asc-amct-bin

LOW

maintainer greenhandzdl 0 votes scanned 2026-10-26 07:46:00.476890

View on AUR

Why flagged

Downloads a prebuilt closed-source binary from Huawei's official OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com), which is the vendor's own distribution infrastructure for CANN packages; checksums are provided and the host is plausibly official, so this is a normal -bin AUR package for proprietary software with no obfuscation or exfiltration concerns.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt closed-source binary from Huawei's official OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com), which is the vendor's own distribution infrastructure for CANN packages; checksums are provided and the host is plausibly official, so this is a normal -bin AUR package for proprietary software with no obfuscation or exfiltration concerns.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-amct_${pkgver}_linux-x86_64.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: greenhandzdl <greenhandzdl@greenhandzdl.moe>
    
      2# AMCT (Ascend Model Compression Toolkit). Closed source, hence -bin.
    
      3pkgname=asc-amct-bin
    
      4pkgver=9.2.0
    
      5pkgrel=1
    
      6pkgdesc='Huawei Ascend Model Compression Toolkit: amct_acl plus Caffe/ONNX/PyTorch/TensorFlow plugins'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://www.hiascend.com/developer/download/community/result?module=cann'
    
      9license=('custom:CANN-OSLA-2.0')
    
      10depends=('glibc' 'gcc-libs' 'bash' 'python' 'asc-toolkit' 'asc-runtime')
    
      11provides=('asc-amct')
    
      12conflicts=('asc-amct')
    
      13options=('!strip' '!debug' 'staticlibs')
    
      14makedepends=('unzip')
    
      15
    
      16_zip="cann-amct-${pkgver}.zip"
    
      17source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-amct_${pkgver}_linux-x86_64.zip")
    
      18source_aarch64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-amct_${pkgver}_linux-aarch64.zip")
    
      19sha256sums_x86_64=('c1356f297f7302da168bfd59d4901f8548da67e438163da0a63d9eaa6f62a971')
    
      20sha256sums_aarch64=('29b2a706dabbcfaf61efebfb2e37a1f2bf14f76506d6e91da6a050a9d5cadf7c')
    
      21noextract=("${_zip}")
    
      22_libdir="${CARCH}-linux"
    
      23
    
      24prepare() {
    
      25  cd "$srcdir"
    
      26  [[ -f .prepared ]] && return
    
      27  rm -rf outer dist acl
    
      28  mkdir -p outer dist
    
      29  unzip -q "$_zip" -d outer
    
      30  bsdtar -xf "outer/Ascend-cann-amct_${pkgver}_linux-${CARCH}.tar.gz" -C dist
    
      31  bash "dist/amct_acl/cann-amct_acl_${pkgver}_linux-${CARCH}.run" \
    
      32    --noexec --extract="$srcdir/acl"
    
      33  rm -f "dist/amct_acl/cann-amct_acl_${pkgver}_linux-${CARCH}.run"
    
      34  touch .prepared
    
      35}
    
      36
    
      37package() {
    
      38  local root="$pkgdir/opt/ascend/cann-${pkgver}"
    
      39  local src="$srcdir/acl" e
    
      40
    
      41  # amct_acl is a regular CANN component and installs into the CANN root
    
      42  install -d "$root/$_libdir"
    
      43  [[ -d $src/$_libdir ]] && cp -a "$src/$_libdir/." "$root/$_libdir/"
    
      44  for e in "$src"/*; do
    
      45    [[ -e $e ]] || continue
    
      46    case ${e##*/} in
    
      47      "$_libdir"|set_env.sh) continue ;;
    
      48    esac
    
      49    cp -a "$e" "$root/"
    
      50  done
    
      51  # identical copies shipped by every component; owned by asc-runtime-bin
    
      52  rm -f "$root/$_libdir/conf/path.cfg" \
    
      53        "$root/$_libdir/bin/setenv.bash"
    
      54
    
      55  # framework plugins are pip/tar distributions the user installs per framework
    
      56  install -d "$pkgdir/opt/ascend/amct/$pkgver"
    
      57  cp -a "$srcdir/dist/." "$pkgdir/opt/ascend/amct/$pkgver/"
    
      58
    
      59  install -Dm644 /dev/stdin "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<'LIC'
    
      60This package repackages binaries distributed by Huawei Technologies Co., Ltd.
    
      61See the CANN Open Software License Agreement Version 2.0 installed by
    
      62asc-toolkit-bin at /usr/share/licenses/asc-toolkit-bin/LICENSE.
    
      63LIC
    
      64
    
      65  install -Dm644 /dev/stdin "$pkgdir/etc/profile.d/ascend-amct.sh" <<'PROFILE'
    
      66# Huawei Ascend AMCT
    
      67case ":${PYTHONPATH:-}:" in
    
      68  *":/opt/ascend/amct/9.2.0:"*) ;;
    
      69  *) PYTHONPATH="/opt/ascend/amct/9.2.0${PYTHONPATH:+:$PYTHONPATH}" ;;
    
      70esac
    
      71export PYTHONPATH
    
      72PROFILE
    
      73  # The upstream installers build with a restrictive umask (750/640/440),
    
      74  # which leaves a root install unreadable to non-root users (bisheng
    
      75  # headers, cmake modules). Normalize to the Arch/AUR norm.
    
      76  find "$pkgdir" -type d -exec chmod 755 {} +
    
      77  find "$pkgdir" -type f -perm /111 -exec chmod 755 {} +
    
      78  find "$pkgdir" -type f ! -perm /111 -exec chmod 644 {} +
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 07:46:00	Low	3
2026-10-26 07:44:04	Medium	2