amdapp-sdk-opencv
maintainer rigred
· 84 votes
· base
amdapp-sdk
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The PKGBUILD downloads a prebuilt AMD APP SDK installer tarball (a self-extracting shell script executed in the build() function via `bash ${_scriptname}${_bits}.sh --noexec --target ...`) from archive.org rather than the official AMD developer domain. Archive.org is a third-party host where the content of a specific item can be replaced or tampered with by the uploader, and the URL is not immutable in the same way a versioned release artifact on an official vendor CDN would be. The sha256sums are architecture-conditional (set at parse time via shell logic), which is a non-standard but functional pattern. The checksums do exist and are architecture-specific, providing some integrity guarantee, but the trust anchor is archive.org rather than AMD's own infrastructure. Since the tarball contains a self-extracting installer that is directly executed during build, a compromised archive.org item would result in arbitrary code execution. This is a genuine medium-severity supply-chain concern: executed binary/installer from a non-official host, not clearly malicious but not verifiable against the original vendor.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:49
"https://archive.org/download/AMDAPPSDK/${_dirname}${_bits}.tar.bz2"
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt AMD APP SDK installer tarball (a self-extracting shell script executed in the build() function via `bash ${_scriptname}${_bits}.sh --noexec --target ...`) from archive.org rather than the official AMD developer domain. Archive.org is a third-party host where the content of a specific item can be replaced or tampered with by the uploader, and the URL is not immutable in the same way a versioned release artifact on an official vendor CDN would be. The sha256sums are architecture-conditional (set at parse time via shell logic), which is a non-standard but functional pattern. The checksums do exist and are architecture-specific, providing some integrity guarantee, but the trust anchor is archive.org rather than AMD's own infrastructure. Since the tarball contains a self-extracting installer that is directly executed during build, a compromised archive.org item would result in arbitrary code execution. This is a genuine medium-severity supply-chain concern: executed binary/installer from a non-official host, not clearly malicious but not verifiable against the original vendor.
PKGBUILD
1 offending line(s) highlighted
1
# NOTE: you have to download archive directly from https://developer.amd.com/amd-accelerated-parallel-processing-app-sdk/
2
# ie. for x86_64 - AMD-APP-SDKInstaller-v3.0.130.136-GA-linux64.tar.bz2
3
# and paste it next to this PKGBUILD
4
5
# Maintainer: satcom886 <rostik.medved@gmail.com>
6
# Previous Maintainer: Vi0L0 <vi0l093@gmail.com>
7
# Previous Previous Maintainer: Michael Krause <mk-arch@spline.de>
8
# Contributor: kralyk
9
# Contributor: pfdm
10
# Contributor: caust1c
11
# Contributor: kralyk (download execution)
12
# Contributor: satcom886 (fixed download links)
13
14
# PKGEXT=".tar.gz" # time to pack this pkg into tar.xz is long, unfortunatelly yaourt got problems when ext is different than .pkg.tar.xz - V
15
16
17
pkgbase=amdapp-sdk
18
pkgname=('amdapp-sdk' 'amdapp-sdk-opencv' 'amdapp-sdk-nocatalyst' 'amdapp-sdk-docs')
19
pkgver=3.0
20
pkgrel=23
21
arch=('i686' 'x86_64')
22
url="https://developer.amd.com/amd-accelerated-parallel-processing-app-sdk/"
23
license=("custom")
24
options=('staticlibs' 'libtool' '!strip')
25
groups=('amdapp')
26
makedepends=('perl' 'llvm' 'apache-ant' 'wget')
27
_dirname='AMD-APP-SDKInstaller-v3.0.130.136-GA-linux'
28
_scriptname='AMD-APP-SDK-v3.0.130.136-GA-linux'
29
30
#Architecture resolution
31
if [ "$CARCH" = 'i686' ]; then
32
_bits=32
33
_arch=x86
34
# _tarbits=x86
35
# _tarbits=32-1
36
else _bits=64
37
_arch=x86_64
38
# _tarbits=x64
39
# _tarbits=64
40
fi
41
42
[ "$CARCH" = 'i686' ] && _hash='181fb9815e735c90ca5713acc27a6f9ed7f85135d2f2a085bed7b4c7ed157b94' \
43
|| _hash='0aa436acd334b686820bd3caab9f09014608741b92e3996d3642d0b148ede0f7'
44
45
#Sources
46
source=(
47
# "http://developer.amd.com/wordpress/media/files/AMD-APP-SDK-linux-v2.9-1.599.381-GA-${_tarbits}.tar.bz2"
48
# "http://developer.amd.com/wordpress/media/files/${_dirname}${_bits}.tar.bz2"
49
"https://archive.org/download/AMDAPPSDK/${_dirname}${_bits}.tar.bz2"
50
'amd.icd'
51
'amd_i686.icd'
52
'amdapp-sdk.sh'
53
'amdapp-sdk.conf')
54
55
#sha256sums
56
sha256sums=(
57
${_hash}
58
'0b7465f250f667a240ea4a46ae07e9f193f7ede4975c611fd77b06cb98478169'
59
'77cb18c5a588e02c73c2406e1057461b6c030b97534154aa3163cbfb9b7e97b7'
60
'dffe3d16ae07fafe6571c37f97f73e694891a7ea7888fc7f0a5d0e42b997e50f'
61
'c871a5044dd19e710b9ff058faa4e40f9b825b27d3928d535bc452116dba3b95')
62
63
_subdir="${_dirname}${_bits}"
64
65
#Install path
66
_ipath='opt/AMDAPP/SDK'
67
68
69
build() {
70
bash ${_scriptname}${_bits}.sh --noexec --target ${srcdir}/${_subdir}
71
}
72
73
74
package_amdapp-sdk() {
75
pkgdesc="AMD Accelerated Parallel Processing (APP) SDK, 3.0 with OpenCL 2.0 support."
76
install=amdapp-sdk.install
77
provides=('opencl-amd' 'opencl' 'amdstream' 'opencl-driver' )
78
depends=('opencl-icd-loader' 'libgl' 'llvm' 'gcc-libs' 'mesa' 'glut' 'glew' 'glu')
79
conflicts=('amdstream')
80
optdepends=(
81
'opencl-headers: for development'
82
'catalyst: for OpenCL on AMD GPU'
83
'libxext: to run some samples'
84
'libsm: to run some samples'
85
'libgl: (or nvidia/catalyst-utils) to run some samples'
86
)
87
88
cd ${srcdir}/${_subdir}
89
90
#Install SDK
91
install -m755 -d ${pkgdir}/${_ipath}
92
cp -r include ${pkgdir}/${_ipath}
93
install -m755 -d ${pkgdir}/${_ipath}/{bin,samples/opencl/bin,samples/bolt/bin}
94
cp -r ./bin/${_arch}/* ${pkgdir}/${_ipath}/bin
95
# cp -r ./lib/${_arch}/* ${pkgdir}/${_ipath}/lib
96
find ./samples/opencl/ -mindepth 1 -maxdepth 1 -type d -not -name bin -exec cp -r {} ${pkgdir}/${_ipath}/samples/opencl \;
97
cp -r ./samples/opencl/bin/${_arch}/* ${pkgdir}/${_ipath}/samples/opencl/bin
98
99
# Bolt
100
find ./samples/opencl/ -mindepth 1 -maxdepth 1 -type d -not -name bin -exec cp -r {} ${pkgdir}/${_ipath}/samples/bolt \;
101
cp -r ./samples/bolt/bin/${_arch}/* ${pkgdir}/${_ipath}/samples/bolt/bin
102
103
#----------- >8 --------------
104
# next 4 lines commented in 2.9.1 -V
105
# #Install includes
106
# install -m755 -d ${pkgdir}/usr/include/OpenVideo
107
# # install -m644 ./include/OpenVideo/{OVDecode.h,OVDecodeTypes.h} ${pkgdir}/usr/include/OpenVideo
108
# install -m644 ./include/OpenVideo/OpenVideo/* ${pkgdir}/usr/include/OpenVideo # why not this way? V
109
110
#Symlink binaries -- doesn't needed? -V
111
# mkdir -p "${pkgdir}/usr/bin"
112
# ln -s "/${_ipath}/bin/clinfo" "${pkgdir}/usr/bin/clinfo"
113
#----------- >8 --------------
114
115
#Fix modes
116
find ${pkgdir}/${_ipath} -type f -exec chmod 644 {} \;
117
chmod 755 ${pkgdir}/${_ipath}/bin/*
118
find ${pkgdir}/${_ipath}/samples/opencl/bin -type f -not -name "*.*" -exec chmod 755 {} \;
119
find ${pkgdir}/${_ipath}/samples/bolt/bin -type f -not -name "*.*" -exec chmod 755 {} \;
120
121
#AMDAPPSDKROOT env var
122
install -m755 -d ${pkgdir}/etc/profile.d
123
install -m755 ${srcdir}/amdapp-sdk.sh ${pkgdir}/etc/profile.d
124
sed -i -e "s|PATH|${_ipath}|" ${pkgdir}/etc/profile.d/amdapp-sdk.sh
125
126
#License
127
install -m755 -d ${pkgdir}/usr/share/licenses/amdapp-sdk
128
install -m644 ${srcdir}/${_subdir}/APPSDK-EULA-linux.txt ${pkgdir}/usr/share/licenses/amdapp-sdk/
129
}
130
131
132
package_amdapp-sdk-nocatalyst() {
133
pkgdesc="AMD Accelerated Parallel Processing (APP) SDK, 3.0 with OpenCL 2.0 support. Libs and ICD for non-catalyst users."
134
install=amdapp-sdk-nocatalyst.install
135
depends=('amdapp-sdk')
136
conflicts=('catalyst-utils')
137
138
#LDCONF
139
install -m755 -d ${pkgdir}/etc/ld.so.conf.d
140
install -m755 ${srcdir}/amdapp-sdk.conf ${pkgdir}/etc/ld.so.conf.d
141
sed -i -e "s|PATH|${_ipath}|" ${pkgdir}/etc/ld.so.conf.d/amdapp-sdk.conf
142
143
#Register ICD
144
install -m755 -d ${pkgdir}/etc/OpenCL/vendors
145
if [ "$CARCH" = 'i686' ]; then
146
install -m755 ${srcdir}/amd_i686.icd ${pkgdir}/etc/OpenCL/vendors/amd.icd
147
else
148
install -m755 ${srcdir}/amd.icd ${pkgdir}/etc/OpenCL/vendors
149
fi
150
sed -i -e "s|PATH|${_ipath}|" ${pkgdir}/etc/OpenCL/vendors/amd.icd
151
sed -i -e "s|BITS|${_bits}|" ${pkgdir}/etc/OpenCL/vendors/amd.icd
152
# The OpenCL ICD specifications: http://www.khronos.org/registry/cl/extensions/khr/cl_khr_icd.txt
153
154
#Place libs
155
install -m755 -d ${pkgdir}/${_ipath}/lib
156
cp -r ${srcdir}/${_subdir}/lib/${_arch}/* ${pkgdir}/${_ipath}/lib
157
chmod 755 ${pkgdir}/${_ipath}/lib/*
158
159
#License
160
install -m755 -d ${pkgdir}/usr/share/licenses
161
ln -s amdapp-sdk ${pkgdir}/usr/share/licenses/${pkgname}
162
}
163
164
165
package_amdapp-sdk-opencv() {
166
pkgdesc="AMD Accelerated Parallel Processing (APP) SDK, 3.0 with OpenCL 2.0 support. OpenCVUtils and opencv samples"
167
depends=('opencl-icd-loader' 'libgl' 'llvm' 'gcc-libs' 'mesa' 'glut' 'glew' 'opencv')
168
install=amdapp-sdk-opencv.install
169
170
cd ${srcdir}/${_subdir}
171
install -m755 -d ${pkgdir}/${_ipath}/samples/opencv/bin
172
find ./samples/opencv/ -mindepth 1 -maxdepth 1 -type d -not -name bin -exec cp -r {} ${pkgdir}/${_ipath}/samples/opencv \;
173
cp -r ./samples/opencv/bin/${_arch}/* ${pkgdir}/${_ipath}/samples/opencv/bin
174
find ${pkgdir}/${_ipath}/samples/opencv/bin -type f -not -name "*.*" -exec chmod 755 {} \;
175
176
#License
177
install -m755 -d ${pkgdir}/usr/share/licenses
178
ln -s amdapp-sdk ${pkgdir}/usr/share/licenses/${pkgname}
179
}
180
181
182
package_amdapp-sdk-docs() {
183
pkgdesc="AMD Accelerated Parallel Processing (APP) SDK, 3.0 with OpenCL 2.0 support. Documentation"
184
install=amdapp-sdk-docs.install
185
186
cd ${srcdir}/${_subdir}
187
install -m755 -d ${pkgdir}/usr/share/doc/amdapp-sdk
188
cp -r ./docs/* ${pkgdir}/usr/share/doc/amdapp-sdk
189
190
#License
191
install -m755 -d ${pkgdir}/usr/share/licenses
192
ln -s amdapp-sdk ${pkgdir}/usr/share/licenses/${pkgname}
193
}
194
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |