accordingly.
+
+In Tf_PyIdHandle::Ptr(), return Py_None when the referent is dead to
+match the original behaviour (previously returned NULL erroneously).
+
+In Tf_PyWeakObject::GetObject(), explicitly return a Python None object
+on failure, matching the original semantics exactly.
+
+Fixes: https://github.com/PixarAnimationStudios/OpenUSD/issues/3966
+
+Assisted-by: Claude Opus 4.6
+Reviewed-by: OpenUSD Maintainers <usd-maintainers@fedoraproject.org>
+---
+ pxr/base/tf/pyFunction.h     | 13 +++++++++----
+ pxr/base/tf/pyIdentity.cpp   | 10 +++++++++-
+ pxr/base/tf/pyWeakObject.cpp | 12 +++++++++---
+ 3 files changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/pxr/base/tf/pyFunction.h b/pxr/base/tf/pyFunction.h
+index 85af943b2..f77b5b71b 100644
+--- a/pxr/base/tf/pyFunction.h
++++ b/pxr/base/tf/pyFunction.h
+@@ -49,11 +49,13 @@ struct TfPyFunctionFromPython<Ret (Args...)>
+             using namespace pxr_boost::python;
+             // Attempt to get the referenced callable object.
+             TfPyLock lock;
+-            object callable(handle<>(borrowed(PyWeakref_GetObject(weak.ptr()))));
+-            if (TfPyIsNone(callable)) {
++            PyObject *rawCallable = NULL;
++            if (PyWeakref_GetRef(weak.ptr(), &rawCallable) <= 0) {
+                 TF_WARN("Tried to call an expired python callback");
+                 return Ret();
+             }
++            // PyWeakref_GetRef returns a strong reference; handle<> steals it.
++            object callable{handle<>(rawCallable)};
+             return TfPyCall<Ret>(callable)(args...);
+         }
+     };
+@@ -68,12 +70,15 @@ struct TfPyFunctionFromPython<Ret (Args...)>
+             // Attempt to get the referenced self parameter, then build a new
+             // instance method and call it.
+             TfPyLock lock;
+-            PyObject *self = PyWeakref_GetObject(weakSelf.ptr());
+-            if (self == Py_None) {
++            PyObject *self = NULL;
++            if (PyWeakref_GetRef(weakSelf.ptr(), &self) <= 0) {
+                 TF_WARN("Tried to call a method on an expired python instance");
+                 return Ret();
+             }
++            // PyWeakref_GetRef returns a strong reference to self; PyMethod_New
++            // takes its own reference, so release ours afterward.
+             object method(handle<>(PyMethod_New(func.ptr(), self)));
++            Py_DECREF(self);
+             return TfPyCall<Ret>(method)(args...);
+         }
+     };
+diff --git a/pxr/base/tf/pyIdentity.cpp b/pxr/base/tf/pyIdentity.cpp
+index 5389d8f25..06b7f9b0c 100644
+--- a/pxr/base/tf/pyIdentity.cpp
++++ b/pxr/base/tf/pyIdentity.cpp
+@@ -136,7 +136,15 @@ PyObject *
+ Tf_PyIdHandle::Ptr() const {
+     if (_weakRef) {
+         TfPyLock lock;
+-        return PyWeakref_GetObject(_weakRef);
++        PyObject *obj = NULL;
++        if (PyWeakref_GetRef(_weakRef, &obj) > 0) {
++            // Return a borrowed-style reference: decrement so the caller
++            // does not need to release. Safe because the GIL is held by
++            // all callers.
++            Py_DECREF(obj);
++            return obj;
++        }
++        return Py_None;   // dead referent → match original behaviour
+     }
+     return 0;
+ }
+diff --git a/pxr/base/tf/pyWeakObject.cpp b/pxr/base/tf/pyWeakObject.cpp
+index 8cfddc729..ecdd7f705 100644
+--- a/pxr/base/tf/pyWeakObject.cpp
++++ b/pxr/base/tf/pyWeakObject.cpp
+@@ -115,9 +115,15 @@ Tf_PyWeakObject::GetOrCreate(pxr_boost::python::object const &obj)
+ pxr_boost::python::object
+ Tf_PyWeakObject::GetObject() const
+ {
+-    return pxr_boost::python::object
+-        (pxr_boost::python::handle<>
+-         (pxr_boost::python::borrowed(PyWeakref_GetObject(_weakRef.get()))));
++    PyObject *obj = NULL;
++    if (PyWeakref_GetRef(_weakRef.get(), &obj) > 0) {
++        // PyWeakref_GetRef returns a strong reference; handle<> steals it.
++        return pxr_boost::python::object(
++            pxr_boost::python::handle<>(obj));
++    }
++    // Dead referent: return Py_None explicitly, as the original did.
++    return pxr_boost::python::object(
++        pxr_boost::python::handle<>(pxr_boost::python::borrowed(Py_None)));
+ }
+ 
+ void
+-- 
+2.55.0
+

0002-Downstream-only-use-the-system-lz4-library.patch

@@ -0,0 +1,44 @@
+From 9fd6089b3e95bb882199ee359fbba83f7c4bb410 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Thu, 29 Aug 2024 13:30:18 -0400
+Subject: [PATCH 2/6] Downstream-only: use the system lz4 library
+
+---
+ pxr/base/tf/CMakeLists.txt | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt
+index b45df65b8..5e6de96da 100644
+--- a/pxr/base/tf/CMakeLists.txt
++++ b/pxr/base/tf/CMakeLists.txt
+@@ -106,6 +106,8 @@ function(add_py_dll_link_test)
+ endfunction()
+ 
+ find_library(double-conversion_LIBRARY NAMES double-conversion REQUIRED)
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(LZ4 REQUIRED liblz4)
+ 
+ pxr_library(tf
+     LIBRARIES
+@@ -113,6 +115,10 @@ pxr_library(tf
+         ${WINLIBS}
+         TBB::tbb
+ 	${double-conversion_LIBRARY}
++	${LZ4_LIBRARIES}
++
++    INCLUDE_DIRS
++        ${LZ4_INCLUDE_DIRS}
+ 
+     PUBLIC_CLASSES
+         anyUniquePtr
+@@ -279,7 +285,6 @@ pxr_library(tf
+ 
+     CPPFILES
+         initConfig.cpp
+-        pxrLZ4/lz4.cpp
+ 
+     PYMODULE_CPPFILES
+         module.cpp
+-- 
+2.55.0
+

0003-Downstream-only-use-the-system-pugixml-library.patch

@@ -0,0 +1,39 @@
+From 73637a9bf67b3f7afe5070e5d56b07524e14a073 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Fri, 30 Aug 2024 09:32:08 -0400
+Subject: [PATCH 3/6] Downstream-only: use the system pugixml library
+
+---
+ third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt b/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt
+index 244f27aa8..1e00413c4 100644
+--- a/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt
++++ b/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt
+@@ -1,6 +1,8 @@
+ set(PXR_PREFIX "")
+ set(PXR_PACKAGE rmanArgsParser)
+ 
++find_library(pugixml_LIBRARY NAMES pugixml REQUIRED)
++
+ pxr_plugin(rmanArgsParser
+     LIBRARIES
+         arch
+@@ -9,12 +11,10 @@ pxr_plugin(rmanArgsParser
+         vt
+         ar
+         sdr
++	${pugixml_LIBRARY}
+ 
+     PRIVATE_CLASSES
+         rmanArgsParser
+-
+-    CPPFILES
+-        pugixml/pugixml.cpp
+     
+     PRIVATE_HEADERS
+         api.h
+-- 
+2.55.0
+

0004-Downstream-only-use-the-system-rapidjson-library.patch

@@ -0,0 +1,63 @@
+From f331a476a66e41e93d83b7a2e438d3ee7f12ea32 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Sat, 31 Aug 2024 11:08:18 -0400
+Subject: [PATCH 4/6] Downstream-only: use the system rapidjson library
+
+---
+ pxr/base/js/CMakeLists.txt | 40 --------------------------------------
+ 1 file changed, 40 deletions(-)
+
+diff --git a/pxr/base/js/CMakeLists.txt b/pxr/base/js/CMakeLists.txt
+index 8cbda8c52..ec8f3c249 100644
+--- a/pxr/base/js/CMakeLists.txt
++++ b/pxr/base/js/CMakeLists.txt
+@@ -15,46 +15,6 @@ pxr_library(js
+         converter.h
+         types.h
+ 
+-    PRIVATE_HEADERS
+-        rapidjson/allocators.h
+-        rapidjson/cursorstreamwrapper.h
+-        rapidjson/document.h
+-        rapidjson/encodedstream.h
+-        rapidjson/encodings.h
+-        rapidjson/error/en.h
+-        rapidjson/error/error.h
+-        rapidjson/filereadstream.h
+-        rapidjson/filewritestream.h
+-        rapidjson/fwd.h
+-        rapidjson/internal/biginteger.h
+-        rapidjson/internal/clzll.h
+-        rapidjson/internal/diyfp.h
+-        rapidjson/internal/dtoa.h
+-        rapidjson/internal/ieee754.h
+-        rapidjson/internal/itoa.h
+-        rapidjson/internal/meta.h
+-        rapidjson/internal/pow10.h
+-        rapidjson/internal/regex.h
+-        rapidjson/internal/stack.h
+-        rapidjson/internal/strfunc.h
+-        rapidjson/internal/strtod.h
+-        rapidjson/internal/swap.h
+-        rapidjson/istreamwrapper.h
+-        rapidjson/memorybuffer.h
+-        rapidjson/memorystream.h
+-        rapidjson/msinttypes/inttypes.h
+-        rapidjson/msinttypes/stdint.h
+-        rapidjson/ostreamwrapper.h
+-        rapidjson/pointer.h
+-        rapidjson/prettywriter.h
+-        rapidjson/rapidjson.h
+-        rapidjson/reader.h
+-        rapidjson/schema.h
+-        rapidjson/stream.h
+-        rapidjson/stringbuffer.h
+-        rapidjson/uri.h
+-        rapidjson/writer.h
+-
+     DOXYGEN_FILES
+         overview.dox
+ )
+-- 
+2.55.0
+

0005-Downstream-only-use-the-system-libdeflate.patch

@@ -0,0 +1,76 @@
+From a537b44edabe942380d2e87ea7069bdf32b93dbc Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Sun, 1 Sep 2024 21:30:11 -0400
+Subject: [PATCH 5/6] Downstream-only: use the system libdeflate
+
+---
+ pxr/imaging/hio/CMakeLists.txt                       |  7 +++++++
+ .../hioOpenEXR/OpenEXR/OpenEXRCore/compression.c     |  3 +--
+ .../plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h     | 12 ------------
+ 3 files changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/pxr/imaging/hio/CMakeLists.txt b/pxr/imaging/hio/CMakeLists.txt
+index e61fc7c54..7cfbe9d70 100644
+--- a/pxr/imaging/hio/CMakeLists.txt
++++ b/pxr/imaging/hio/CMakeLists.txt
+@@ -1,6 +1,9 @@
+ set(PXR_PREFIX pxr/imaging)
+ set(PXR_PACKAGE hio)
+ 
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(DEFLATE REQUIRED libdeflate)
++
+ pxr_library(hio
+     LIBRARIES
+         arch
+@@ -11,6 +14,10 @@ pxr_library(hio
+         trace
+         ar
+         hf
++	${DEFLATE_LIBRARIES}
++
++    INCLUDE_DIRS
++	${DEFLATE_INCLUDE_DIRS}
+ 
+     PUBLIC_CLASSES
+         fieldTextureData
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c
+index a672e833b..1d2eaea56 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c
+@@ -8,8 +8,7 @@
+ #include "internal_memory.h"
+ #include "internal_structs.h"
+ 
+-// pxr #include <libdeflate.h>
+-#include "../deflate/libdeflate.h"
++#include <libdeflate.h>
+ 
+ #if (                                                                          \
+     LIBDEFLATE_VERSION_MAJOR > 1 ||                                            \
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h
+index 7481a346e..71bdde9cc 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h
+@@ -8,18 +8,6 @@
+ 
+ #include "OpenEXRCore/openexr_config.h"
+ 
+-#include "deflate/lib/lib_common.h"
+-#include "deflate/common_defs.h"
+-#include "deflate/lib/utils.c"
+-#include "deflate/lib/arm/cpu_features.c"
+-#include "deflate/lib/x86/cpu_features.c"
+-#include "deflate/lib/deflate_compress.c"
+-#undef BITBUF_NBITS
+-#include "deflate/lib/deflate_decompress.c"
+-#include "deflate/lib/adler32.c"
+-#include "deflate/lib/zlib_compress.c"
+-#include "deflate/lib/zlib_decompress.c"
+-
+ #include "openexr-c.h"
+ 
+ #include "OpenEXRCore/attributes.c"
+-- 
+2.55.0
+

0006-Downstream-only-use-the-system-libavif.patch

@@ -0,0 +1,241 @@
+From f2a3615238a691e11a4029c33498e7f21a34fff9 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Wed, 4 Sep 2024 11:09:47 -0400
+Subject: [PATCH 6/6] Downstream-only: use the system libavif
+
+---
+ pxr/imaging/plugin/hioAvif/AVIFImage.cpp  |   2 +-
+ pxr/imaging/plugin/hioAvif/CMakeLists.txt | 194 +---------------------
+ 2 files changed, 7 insertions(+), 189 deletions(-)
+
+diff --git a/pxr/imaging/plugin/hioAvif/AVIFImage.cpp b/pxr/imaging/plugin/hioAvif/AVIFImage.cpp
+index b56369ee5..c6fcb4a6c 100644
+--- a/pxr/imaging/plugin/hioAvif/AVIFImage.cpp
++++ b/pxr/imaging/plugin/hioAvif/AVIFImage.cpp
+@@ -30,7 +30,7 @@ ARCH_PRAGMA_UNUSED_FUNCTION
+ #include "pxr/base/tf/stringUtils.h"
+ #include "pxr/base/tf/type.h"
+ 
+-#include "pxr/imaging/plugin/hioAvif/AVIF/src/avif/avif.h"
++#include <avif/avif.h>
+ 
+ PXR_NAMESPACE_OPEN_SCOPE
+ 
+diff --git a/pxr/imaging/plugin/hioAvif/CMakeLists.txt b/pxr/imaging/plugin/hioAvif/CMakeLists.txt
+index 1ac2683f6..7d583c137 100644
+--- a/pxr/imaging/plugin/hioAvif/CMakeLists.txt
++++ b/pxr/imaging/plugin/hioAvif/CMakeLists.txt
+@@ -1,6 +1,9 @@
+ set(PXR_PREFIX pxr/imaging)
+ set(PXR_PACKAGE hioAvif)
+ 
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(AVIF REQUIRED libavif)
++
+ pxr_plugin(hioAvif
+     LIBRARIES
+         ar
+@@ -8,197 +11,12 @@ pxr_plugin(hioAvif
+         gf
+         hio
+         tf
++	${AVIF_LIBRARIES}
+ 
+-    PRIVATE_HEADERS
+-        aom/aom.h
+-        aom/aom_codec.h
+-        aom/aom_decoder.h
+-        aom/aom_encoder.h
+-        aom/aom_frame_buffer.h
+-        aom/aom_image.h
+-        aom/aom_integer.h
+-        aom/aomdx.h
+-        aom/aom_external_partition.h
+-        aom/internal/aom_codec_internal.h
+-        aom/internal/aom_image_internal.h
+-        aom_dsp/aom_dsp_common.h
+-        aom_dsp/aom_filter.h
+-        aom_dsp/binary_codes_reader.h
+-        aom_dsp/bitreader.h
+-        aom_dsp/bitreader_buffer.h
+-        aom_dsp/blend.h
+-        aom_dsp/entcode.h
+-        aom_dsp/entdec.h
+-        aom_dsp/flow_estimation/corner_detect.h
+-        aom_dsp/flow_estimation/flow_estimation.h
+-        aom_dsp/grain_params.h
+-        aom_dsp/grain_table.h
+-        aom_dsp/intrapred_common.h
+-        aom_dsp/odintrin.h
+-        aom_dsp/prob.h
+-        aom_dsp/pyramid.h
+-        aom_dsp/recenter.h
+-        aom_dsp/txfm_common.h
+-        aom_mem/aom_mem.h
+-        aom_mem/include/aom_mem_intrnl.h
+-        aom_ports/aom_once.h
+-        aom_ports/aom_timer.h
+-        aom_ports/bitops.h
+-        aom_ports/mem.h
+-        aom_ports/mem_ops.h
+-        aom_ports/mem_ops_aligned.h
+-        aom_ports/sanitizer.h
+-        aom_scale/yv12config.h
+-        aom_util/aom_thread.h
+-        aom_util/aom_pthread.h
+-        av1/av1_iface_common.h
+-        av1/common/alloccommon.h
+-        av1/common/av1_common_int.h
+-        av1/common/av1_inv_txfm1d.h
+-        av1/common/av1_inv_txfm1d_cfg.h
+-        av1/common/av1_loopfilter.h
+-        av1/common/av1_txfm.h
+-        av1/common/blockd.h
+-        av1/common/cdef.h
+-        av1/common/cdef_block.h
+-        av1/common/cfl.h
+-        av1/common/common.h
+-        av1/common/common_data.h
+-        av1/common/convolve.h
+-        av1/common/entropy.h
+-        av1/common/entropymode.h
+-        av1/common/entropymv.h
+-        av1/common/enums.h
+-        av1/common/filter.h
+-        av1/common/frame_buffers.h
+-        av1/common/idct.h
+-        av1/common/mv.h
+-        av1/common/mvref_common.h
+-        av1/common/obmc.h
+-        av1/common/obu_util.h
+-        av1/common/pred_common.h
+-        av1/common/quant_common.h
+-        av1/common/reconinter.h
+-        av1/common/reconinter_template.inc
+-        av1/common/reconintra.h
+-        av1/common/resize.h
+-        av1/common/restoration.h
+-        av1/common/scale.h
+-        av1/common/scan.h
+-        av1/common/seg_common.h
+-        av1/common/thread_common.h
+-        av1/common/tile_common.h
+-        av1/common/timing.h
+-        av1/common/token_cdfs.h
+-        av1/common/txb_common.h
+-        av1/common/warped_motion.h
+-        av1/decoder/decodeframe.h
+-        av1/decoder/decodemv.h
+-        av1/decoder/decoder.h
+-        av1/decoder/decodetxb.h
+-        av1/decoder/detokenize.h
+-        av1/decoder/dthread.h
+-        av1/decoder/grain_synthesis.h
+-        av1/decoder/obu.h
+-        common/args_helper.h
+-        AVIF/src/avif/avif.h
+-        AVIF/src/avif/internal.h
+-        AVIF/src/src-libyuv/libyuv/basic_types.h
+-        AVIF/src/src-libyuv/libyuv.h
+-        AVIF/src/src-libyuv/libyuv/planar_functions.h
+-        AVIF/src/src-libyuv/libyuv/row.h
+-        AVIF/src/src-libyuv/libyuv/scale.h
+-        AVIF/src/src-libyuv/libyuv/scale_row.h
+-        AVIF/src/src-libyuv/libyuv/version.h
++    INCLUDE_DIRS
++	${AVIF_INCLUDE_DIRS}
+ 
+     CPPFILES
+-        aom/src/aom_codec.c
+-        aom/src/aom_decoder.c
+-        aom/src/aom_image.c
+-        aom/src/aom_integer.c
+-        aom_dsp/aom_convolve.c
+-        aom_dsp/aom_dsp_rtcd.c
+-        aom_dsp/binary_codes_reader.c
+-        aom_dsp/bitreader.c
+-        aom_dsp/bitreader_buffer.c
+-        aom_dsp/blend_a64_hmask.c
+-        aom_dsp/blend_a64_mask.c
+-        aom_dsp/blend_a64_vmask.c
+-        aom_dsp/entcode.c
+-        aom_dsp/entdec.c
+-        aom_dsp/intrapred.c
+-        aom_dsp/loopfilter.c
+-        aom_dsp/odintrin.c
+-        aom_dsp/pyramid.c
+-        aom_mem/aom_mem.c
+-        aom_scale/aom_scale_rtcd.c
+-        aom_scale/generic/yv12config.c
+-        aom_scale/generic/yv12extend.c
+-        aom_util/aom_thread.c
+-        av1/av1_dx_iface.c
+-        av1/common/alloccommon.c
+-        av1/common/av1_inv_txfm1d.c
+-        av1/common/av1_inv_txfm2d.c
+-        av1/common/av1_loopfilter.c
+-        av1/common/av1_rtcd.c
+-        av1/common/av1_txfm.c
+-        av1/common/blockd.c
+-        av1/common/cdef.c
+-        av1/common/cdef_block.c
+-        av1/common/cfl.c
+-        av1/common/common_data.c
+-        av1/common/convolve.c
+-        av1/common/entropy.c
+-        av1/common/entropymode.c
+-        av1/common/entropymv.c
+-        av1/common/frame_buffers.c
+-        av1/common/idct.c
+-        av1/common/mvref_common.c
+-        av1/common/obu_util.c
+-        av1/common/pred_common.c
+-        av1/common/quant_common.c
+-        av1/common/reconinter.c
+-        av1/common/reconintra.c
+-        av1/common/resize.c
+-        av1/common/restoration.c
+-        av1/common/scale.c
+-        av1/common/scan.c
+-        av1/common/seg_common.c
+-        av1/common/thread_common.c
+-        av1/common/tile_common.c
+-        av1/common/timing.c
+-        av1/common/txb_common.c
+-        av1/common/warped_motion.c
+-        av1/decoder/decodeframe.c
+-        av1/decoder/decodemv.c
+-        av1/decoder/decoder.c
+-        av1/decoder/decodetxb.c
+-        av1/decoder/detokenize.c
+-        av1/decoder/grain_synthesis.c
+-        av1/decoder/obu.c
+-        AVIF/src/alpha.c
+-        AVIF/src/avif.c
+-        AVIF/src/codec_aom.c
+-        AVIF/src/colr.c
+-        AVIF/src/diag.c
+-        AVIF/src/exif.c
+-        AVIF/src/io.c
+-        AVIF/src/mem.c
+-        AVIF/src/avif_obu.c
+-        AVIF/src/rawdata.c
+-        AVIF/src/read.c
+-        AVIF/src/reformat.c
+-        AVIF/src/reformat_libsharpyuv.c
+-        AVIF/src/reformat_libyuv.c
+-        AVIF/src/avif-scale.c
+-        AVIF/src/stream.c
+-        AVIF/src/utils.c
+-        AVIF/src/write.c
+-        AVIF/src/src-libyuv/planar_functions.c
+-        AVIF/src/src-libyuv/row_common.c
+-        AVIF/src/src-libyuv/yuv_scale.c
+-        AVIF/src/src-libyuv/scale_any.c
+-        AVIF/src/src-libyuv/scale_common.c
+         AVIFImage.cpp
+ 
+     RESOURCE_FILES
+-- 
+2.55.0
+

2266.patch

@@ -1,217 +0,0 @@
-From 4b6c23d459c602fdac5e0ebc9b7722cbd5475e86 Mon Sep 17 00:00:00 2001
-From: "Benjamin A. Beasley" <code@musicinmybrain.net>
-Date: Sat, 11 Feb 2023 13:58:42 -0500
-Subject: [PATCH] Port to Embree 4.x
-
----
- cmake/modules/FindEmbree.cmake                   | 16 ++++++++--------
- pxr/imaging/plugin/hdEmbree/context.h            |  2 +-
- pxr/imaging/plugin/hdEmbree/mesh.cpp             |  2 +-
- pxr/imaging/plugin/hdEmbree/mesh.h               |  4 ++--
- pxr/imaging/plugin/hdEmbree/meshSamplers.h       |  4 ++--
- pxr/imaging/plugin/hdEmbree/pch.h                |  6 +++---
- pxr/imaging/plugin/hdEmbree/renderDelegate.h     |  2 +-
- pxr/imaging/plugin/hdEmbree/renderParam.h        |  2 +-
- pxr/imaging/plugin/hdEmbree/renderer.cpp         |  8 ++------
- pxr/imaging/plugin/hdEmbree/renderer.h           |  4 ++--
- .../plugin/hdEmbree/testenv/testHdEmbree.cpp     |  2 +-
- 11 files changed, 24 insertions(+), 28 deletions(-)
-
-diff --git a/cmake/modules/FindEmbree.cmake b/cmake/modules/FindEmbree.cmake
-index e12639d6d9..ec13d0f5c4 100644
---- a/cmake/modules/FindEmbree.cmake
-+++ b/cmake/modules/FindEmbree.cmake
-@@ -37,11 +37,11 @@
- #=============================================================================
- 
- if (APPLE)
--    set (EMBREE_LIB_NAME libembree3.dylib)
-+    set (EMBREE_LIB_NAME libembree4.dylib)
- elseif (UNIX)
--    set (EMBREE_LIB_NAME libembree3.so)
-+    set (EMBREE_LIB_NAME libembree4.so)
- elseif (WIN32)
--    set (EMBREE_LIB_NAME embree3.lib)
-+    set (EMBREE_LIB_NAME embree4.lib)
- endif()
- 
- find_library(EMBREE_LIBRARY
-@@ -56,7 +56,7 @@ find_library(EMBREE_LIBRARY
- )
- 
- find_path(EMBREE_INCLUDE_DIR
--    embree3/rtcore.h
-+    embree4/rtcore.h
- HINTS
-     "${EMBREE_LOCATION}/include"
-     "$ENV{EMBREE_LOCATION}/include"
-@@ -64,12 +64,12 @@ DOC
-     "Embree headers path"
- )
- 
--if (EMBREE_INCLUDE_DIR AND EXISTS "${EMBREE_INCLUDE_DIR}/embree3/rtcore_version.h" )
--    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree3/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_MAJOR.*$")
-+if (EMBREE_INCLUDE_DIR AND EXISTS "${EMBREE_INCLUDE_DIR}/embree4/rtcore_version.h" )
-+    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree4/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_MAJOR.*$")
-     string(REGEX MATCHALL "[0-9]+" MAJOR ${TMP})
--    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree3/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_MINOR.*$")
-+    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree4/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_MINOR.*$")
-     string(REGEX MATCHALL "[0-9]+" MINOR ${TMP})
--    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree3/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_PATCH.*$")
-+    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree4/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_PATCH.*$")
-     string(REGEX MATCHALL "[0-9]+" PATCH ${TMP})
- 
-     set (EMBREE_VERSION ${MAJOR}.${MINOR}.${PATCH})
-diff --git a/pxr/imaging/plugin/hdEmbree/context.h b/pxr/imaging/plugin/hdEmbree/context.h
-index 7af4ab0d27..fb10e8ceff 100644
---- a/pxr/imaging/plugin/hdEmbree/context.h
-+++ b/pxr/imaging/plugin/hdEmbree/context.h
-@@ -31,7 +31,7 @@
- #include "pxr/base/gf/matrix4f.h"
- #include "pxr/base/vt/array.h"
- 
--#include <embree3/rtcore.h>
-+#include <embree4/rtcore.h>
- 
- PXR_NAMESPACE_OPEN_SCOPE
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/mesh.cpp b/pxr/imaging/plugin/hdEmbree/mesh.cpp
-index e8e001e1cc..fe0f25b7b8 100644
---- a/pxr/imaging/plugin/hdEmbree/mesh.cpp
-+++ b/pxr/imaging/plugin/hdEmbree/mesh.cpp
-@@ -220,7 +220,7 @@ void HdEmbreeMesh::_EmbreeCullFaces(const RTCFilterFunctionNArguments* args)
-             default: break;
-         }
-         if (cull) {
--            // This is how you reject a hit in embree3 instead of setting
-+            // This is how you reject a hit in embree3/4 instead of setting
-             // geomId to invalid on the ray
-             args->valid[i] = 0;
-         }
-diff --git a/pxr/imaging/plugin/hdEmbree/mesh.h b/pxr/imaging/plugin/hdEmbree/mesh.h
-index 4574454368..f83bf5d998 100644
---- a/pxr/imaging/plugin/hdEmbree/mesh.h
-+++ b/pxr/imaging/plugin/hdEmbree/mesh.h
-@@ -32,8 +32,8 @@
- 
- #include "pxr/imaging/plugin/hdEmbree/meshSamplers.h"
- 
--#include <embree3/rtcore.h>
--#include <embree3/rtcore_ray.h>
-+#include <embree4/rtcore.h>
-+#include <embree4/rtcore_ray.h>
- 
- PXR_NAMESPACE_OPEN_SCOPE
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/meshSamplers.h b/pxr/imaging/plugin/hdEmbree/meshSamplers.h
-index bef6f65959..2b481e5694 100644
---- a/pxr/imaging/plugin/hdEmbree/meshSamplers.h
-+++ b/pxr/imaging/plugin/hdEmbree/meshSamplers.h
-@@ -29,8 +29,8 @@
- #include "pxr/imaging/hd/meshUtil.h"
- #include "pxr/base/vt/types.h"
- 
--#include <embree3/rtcore.h>
--#include <embree3/rtcore_geometry.h>
-+#include <embree4/rtcore.h>
-+#include <embree4/rtcore_geometry.h>
- 
- #include <bitset>
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/pch.h b/pxr/imaging/plugin/hdEmbree/pch.h
-index 7710229804..e8e733bfc4 100644
---- a/pxr/imaging/plugin/hdEmbree/pch.h
-+++ b/pxr/imaging/plugin/hdEmbree/pch.h
-@@ -151,9 +151,9 @@
- #include <boost/unordered_map.hpp>
- #include <boost/utility/enable_if.hpp>
- #include <boost/weak_ptr.hpp>
--#include <embree3/rtcore.h>
--#include <embree3/rtcore_geometry.h>
--#include <embree3/rtcore_ray.h>
-+#include <embree4/rtcore.h>
-+#include <embree4/rtcore_geometry.h>
-+#include <embree4/rtcore_ray.h>
- #include <tbb/atomic.h>
- #include <tbb/blocked_range.h>
- #include <tbb/cache_aligned_allocator.h>
-diff --git a/pxr/imaging/plugin/hdEmbree/renderDelegate.h b/pxr/imaging/plugin/hdEmbree/renderDelegate.h
-index 20a80487a9..6a6bc9dbf1 100644
---- a/pxr/imaging/plugin/hdEmbree/renderDelegate.h
-+++ b/pxr/imaging/plugin/hdEmbree/renderDelegate.h
-@@ -31,7 +31,7 @@
- #include "pxr/base/tf/staticTokens.h"
- 
- #include <mutex>
--#include <embree3/rtcore.h>
-+#include <embree4/rtcore.h>
- 
- PXR_NAMESPACE_OPEN_SCOPE
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/renderParam.h b/pxr/imaging/plugin/hdEmbree/renderParam.h
-index ff61000ab5..d3f903e0f3 100644
---- a/pxr/imaging/plugin/hdEmbree/renderParam.h
-+++ b/pxr/imaging/plugin/hdEmbree/renderParam.h
-@@ -28,7 +28,7 @@
- #include "pxr/imaging/hd/renderDelegate.h"
- #include "pxr/imaging/hd/renderThread.h"
- 
--#include <embree3/rtcore.h>
-+#include <embree4/rtcore.h>
- 
- PXR_NAMESPACE_OPEN_SCOPE
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/renderer.cpp b/pxr/imaging/plugin/hdEmbree/renderer.cpp
-index 20ec78c6aa..72a897120d 100644
---- a/pxr/imaging/plugin/hdEmbree/renderer.cpp
-+++ b/pxr/imaging/plugin/hdEmbree/renderer.cpp
-@@ -650,9 +650,7 @@ HdEmbreeRenderer::_TraceRay(unsigned int x, unsigned int y,
-     rayHit.ray.flags = 0;
-     _PopulateRayHit(&rayHit, origin, dir, 0.0f);
-     {
--      RTCIntersectContext context;
--      rtcInitIntersectContext(&context);
--      rtcIntersect1(_scene, &context, &rayHit);
-+      rtcIntersect1(_scene, &rayHit);
-       //
-       // there is something odd about how this is used in Embree. Is it reversed
-       // here and then when it it used in
-@@ -992,9 +990,7 @@ HdEmbreeRenderer::_ComputeAmbientOcclusion(GfVec3f const& position,
-         shadow.flags = 0;
-         _PopulateRay(&shadow, position, shadowDir, 0.001f);
-         {
--          RTCIntersectContext context;
--          rtcInitIntersectContext(&context);
--          rtcOccluded1(_scene,&context,&shadow);
-+          rtcOccluded1(_scene,&shadow);
-         }
- 
-         // Record this AO ray's contribution to the occlusion factor: a
-diff --git a/pxr/imaging/plugin/hdEmbree/renderer.h b/pxr/imaging/plugin/hdEmbree/renderer.h
-index 6af8081678..740812fb03 100644
---- a/pxr/imaging/plugin/hdEmbree/renderer.h
-+++ b/pxr/imaging/plugin/hdEmbree/renderer.h
-@@ -32,8 +32,8 @@
- #include "pxr/base/gf/matrix4d.h"
- #include "pxr/base/gf/rect2i.h"
- 
--#include <embree3/rtcore.h>
--#include <embree3/rtcore_ray.h>
-+#include <embree4/rtcore.h>
-+#include <embree4/rtcore_ray.h>
- 
- #include <random>
- #include <atomic>
-diff --git a/pxr/imaging/plugin/hdEmbree/testenv/testHdEmbree.cpp b/pxr/imaging/plugin/hdEmbree/testenv/testHdEmbree.cpp
-index c361c678bc..8380aebe72 100644
---- a/pxr/imaging/plugin/hdEmbree/testenv/testHdEmbree.cpp
-+++ b/pxr/imaging/plugin/hdEmbree/testenv/testHdEmbree.cpp
-@@ -40,7 +40,7 @@
- 
- #include "pxr/base/tf/errorMark.h"
- 
--#include <embree3/rtcore.h>
-+#include <embree4/rtcore.h>
- #include <iostream>
- 
- PXR_NAMESPACE_USING_DIRECTIVE

3903.patch

@@ -0,0 +1,83 @@
+From 3e51fb244dd264b09179999d29dc7c5afd7e71e3 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Tue, 2 Dec 2025 10:43:31 +0000
+Subject: [PATCH] Backport fixes for CVE-2025-64181 etc. in OpenEXRCore
+
+---
+ .../hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c    | 20 ++++++++++++++++---
+ .../OpenEXR/OpenEXRCore/internal_util.h       |  4 ++--
+ .../OpenEXR/OpenEXRCore/parse_header.c        |  4 +++-
+ 3 files changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c
+index cfe80b4cd68..e11209fe660 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c
+@@ -1292,6 +1292,16 @@ exr_read_tile_chunk_info (
+         return pctxt->report_error (
+             pctxt, EXR_ERR_INVALID_ARGUMENT, "Invalid packed size of 0");
+ 
++    if (part->comp_type == EXR_COMPRESSION_NONE &&
++       cinfo->packed_size != cinfo->unpacked_size)
++    {
++         return pctxt->print_error (
++             pctxt,
++             EXR_ERR_BAD_CHUNK_LEADER,
++             "Mismatch between unpacked and packed size with uncompressed data: packed is %" PRIu64 "; unpacked is %" PRIu64,
++             cinfo->packed_size, cinfo->unpacked_size);
++    }
++
+     return EXR_ERR_SUCCESS;
+ }
+ 
+@@ -1350,11 +1360,15 @@ exr_read_chunk (
+         rv    = pctxt->do_read (
+             pctxt, packed_data, toread, &dataoffset, &nread, rmode);
+ 
+-        if (rmode == EXR_ALLOW_SHORT_READ && nread < (int64_t) toread)
++        if (rmode == EXR_ALLOW_SHORT_READ &&
++            nread >= 0 &&
++            nread < (int64_t) toread)
++        {
+             memset (
+                 ((uint8_t*) packed_data) + nread,
+-                0,
+-                toread - (uint64_t) (nread));
++                    0,
++            (size_t)(toread - (uint64_t)nread));
++        }
+     }
+     else
+         rv = EXR_ERR_SUCCESS;
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h
+index 3c6f02786cc..e0fa3933d92 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h
+@@ -31,10 +31,10 @@ compute_sampled_height (int height, int y_sampling, int start_y)
+         else
+             start = start_y;
+         end = start_y + height - 1;
+-        end -= (end < 0) ? (-end % y_sampling) : (end % y_sampling);
++        end -= (end < 0 ? -end : end) % y_sampling;
+ 
+         if (start > end)
+-            nlines = 0;
++            nlines = start == start_y ? 1 : 0;
+         else
+             nlines = (end - start) / y_sampling + 1;
+     }
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c
+index d7230392693..8b6cf78cc59 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c
+@@ -2293,7 +2293,9 @@ internal_exr_compute_chunk_offset_size (struct _internal_exr_part* curpart)
+ 
+     w = (uint64_t) (((int64_t) dw.max.x) - ((int64_t) dw.min.x) + 1);
+ 
+-    if (curpart->tiles)
++    if (curpart->storage_mode != EXR_STORAGE_SCANLINE &&
++       curpart->storage_mode != EXR_STORAGE_DEEP_SCANLINE &&
++       curpart->tiles)
+     {
+         const exr_attr_tiledesc_t* tiledesc  = curpart->tiles->tiledesc;
+         int64_t                    tilecount = 0;

USD-23.05-tbb2020.3.patch

@@ -1,22 +0,0 @@
---- USD-23.05/cmake/modules/FindTBB.cmake~	2023-06-28 13:02:04.191419402 +0100
-+++ USD-23.05/cmake/modules/FindTBB.cmake	2023-06-28 13:02:06.336423412 +0100
-@@ -197,7 +197,18 @@
-   ##################################
- 
-   if(TBB_INCLUDE_DIRS)
--    file(READ "${TBB_INCLUDE_DIRS}/tbb/tbb_stddef.h" _tbb_version_file)
-+    # Starting in 2020.1.1, tbb_stddef.h is replaced by version.h
-+    set(_version_files "${TBB_INCLUDE_DIRS}/tbb/tbb_stddef.h"
-+                       "${TBB_INCLUDE_DIRS}/tbb/version.h"
-+                       "${TBB_INCLUDE_DIRS}/oneapi/tbb/version.h")
-+    foreach(f IN ITEMS ${_version_files})
-+        if(EXISTS ${f})
-+            set(_version_file ${f})
-+        endif()
-+    endforeach()
-+    unset(_version_files)
-+
-+    file(READ ${_version_file} _tbb_version_file)
-     string(REGEX REPLACE ".*#define TBB_VERSION_MAJOR ([0-9]+).*" "\\1"
-         TBB_VERSION_MAJOR "${_tbb_version_file}")
-     string(REGEX REPLACE ".*#define TBB_VERSION_MINOR ([0-9]+).*" "\\1"

org.openusd.usdview.desktop

@@ -1,7 +1,7 @@
 [Desktop Entry]
 Name=USD view
 GenericName=Universal Scene Description Viewer
-Comment=Open .cbr & .cbz files
+Comment=Visualize USD files
 Exec=usdview
 Icon=applications-graphics
 Terminal=false

sources

@@ -1 +1 @@
-SHA512 (OpenUSD-23.11.tar.gz) = a6f718c8c227cabcc467de80bd5197470bcf335aaf1738e49e37d8d0fa4b47a0c0d9dc1518032de8c603e3ef303d22f9960504caeede4c5053ab1d3c84987304
+SHA512 (OpenUSD-26.08.tar.gz) = 82f7bb4f77b295be79cd36f591f242276d36c0d589b0fca383344c27e70daf7e29151bf587528bb2fc2b2a8b974387a253993ace3caf5f79ae70f9ebbc71cf1a

stb_image.patch

@@ -1,155 +0,0 @@
---- stb/stb_image.h	2021-09-16 11:52:38.284782000 -0700k
-+++ stb_image.h	2021-09-16 13:45:48.159770000 -0700
-@@ -488,14 +488,14 @@
- STBIDEF void     stbi_image_free      (void *retval_from_stbi_load);
- 
- // get image dimensions & components without fully decoding
--STBIDEF int      stbi_info_from_memory(stbi_uc const *buffer, int len, int *x, int *y, int *comp);
--STBIDEF int      stbi_info_from_callbacks(stbi_io_callbacks const *clbk, void *user, int *x, int *y, int *comp);
-+STBIDEF int      stbi_info_from_memory(stbi_uc const *buffer, int len, int *x, int *y, int *comp, float *gamma);
-+STBIDEF int      stbi_info_from_callbacks(stbi_io_callbacks const *clbk, void *user, int *x, int *y, int *comp, float *gamma);
- STBIDEF int      stbi_is_16_bit_from_memory(stbi_uc const *buffer, int len);
- STBIDEF int      stbi_is_16_bit_from_callbacks(stbi_io_callbacks const *clbk, void *user);
- 
- #ifndef STBI_NO_STDIO
--STBIDEF int      stbi_info               (char const *filename,     int *x, int *y, int *comp);
--STBIDEF int      stbi_info_from_file     (FILE *f,                  int *x, int *y, int *comp);
-+STBIDEF int      stbi_info               (char const *filename,     int *x, int *y, int *comp, float *gamma);
-+STBIDEF int      stbi_info_from_file     (FILE *f,                  int *x, int *y, int *comp, float *gamma);
- STBIDEF int      stbi_is_16_bit          (char const *filename);
- STBIDEF int      stbi_is_16_bit_from_file(FILE *f);
- #endif
-@@ -911,7 +911,7 @@
- #ifndef STBI_NO_PNG
- static int      stbi__png_test(stbi__context *s);
- static void    *stbi__png_load(stbi__context *s, int *x, int *y, int *comp, int req_comp, stbi__result_info *ri);
--static int      stbi__png_info(stbi__context *s, int *x, int *y, int *comp);
-+static int      stbi__png_info(stbi__context *s, int *x, int *y, int *comp, float *gamma);
- static int      stbi__png_is16(stbi__context *s);
- #endif
- 
-@@ -4554,6 +4554,7 @@
-    stbi__context *s;
-    stbi_uc *idata, *expanded, *out;
-    int depth;
-+   float gamma = 0;
- } stbi__png;
- 
- 
-@@ -5112,6 +5113,13 @@
-             break;
-          }
- 
-+         case STBI__PNG_TYPE('g','A','M','A'): {
-+            if (first) return stbi__err("first not IHDR", "Corrupt PNG");
-+            if (4 != c.length) return stbi__err("invalid gAMA","Corrupt PNG");
-+            z->gamma = stbi__get32be(s) / 100000.0f;
-+            break;
-+         }
-+
-          case STBI__PNG_TYPE('I','D','A','T'): {
-             if (first) return stbi__err("first not IHDR", "Corrupt PNG");
-             if (pal_img_n && !pal_len) return stbi__err("no PLTE","Corrupt PNG");
-@@ -5243,7 +5251,7 @@
-    return r;
- }
- 
--static int stbi__png_info_raw(stbi__png *p, int *x, int *y, int *comp)
-+static int stbi__png_info_raw(stbi__png *p, int *x, int *y, int *comp, float *gamma)
- {
-    if (!stbi__parse_png_file(p, STBI__SCAN_header, 0)) {
-       stbi__rewind( p->s );
-@@ -5252,21 +5260,22 @@
-    if (x) *x = p->s->img_x;
-    if (y) *y = p->s->img_y;
-    if (comp) *comp = p->s->img_n;
-+   if (gamma) *gamma = p->gamma;
-    return 1;
- }
- 
--static int stbi__png_info(stbi__context *s, int *x, int *y, int *comp)
-+static int stbi__png_info(stbi__context *s, int *x, int *y, int *comp, float *gamma)
- {
-    stbi__png p;
-    p.s = s;
--   return stbi__png_info_raw(&p, x, y, comp);
-+   return stbi__png_info_raw(&p, x, y, comp, gamma);
- }
- 
- static int stbi__png_is16(stbi__context *s)
- {
-    stbi__png p;
-    p.s = s;
--   if (!stbi__png_info_raw(&p, NULL, NULL, NULL))
-+   if (!stbi__png_info_raw(&p, NULL, NULL, NULL, NULL))
- 	   return 0;
-    if (p.depth != 16) {
-       stbi__rewind(p.s);
-@@ -7538,14 +7547,14 @@
- }
- #endif
- 
--static int stbi__info_main(stbi__context *s, int *x, int *y, int *comp)
-+static int stbi__info_main(stbi__context *s, int *x, int *y, int *comp, float *gamma)
- {
-    #ifndef STBI_NO_JPEG
-    if (stbi__jpeg_info(s, x, y, comp)) return 1;
-    #endif
- 
-    #ifndef STBI_NO_PNG
--   if (stbi__png_info(s, x, y, comp))  return 1;
-+   if (stbi__png_info(s, x, y, comp, gamma))  return 1;
-    #endif
- 
-    #ifndef STBI_NO_GIF
-@@ -7597,23 +7606,23 @@
- }
- 
- #ifndef STBI_NO_STDIO
--STBIDEF int stbi_info(char const *filename, int *x, int *y, int *comp)
-+STBIDEF int stbi_info(char const *filename, int *x, int *y, int *comp, float *gamma)
- {
-     FILE *f = stbi__fopen(filename, "rb");
-     int result;
-     if (!f) return stbi__err("can't fopen", "Unable to open file");
--    result = stbi_info_from_file(f, x, y, comp);
-+    result = stbi_info_from_file(f, x, y, comp, gamma);
-     fclose(f);
-     return result;
- }
- 
--STBIDEF int stbi_info_from_file(FILE *f, int *x, int *y, int *comp)
-+STBIDEF int stbi_info_from_file(FILE *f, int *x, int *y, int *comp, float *gamma)
- {
-    int r;
-    stbi__context s;
-    long pos = ftell(f);
-    stbi__start_file(&s, f);
--   r = stbi__info_main(&s,x,y,comp);
-+   r = stbi__info_main(&s,x,y,comp, gamma);
-    fseek(f,pos,SEEK_SET);
-    return r;
- }
-@@ -7640,18 +7649,18 @@
- }
- #endif // !STBI_NO_STDIO
- 
--STBIDEF int stbi_info_from_memory(stbi_uc const *buffer, int len, int *x, int *y, int *comp)
-+STBIDEF int stbi_info_from_memory(stbi_uc const *buffer, int len, int *x, int *y, int *comp, float *gamma)
- {
-    stbi__context s;
-    stbi__start_mem(&s,buffer,len);
--   return stbi__info_main(&s,x,y,comp);
-+   return stbi__info_main(&s,x,y,comp, gamma);
- }
- 
--STBIDEF int stbi_info_from_callbacks(stbi_io_callbacks const *c, void *user, int *x, int *y, int *comp)
-+STBIDEF int stbi_info_from_callbacks(stbi_io_callbacks const *c, void *user, int *x, int *y, int *comp, float *gamma)
- {
-    stbi__context s;
-    stbi__start_callbacks(&s, (stbi_io_callbacks *) c, user);
--   return stbi__info_main(&s,x,y,comp);
-+   return stbi__info_main(&s,x,y,comp, gamma);
- }
- 
- STBIDEF int stbi_is_16_bit_from_memory(stbi_uc const *buffer, int len)

usd.spec

@@ -2,14 +2,13 @@
 # package version, as a reminder of the need to rebuild dependent packages on
 # every update. See additional notes near the downstream ABI versioning patch.
 # It should be 0.MAJOR.MINOR without leading zeros, e.g. 22.03 → 0.22.3.
-%global downstream_so_version 0.23.11
+%global downstream_so_version 0.26.8
 
 %bcond alembic       1
 %bcond draco         1
 %bcond embree        1
 %bcond jemalloc      0
-# Not yet packaged: https://github.com/AcademySoftwareFoundation/MaterialX
-%bcond materialx     0
+%bcond materialx     1
 # Default "UNIX Makefiles" backend for CMake would also work fine; ninja is a
 # bit faster. We conditionalize it just in case there are backend-specific
 # issues in the future.
@@ -19,19 +18,14 @@
 %bcond ocio          1
 %bcond oiio          1
 %bcond ptex          1
-# Not yet packaged
-%bcond pyside6       0
-# F39FailsToInstall: python3-pyside2, python3-shiboken2,
-# python3-shiboken2-devel
-# https://bugzilla.redhat.com/show_bug.cgi?id=2220452
-%bcond usdview       0
+%bcond usdview       1
 # TODO: Figure out how to re-enable the tests. Currently these want to install
-# into /usr/tests and, and there are issues with the launchers finding the
+# into /usr/tests, and there are issues with the launchers finding the
 # command-line tools in the buildroot.
 %bcond test          0
 
 Name:           usd
-Version:        23.11
+Version:        26.08
 Release:        %autorelease
 Summary:        3D VFX pipeline interchange file format
 
@@ -39,30 +33,40 @@ Summary:        3D VFX pipeline interchange file format
 #
 # Apache-2.0:
 #   - pxr/imaging/hgiVulkan/spirv_reflect.{cpp,h}
+#   - pxr/imaging/plugin/hdEmbree/pxrPbrt/pbrtUtils.h
+#   - pxr/imaging/plugin/hdEmbree/pxrIES/pxr-IES.patch
+#   - pxr/imaging/plugin/hdEmbree/pxrIES/ies.{cpp,h}
 # BSD-3-Clause:
 #   - pxr/base/gf/ilmbase_*
-#   - pxr/base/js/rapidjson/msinttypes/
-#   - pxr/base/tf/pxrCLI11/
-#   - pxr/base/tf/pxrDoubleConversion/
-#   - pxr/imaging/hio/OpenEXR/OpenEXRCore/
+#   - pxr/base/js/rapidjson/msinttypes/ (removed in %%prep)
+#   - pxr/base/tf/pxrCLI11/ (removed in %%prep)
+#   - pxr/base/tf/pxrDoubleConversion/ (removed in %%prep)
+#   - pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/
+#   - pxr/imaging/plugin/hioAvif/AVIF/src/src-libyuv/
 # BSD-2-Clause:
-#   - pxr/base/tf/pxrLZ4/
+#   - pxr/base/tf/pxrLZ4/ (removed in %%prep)
+#   - pxr/imaging/plugin/hioAvif/AVIF/, except
+#     pxr/imaging/plugin/hioAvif/AVIF/src/src-libyuv/;
+#     pxr/imaging/plugin/hioAvif/AVIF/src/avif_obu.c has a different copyright
+#   - pxr/imaging/plugin/hioAvif/aom/
+# BSL-1.0:
+#   - pxr/external/boost/
 # MIT:
 #   - docs/doxygen/doxygen-awesome-css/ (removed in %%prep)
-#   - pxr/base/js/rapidjson/, except pxr/base/js/rapidjson/msinttypes/
-#   - pxr/base/tf/pxrPEGTL/
+#   - pxr/base/js/rapidjson/, except pxr/base/js/rapidjson/msinttypes/ (both
+#     removed in %%prep)
+#   - pxr/base/pegtl/
 #   - pxr/base/tf/pxrTslRobinMap/
 #   - pxr/imaging/garch/khrplatform.h
 #   - pxr/imaging/hgiVulkan/vk_mem_alloc.h
-#   - pxr/imaging/hio/EpenEXR/deflate/
-#   - pxr/usd/sdf/invoke.hpp
-#   - third_party/renderman-24/plugin/rmanArgsParser/pugixml/
+#   - pxr/imaging/plugin/hioOpenEXR/OpenEXR/deflate/ (removed in %%prep)
+#   - third_party/renderman/plugin/rmanArgsParser/pugixml/ (removed in %%prep)
 # MIT OR Unlicense:
 #   - pxr/imaging/hio/stb/
 # Pixar AND GPL-3.0-or-later WITH Bison-exception-2.2:
 #   - pxr/usd/sdf/path.tab.{cpp,h}
 #   - pxr/usd/sdf/textFileFormat.tab.{cpp,h}
-#   - third_party/renderman-24/plugin/hdPrman/virtualStructConditionalGrammar.tab.{cpp,h}
+#   - third_party/renderman/plugin/hdPrman/virtualStructConditionalGrammar.tab.{cpp,h}
 #
 # Additionally, the following would be listed above but are removed in %%prep:
 #
@@ -76,11 +80,16 @@ Summary:        3D VFX pipeline interchange file format
 #
 # (Certain build system files are also under licenses other than Apache-2.0, but
 # do not contribute their license terms to the built RPMs.)
+#
+# Note that the license assigned the SPDX identifier Pixar was later officially
+# named Tomorrow Open Source Technology License 1.0, TOST-1.0, with no change
+# to its terms.
 License:        %{shrink:
                 Pixar AND
                 Apache-2.0 AND
                 BSD-3-Clause AND
                 BSD-2-Clause AND
+                BSL-1.0 AND
                 MIT AND
                 (MIT OR Unlicense) AND
                 (Pixar AND GPL-3.0-or-later WITH Bison-exception-2.2)
@@ -89,13 +98,6 @@ URL:            http://www.openusd.org/
 %global forgeurl https://github.com/PixarAnimationStudios/OpenUSD
 Source0:        %{forgeurl}/archive/v%{version}/OpenUSD-%{version}.tar.gz
 Source1:        org.openusd.usdview.desktop
-# Latest stb_image.patch that applies cleanly against 2.27:
-#   %%{forgeurl}/raw/8f9bb9563980b41e7695148b63bf09f7abd38a41/pxr/imaging/hio/stb/stb_image.patch
-# We treat this as a source file because it is applied separately during
-# unbundling. It has been hand-edited to apply to 2.28, where
-# stbi__unpremultiply_on_load_thread is already renamed to
-# stbi_set_unpremultiply_on_load_thread.
-Source2:        stb_image.patch
 
 # Downstream-only: add an SONAME version
 #
@@ -125,11 +127,38 @@ Source2:        stb_image.patch
 # built with -DPXR_BUILD_EXAMPLES=OFF, but it is.)
 Patch:          0001-Downstream-only-add-an-SONAME-version.patch
 
-# Port to Embree 4.x
-# https://github.com/PixarAnimationStudios/USD/pull/2266
-Patch:          %{forgeurl}/pull/2266.patch
+# Downstream-only: use Valgrind macro instead of inline assembly
+#
+# Upstream already has a plan to make this change, but is waiting to be
+# able to add a build dependency on valgrind-devel. We have no such
+# obstacle, and this change fixes the inline assembly failing to compile
+# on aarch64.
+Patch:          0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch
 
-Patch:          USD-23.05-tbb2020.3.patch
+# Downstream-only: use the system double-conversion library
+Patch:          0001-Downstream-only-use-the-system-double-conversion-lib.patch
+# Downstream-only: use the system lz4 library
+Patch:          0002-Downstream-only-use-the-system-lz4-library.patch
+# Downstream-only: use the system pugixml library
+Patch:          0003-Downstream-only-use-the-system-pugixml-library.patch
+# Downstream-only: use the system rapidjson library
+Patch:          0004-Downstream-only-use-the-system-rapidjson-library.patch
+# Downstream-only: use the system libdeflate library
+Patch:          0005-Downstream-only-use-the-system-libdeflate.patch
+# Downstream-only: use the system libavif library
+Patch:          0006-Downstream-only-use-the-system-libavif.patch
+
+# Backport fixes for CVE-2025-64181 etc. in OpenEXRCore
+# https://github.com/PixarAnimationStudios/OpenUSD/pull/3903
+Patch:          %{forgeurl}/pull/3903.patch
+
+# Replace PyWeakref_GetObject with PyWeakref_GetRef
+# Fixes RHBZ#2433881. This patch is LLM-generated and needs expert human
+# review, but it at least builds. See discussion in
+# https://bugzilla.redhat.com/show_bug.cgi?id=2433881.
+# Mentioned upstream in
+# https://github.com/PixarAnimationStudios/OpenUSD/issues/3966#issuecomment-5128542913.
+Patch:          0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch
 
 # Base
 BuildRequires:  gcc-c++
@@ -143,14 +172,31 @@ BuildRequires:  dos2unix
 BuildRequires:  help2man
 
 BuildRequires:  pkgconfig(blosc)
-BuildRequires:  boost-devel
 BuildRequires:  pkgconfig(dri)
 BuildRequires:  hdf5-devel
-BuildRequires:  opensubdiv-devel
-BuildRequires:  pkgconfig(tbb) = 2020.3
+BuildRequires:  cmake(OpenSubdiv)
+BuildRequires:  pkgconfig(tbb)
+# This seems to be an indirect dependency, probably through OpenSubdiv.
+# Ideally, everything would take care of its own dependencies, and we wouldn’t
+# have to specify it directly, but we haven’t studied the problem closely
+# enough to propose a fix.
+BuildRequires:  pkgconfig(OpenCL)
+# Unbundled:
+BuildRequires:  cmake(double-conversion)
+BuildRequires:  pkgconfig(liblz4)
+BuildRequires:  cli11-devel cli11-static
+BuildRequires:  cmake(pugixml)
+BuildRequires:  rapidjson-devel rapidjson-static
+BuildRequires:  robin-map-devel robin-map-static
+BuildRequires:  pkgconfig(libdeflate)
+# Unbundling this means we also use external versions of libaom and libyuv.
+BuildRequires:  pkgconfig(libavif)
 
 BuildRequires:  cmake(Imath) >= 3.0
 
+# Introduced by 0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch
+BuildRequires:  valgrind-devel
+
 %if %{with alembic}
 BuildRequires:  cmake(Alembic)
 %endif
@@ -167,6 +213,13 @@ BuildRequires:  embree-devel
 BuildRequires:  pkgconfig(jemalloc)
 %endif
 
+%if %{with materialx}
+BuildRequires:  cmake(materialx)
+BuildRequires:  materialx-data
+BuildRequires:  pkgconfig(xt)
+BuildRequires:  python3-materialx
+%endif
+
 %if %{with ocio}
 BuildRequires:  cmake(OpenColorIO)
 %endif
@@ -185,10 +238,9 @@ BuildRequires:  openvdb-devel
 %endif
 
 %if %{with ptex}
-BuildRequires:  pkgconfig(Ptex)
+BuildRequires:  cmake(ptex)
 %endif
 
-
 # Header-only library: -static is for tracking per guidelines
 #
 # Enforce the the minimum EVR to contain fixes for all of:
@@ -203,12 +255,11 @@ BuildRequires:  pkgconfig(Ptex)
 # CVE-2023-45664
 # CVE-2023-45666
 # CVE-2023-45667
-BuildRequires:  stb_image-devel >= 2.28^20231011gitbeebb24-12
-BuildRequires:  stb_image-static
-BuildRequires:  stb_image_write-devel >= 1.16
-BuildRequires:  stb_image_write-static
-BuildRequires:  stb_image_resize-devel >= 0.97
-BuildRequires:  stb_image_resize-static
+# https://github.com/nothings/stb/issues/1860
+# https://github.com/nothings/stb/issues/1861
+BuildRequires:  stb_image-static >= 2.30^20251025gitf1c79c0-2
+BuildRequires:  stb_image_write-static >= 1.16
+BuildRequires:  stb_image_resize-static >= 0.97
 
 Requires:       usd-libs%{?_isa} = %{version}-%{release}
 Requires:       python3-usd%{?_isa} = %{version}-%{release}
@@ -219,7 +270,7 @@ Requires:       python3-usd%{?_isa} = %{version}-%{release}
 #
 # Note that pxr/base/arch/assumptions.cpp explicitly tests the machine is not
 # big-endian, and pxr/base/arch/defines.h explicitly enforces x86_64 or ARM64.
-ExclusiveArch:  aarch64 x86_64
+ExclusiveArch:  %{arm64} %{x86_64}
 
 %description
 Universal Scene Description (USD) is a time-sampled scene
@@ -234,40 +285,124 @@ Summary:        Universal Scene Description library
 # See also:
 #   Path to using external/system copies of OpenEXRCore and libdeflate?
 #   https://github.com/PixarAnimationStudios/OpenUSD/issues/2619
-# Version from: pxr/base/tf/pxrDoubleConversion/README
-Provides:       bundled(double-conversion) = 2.0.0
 # Version from: pxr/base/gf/ilmbase_half.README
+#
+# This is difficult to unbundle even in the manner of double-conversion: code
+# that uses the half type is compatible with ilmbase version 2 (as packaged in
+# openexr2) rather than version 3 (as packaged in the ilmbase package).
+# Unfortunately, we need cmake(Imath) elsewhere in the package, and this comes
+# from the imath package (version 3), which conflicts with the imath version 2
+# libraries included with openexr2. So this will not be possible until the
+# surrounding code is patched (upstream or downstream) for compatibility with
+# ilmbase version 3, something we’re currently not willing to attempt.
 Provides:       bundled(ilmbase) = 2.5.3
+# Version from: pxr/base/pegtl/pegtl/version.hpp
+# Currently, Fedora’s PEGTL is too old:
+# https://bugzilla.redhat.com/show_bug.cgi?id=1902427
+Provides:       bundled(PEGTL) = 3.2.7
+# Version from
+# pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/openexr_version.h
+# From pxr/imaging/plugin/hioOpenEXR/OpenEXR/README.md:
+#   A few changes are still in progress to upstreamed to the OpenEXR project,
+#   but these are minor, and otherwise, almost all differences between the
+#   interred OpenEXRCore and the official OpenEXR repo are consolidated to the
+#   openexr_conf.h header. The remaining differences are removing an extern
+#   marking from the few global data tables.
+# This suggests that it may not be entirely safe to unbundle this.
+Provides:       bundled(openexr) = 3.2.0
+# Version from the message for the commit
+# e7a8d718c7c113e1c653ee31dc52421f17e09b42 that introduced pxr/external/boost/:
+#
+#   python: Initial import of boost::python from boost 1.85.0
+#   This change just brings boost::python into the tree as a starting point for
+#   the pxr_boost::python implementation. The src/ and test/ directories are
+#   placed next to the public headers since we don't have separate
+#   public/private directory hierarchies like boost, but the code itself is
+#   unchanged and not included in the build.
+#
+#   We use boost 1.85.0 as the starting point even though we're currently on
+#   VFX Reference Platform 2022, which specifies boost 1.76.0. This is because
+#   later versions of boost are needed for other platforms and versions of
+#   Python that OpenUSD supports. For example Python 3.11 requires boost
+#   1.82.0+.
+#
+# This is not a candidate for unbundling because upstream has explicitly forked
+# boost::python and modified it to work without the rest of Boost as part of an
+# effort to remove the Boost dependency. While pxr_boost::python is derived
+# from boost::python, it is not intended to remain compatible with it.
+Provides:       bundled(boost) = 1.85.0
+# From LICENSE.txt:
+# ===========================================================
+# PBRT (Sampling functions)
+# ============================================================
+# USD includes code derived from the pbrt-v4 library, retrieved from
+# https://github.com/mmp/pbrt-v4/tree/8c19f304558fd7681e2fef2c395a689d0106fb05, which was
+# provided subject to the unmodified Apache 2.0 license. For details, see
+# https://github.com/mmp/pbrt-v4/blob/8c19f304558fd7681e2fef2c395a689d0106fb05/LICENSE.txt
+#
+# The bundled routines in pxr/imaging/plugin/hdEmbree/pxrPbrt/pbrtUtils.h are
+# just a handful of small internal utility functions. It would not be
+# reasonable to add a dependency on the full pbrt ray tracer even if these were
+# exposed in a public API.
+Provides:       bundled(pbrt-v4) = 4~20251208.8c19f30
+# From LICENSE.txt:
+# ============================================================
+# Cycles (IES reader)
+# ============================================================
+# USD includes classes from the Blender Foundation's Cycles project, retrieved from
+# https://projects.blender.org/blender/cycles/src/commit/0be21d452506ec90259b9063c28b5a6fc1cac6a1,
+# which was provided subject to the unmodified Apache 2.0 license. For details, see
+# https://projects.blender.org/blender/cycles/src/commit/0be21d452506ec90259b9063c28b5a6fc1cac6a1/LICENSE
+#
+# These are not a candidate for unbundling because they are internal utility
+# functions not available in the public API. There are also some minor
+# modifications for OpenUSD, documented in
+# pxr/imaging/plugin/hdEmbree/pxrIES/pxr-IES.patch.
+#
+# Is this commit a post-release snapshot of 4.5.0, or a pre-release snapshot of
+# 5.0.0? How can we tell? There doesn’t seem to be a project version number
+# embedded in the source tree. Since this commit hash is only two commits ahead
+# of the v4.5.0 tag, we consider it a 4.5.0 post-release.
+Provides:       bundled(cycles) = 4.5.0^20251210.0be21d4
+
+# We are currently able to unbundle these and use system libraries, but we
+# retain the virtual Provides, commented out, as documentation and in case we
+# ever have to switch back to the bundled versions.
+#
+# Version from: pxr/base/tf/pxrDoubleConversion/README
+# Provides:       bundled(double-conversion) = 3.3.0
 # Version from: pxr/base/tf/pxrLZ4/lz4.h (LZ4_VERSION_{MAJOR,MINOR_PATCH})
-Provides:       bundled(lz4) = 1.9.2
+# Provides:       bundled(lz4) = 1.9.2
 # Version from: pxr/base/tf/pxrCLI11/README.md
-Provides:       bundled(cli11) = 2.3.1
+# Provides:       bundled(cli11) = 2.3.1
 # Version from:
-# third_party/renderman-24/plugin/rmanArgsParser/pugixml/pugiconfig.hpp
+# third_party/renderman/plugin/rmanArgsParser/pugixml/pugiconfig.hpp
 # (header comment)
-Provides:       bundled(pugixml) = 1.9
+# Provides:       bundled(pugixml) = 1.9
 # Version from: pxr/base/js/rapidjson/rapidjson.h
 # (RAPIDJSON_{MAJOR,MINOR,PATCH}_VERSION)
-Provides:       bundled(rapidjson) = 1.1.0
-# Version from: pxr/imaging/hgiVulkan/spirv_reflect.h (header comment)
-Provides:       bundled(SPIRV-Reflect) = 1.0
-# Version from: pxr/imaging/hgiVulkan/vk_mem_alloc.h (header comment)
-Provides:       bundled(VulkanMemoryAllocator) = 3.0.0~development
-# Forked from an unknown version: pxr/base/tf/pxrTslRobinMap/
-Provides:       bundled(robin-map)
-# Version from: pxr/base/tf/pxrPEGTL/pegtl.h (TAO_PEGTL_VERSION)
-Provides:       bundled(PEGTL) = 2.8.3
-# Version from pxr/imaging/hio/OpenEXR/OpenEXRCore/openexr_version.h
-Provides:       bundled(openexr) = 3.2.0
-# Version from pxr/imaging/hio/OpenEXR/deflate/libdeflate.h
-Provides:       bundled(libdeflate) = 1.18
-# Forked from https://github.com/blackmatov/invoke.hpp, which upstream has
-# never versioned; however, a copyright statement appears in the header comment
-# in pxr/usd/sdf/invoke.hpp with a date of 2023, and the only upstream commit
-# with the same date (as of this writing) is
-# 2c1eabc2e20ab02961f95c704ff0c0818671ddd1, so we infer that the bundled copy
-# was forked from that commit.
-Provides:       bundled(invoke-hpp) = 0^20230107git2c1eabc
+# Provides:       bundled(rapidjson) = 1.1.0
+# Version from: pxr/base/tf/pxrTslRobinMap/robin_growth_policy.h
+# (PXR_TSL_RH_VERSION_{MAJOR,MINOR,PATCH})
+# Provides:       bundled(robin-map) = 1.3.0
+# Version from pxr/imaging/plugin/hioOpenEXR/OpenEXR/deflate/libdeflate.h
+# Provides:       bundled(libdeflate) = 1.18
+# Version from pxr/imaging/plugin/hioAvif/AVIF/src/avif/avif.h
+#   We actually have a post-release snapshot of libavif, because
+#   AVIF_VERSION_DEVEL is nonzero, but it’s not easy to determine which commit
+#   hash it was copied from.
+# Provides:       bundled(libavif) = 1.0.1
+# Version from pxr/imaging/plugin/hioAvif/AVIF/src/src-libyuv/libyuv/version.h
+# LIBYUV_VERSION is a “serial number” version, e.g. 1895, that gets incremented
+# every time changes are dumped into git from an internal VCS; the libyuv
+# package in Fedora is considered to have version 0 and uses snapshot
+# versioning. We can dig through
+# https://chromium.googlesource.com/libyuv/libyuv and find the commit hash that
+# corresponds to a particular serial number.
+# LIBYUV_VERSION 1895 = commit a97746349b244efd54ab1eb0c0a7366717b33f39
+# Provides:       bundled(libyuv) = 0^20240812.a977463
+# Version from pxr/imaging/plugin/hioAvif/config/aom_version.h
+# Provides:       bundled(aom) = 3.0.0
 
 %description libs
 Universal Scene Description (USD) is an efficient, scalable system for
@@ -278,6 +413,15 @@ interchange between graphics applications.
 Summary:        Development files for USD
 Requires:       usd-libs%{?_isa} = %{version}-%{release}
 
+# Unbundled, and exposed in the API:
+Requires:       cli11-devel cli11-static
+Requires:       robin-map-devel robin-map-static
+# Needed by cmake config
+Requires:       cmake(OpenSubdiv)
+%if %{with materialx}
+Requires:       cmake(materialx)
+%endif
+
 %description devel
 This package contains the C++ header files and symbolic links to the shared
 libraries for usd. If you would like to develop programs using usd,
@@ -288,30 +432,22 @@ you will need to install usd-devel.
 Summary: %{summary}
 
 BuildRequires:  pkgconfig(python3)
-BuildRequires:  pkgconfig(Qt5)
 BuildRequires:  python3dist(jinja2)
 %if %{with usdview}
 BuildRequires:  desktop-file-utils
-%if %{with pyside6}
 BuildRequires:  python3dist(pyside6)
-%else
-BuildRequires:  python3dist(pyside2)
-%endif
-%endif
+BuildRequires:  pyside6-tools
 BuildRequires:  python3dist(pyopengl)
+%endif
 Requires:       font(roboto)
 Requires:       font(robotoblack)
 Requires:       font(robotolight)
 Requires:       font(robotomono)
 Requires:       python3dist(jinja2)
 %if %{with usdview}
-%if %{with pyside6}
 Requires:       python3dist(pyside6)
-%else
-Requires:       python3dist(pyside2)
-%endif
-%endif
 Requires:       python3dist(pyopengl)
+%endif
 
 Requires:       usd-libs%{?_isa} = %{version}-%{release}
 
@@ -344,7 +480,7 @@ ln -s %{_datadir}/fonts/google-roboto-mono \
 # Unbundle stb_image, stb_image_write, stb_image_resize:
 pushd pxr/imaging/hio/stb
 cp -p %{_usr}/include/stb_image.h .
-patch -p1 < '%{SOURCE2}'
+patch -p1 < stb_image.patch
 ln -svf %{_usr}/include/stb_image_resize.h \
     %{_usr}/include/stb_image_write.h ./
 popd
@@ -353,21 +489,91 @@ popd
 # building Doxygen-generated HTML documentation.
 rm -rf docs/doxygen/doxygen-awesome-css/
 
+# Remove the bundled copy of double-conversion.
+#
+# From pxr/base/tf/pxrDoubleConversion/README, the upstream double-conversion
+# is patched with pxr/base/tf/pxrDoubleConversion/pxr-double-conversion.patch;
+# examination of that patch shows that it merely adds namespaces and renames
+# symbols, rather than making functional changes, so using the system library
+# should be safe.
+find pxr/base/tf/pxrDoubleConversion -type f ! -name '*.h' -print -delete
+for hdr in pxr/base/tf/pxrDoubleConversion/*.h
+do
+  cat > "${hdr}" <<EOF
+#include <double-conversion/$(basename "${hdr}")>
+namespace pxr_double_conversion = double_conversion;
+EOF
+done
+# Similarly, remove the bundled copy of lz4. Change in the bundled copy can be
+# identified by source-code comments, and appear to be limited to adding
+# namespaces and removing C linkage.
+rm -v pxr/base/tf/pxrLZ4/*
+cat > pxr/base/tf/pxrLZ4/lz4.h <<'EOF'
+#include <lz4.h>
+// System LZ4 has C linkage; this just allows "using namespace"
+namespace pxr_lz4 {}
+EOF
+# Remove the bundled copy of cli11.
+rm -v pxr/base/tf/pxrCLI11/*
+cat > pxr/base/tf/pxrCLI11/CLI11.h <<'EOF'
+#include <CLI/CLI.hpp>
+namespace pxr_CLI = CLI;
+EOF
+# Remove the bundled copy of pugixml.
+find third_party/renderman/plugin/rmanArgsParser/pugixml/ \
+    -type f ! -name '*.hpp' -print -delete
+for hdr in third_party/renderman/plugin/rmanArgsParser/pugixml/*.hpp
+do
+  cat > "${hdr}" <<EOF
+#include <$(basename "${hdr}")>
+EOF
+done
+# Remove the bundled copy of rapidjson. It does not seem to have been modified
+# or forked at all.
+rm -rv pxr/base/js/rapidjson/
+# Remove the bundled copy of robin-map. There are several macros that are
+# renamed from TSL_*/tsl_* to PXR_TSL_*/pxr_tsl_* in the bundled copy, and we
+# could “alias” these if necessary to avoid patching call sites, but for now
+# are not used outside the library headers and we can get by with merely
+# aliasing the namespace.
+find pxr/base/tf/pxrTslRobinMap -type f ! -name '*.h' -print -delete
+for hdr in pxr/base/tf/pxrTslRobinMap/*.h
+do
+  cat > "${hdr}" <<EOF
+#include <tsl/$(basename "${hdr}")>
+namespace pxr_tsl = tsl;
+EOF
+done
+# Remove the bundled copy of libdeflate.
+rm -rv pxr/imaging/plugin/hioOpenEXR/OpenEXR/deflate/
+# Remove the bundled copies of libavif, along with the associated libaom and
+# the libyuv that is in the libavif sources.
+rm -rv pxr/imaging/plugin/hioAvif/aom/ \
+    pxr/imaging/plugin/hioAvif/AVIF/
+
 # Use c++17 standard otherwise build fails
 sed -i 's|set(CMAKE_CXX_STANDARD 14)|set(CMAKE_CXX_STANDARD 17)|g' \
         cmake/defaults/CXXDefaults.cmake
 
 # Fix libdir installation
-sed -i 's|lib/usd|%{_libdir}/usd|g' cmake/macros/Private.cmake
-sed -i 's|"lib"|%{_libdir}|g' cmake/macros/Private.cmake
+sed -i 's|lib/usd|%{_libdir}/usd|g' \
+        cmake/macros/{Private,Public}.cmake
 sed -i 's|plugin/usd|%{_libdir}/usd/plugin|g' \
-        cmake/macros/Private.cmake
+        cmake/macros/{Private,Public}.cmake
+sed -i 's|"lib"|%{_libdir}|g' \
+        cmake/macros/{Private,Public}.cmake
 sed -i 's|/python|/python%{python3_version}/site-packages|g' \
-        cmake/macros/Private.cmake
-sed -i 's|lib/usd|%{_libdir}/usd|g' cmake/macros/Public.cmake
-sed -i 's|"lib"|%{_libdir}|g' cmake/macros/Public.cmake
-sed -i 's|plugin/usd|%{_libdir}/usd/plugin|g' \
-        cmake/macros/Public.cmake
+        cmake/macros/{Private,Public}.cmake pxr/usdImaging/usdviewq/CMakeLists.txt
+sed -i 's|/pxrConfig.cmake|%{_libdir}/cmake/pxr/pxrConfig.cmake|g' \
+        pxr/CMakeLists.txt
+sed -i 's|"cmake"|"%{_libdir}/cmake/pxr"|g' \
+        pxr/CMakeLists.txt
+sed -i 's|${PXR_CMAKE_DIR}/cmake|${PXR_CMAKE_DIR}|g' \
+        pxr/pxrConfig.cmake.in
+sed -i 's|${PXR_CMAKE_DIR}/include|/usr/include|g' \
+        pxr/pxrConfig.cmake.in
+sed -i 's|EXACT COMPONENTS|COMPONENTS|g' \
+        pxr/pxrConfig.cmake.in
 
 # Fix cmake directory destination
 sed -i 's|"${CMAKE_INSTALL_PREFIX}"|%{_libdir}/cmake/pxr|g' pxr/CMakeLists.txt
@@ -377,13 +583,6 @@ sed -i 's|"${CMAKE_INSTALL_PREFIX}"|%{_libdir}/cmake/pxr|g' pxr/CMakeLists.txt
 find . -type f -exec gawk '/embree3/ { print FILENAME }' '{}' '+' |
   xargs -r sed -r -i 's/(embree)3/\14/'
 
-# Fix uic-qt5 use
-cat > uic-wrapper <<'EOF'
-#!/bin/sh
-exec uic-qt5 -g python "$@"
-EOF
-chmod +x uic-wrapper
-
 
 %build
 # The necessary include path for Imath is not set everywhere it’s needed. It’s
@@ -412,20 +611,21 @@ extra_flags="${extra_flags-} -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1"
      -DCMAKE_SKIP_RPATH=ON \
      -DCMAKE_VERBOSE_MAKEFILE=ON \
      \
-     -DPXR_BUILD_DOCUMENTATION=FALSE \
+     -DPXR_BUILD_HTML_DOCUMENTATION=FALSE \
+     -DPXR_BUILD_PYTHON_DOCUMENTATION=FALSE \
      -DPXR_BUILD_EXAMPLES=OFF \
      -DPXR_BUILD_IMAGING=ON \
      -DPXR_BUILD_MONOLITHIC=ON \
      -DPXR_BUILD_TESTS=%{expr:%{with test}?"ON":"OFF"} \
      -DPXR_BUILD_TUTORIALS=OFF \
      -DPXR_BUILD_USD_IMAGING=ON \
+     -DPXR_BUILD_EXEC=ON \
      -DPXR_BUILD_USD_TOOLS=ON \
      -DPXR_BUILD_USDVIEW=%{expr:%{with usdview}?"ON":"OFF"} \
      \
      -DPXR_BUILD_ALEMBIC_PLUGIN=%{expr:%{with alembic}?"ON":"OFF"} \
      -DPXR_BUILD_DRACO_PLUGIN=%{expr:%{with draco}?"ON":"OFF"} \
      -DPXR_BUILD_EMBREE_PLUGIN=%{expr:%{with embree}?"ON":"OFF"} \
-     -DPXR_BUILD_MATERIALX_PLUGIN=%{expr:%{with materialx}?"ON":"OFF"} \
      -DPXR_BUILD_OPENCOLORIO_PLUGIN=%{expr:%{with ocio}?"ON":"OFF"} \
      -DPXR_BUILD_OPENIMAGEIO_PLUGIN=%{expr:%{with oiio}?"ON":"OFF"} \
      -DPXR_BUILD_PRMAN_PLUGIN=OFF \
@@ -435,13 +635,14 @@ extra_flags="${extra_flags-} -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1"
      -DPXR_ENABLE_PTEX_SUPPORT=%{expr:%{with ptex}?"ON":"OFF"} \
      -DPXR_ENABLE_OSL_SUPPORT=%{expr:%{with openshading}?"ON":"OFF"} \
      -DPXR_ENABLE_MALLOCHOOK_SUPPORT=OFF \
+     -DPXR_ENABLE_MATERIALX_SUPPORT=%{expr:%{with materialx}?"ON":"OFF"} \
      -DPXR_ENABLE_PYTHON_SUPPORT=ON \
      \
      -DPXR_INSTALL_LOCATION="%{_libdir}/usd/plugin" \
      \
      -DPXR_VALIDATE_GENERATED_CODE=OFF \
      \
-     -DPYSIDEUICBINARY:PATH=${PWD}/uic-wrapper \
+     -DPYSIDEUICBINARY:PATH=pyside6-uic \
      -DPYSIDE_AVAILABLE=ON \
      -DPYTHON_EXECUTABLE=%{python3}
 %cmake_build
@@ -453,6 +654,10 @@ extra_flags="${extra_flags-} -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1"
 mkdir -p %{buildroot}%{python3_sitearch}
 mv %{buildroot}%{python3_sitelib}/* %{buildroot}%{python3_sitearch}
 
+# Upstream may expect to use this as a script in development, but we install it
+# without executable permissions, so we remove the shebang.
+sed -r -i '1{/^#!/d}' '%{buildroot}%{python3_sitearch}/pxr/Usd/usdGenSchema.py'
+
 %if %{with usdview}
 # Install a desktop icon for usdview
 desktop-file-install                                    \
@@ -460,24 +665,15 @@ desktop-file-install                                    \
 %{SOURCE1}
 %endif
 
+# Little hack until this issue is resolved
+# https://github.com/PixarAnimationStudios/OpenUSD/issues/3310
+sed -i 's|OpenGL::GL|${OPENGL_gl_LIBRARY}|g' \
+        %{buildroot}%{_libdir}/cmake/pxr/pxrTargets.cmake
+
 # Remove examples that were built and installed even though we set
 # -DPXR_BUILD_EXAMPLES=OFF.
 rm -vrf '%{buildroot}%{_datadir}/usd/examples'
 
-# Fix installation path for some files
-mv %{buildroot}%{_prefix}/lib/python/pxr/*.* \
-        %{buildroot}%{python3_sitearch}/pxr/
-%if %{with usdview}
-mv %{buildroot}%{_prefix}/lib/python/pxr/Usdviewq/* \
-        %{buildroot}%{python3_sitearch}/pxr/Usdviewq/
-%endif
-
-# TODO: Can we figure out how to fix the installation path for
-# pxrTargets{,-release}.cmake, instead of moving them after the fact? We choose
-# to put them in the same directory as pxrConfig.cmake.
-find %{buildroot}%{_prefix}/cmake -mindepth 1 -maxdepth 1 -type f \
-    -exec mv -v '{}' '%{buildroot}%{_libdir}/cmake/pxr' ';'
-
 # Generate and install man pages. While generating the man pages might more
 # properly go in %%build, it is generally much easier to do this here in a
 # single step, using the entry points installed into the buildroot. This is
@@ -502,9 +698,14 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
 %files
 %doc NOTICE.txt README.md
 
+%{_bindir}/hdGenSchema
 %{_bindir}/sdfdump
 %{_bindir}/sdffilter
+%if %{with materialx}
+%{_bindir}/usdBakeMaterialX
+%endif
 %{_bindir}/usdGenSchema
+%{_bindir}/usdInitSchema
 %{_bindir}/usdcat
 %{_bindir}/usdchecker
 %if %{with draco}
@@ -515,11 +716,13 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
 %{_bindir}/usdedit
 %{_bindir}/usdfixbrokenpixarschemas
 %{_bindir}/usdgenschemafromsdr
+%{_bindir}/usdmeasureperformance
 %{_bindir}/usdrecord
 %{_bindir}/usdresolve
 %{_bindir}/usdstitch
 %{_bindir}/usdstitchclips
 %{_bindir}/usdtree
+%{_bindir}/usdupdatecrate
 %{_bindir}/usdzip
 %if %{with usdview}
 %{_datadir}/applications/org.openusd.usdview.desktop
@@ -527,9 +730,14 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
 %{_bindir}/usdview
 %endif
 
+%{_mandir}/man1/hdGenSchema.1*
 %{_mandir}/man1/sdfdump.1*
 %{_mandir}/man1/sdffilter.1*
+%if %{with materialx}
+%{_mandir}/man1/usdBakeMaterialX.1*
+%endif
 %{_mandir}/man1/usdGenSchema.1*
+%{_mandir}/man1/usdInitSchema.1*
 %{_mandir}/man1/usdcat.1*
 %{_mandir}/man1/usdchecker.1*
 %if %{with draco}
@@ -540,11 +748,13 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
 %{_mandir}/man1/usdedit.1*
 %{_mandir}/man1/usdfixbrokenpixarschemas.1*
 %{_mandir}/man1/usdgenschemafromsdr.1*
+%{_mandir}/man1/usdmeasureperformance.1*
 %{_mandir}/man1/usdrecord.1*
 %{_mandir}/man1/usdresolve.1*
 %{_mandir}/man1/usdstitch.1*
 %{_mandir}/man1/usdstitchclips.1*
 %{_mandir}/man1/usdtree.1*
+%{_mandir}/man1/usdupdatecrate.1*
 %{_mandir}/man1/usdzip.1*
 %if %{with usdview}
 %{_mandir}/man1/testusdview.1*