asc-devkit-bin

LOW

maintainer greenhandzdl 0 votes scanned 2026-10-26 07:46:00.476890

View on AUR

Why flagged

Downloads official Huawei CANN toolkit ZIPs from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com) with pinned SHA-256 checksums; extracts prebuilt binaries/headers using --noexec self-extractors from the vendor's own installer, which is normal for proprietary SDK packaging and not meaningfully different from a GitHub release asset.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads official Huawei CANN toolkit ZIPs from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com) with pinned SHA-256 checksums; extracts prebuilt binaries/headers using --noexec self-extractors from the vendor's own installer, which is normal for proprietary SDK packaging and not meaningfully different from a GitHub release asset.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-x86_64.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: greenhandzdl <greenhandzdl@greenhandzdl.moe>
    
      2# CANN Ascend C devkit as shipped in the official 9.2.0 toolkit bundle.
    
      3# Prefer asc-devkit-git if you want the AtomGit source build.
    
      4pkgname=asc-devkit-bin
    
      5pkgver=9.2.0
    
      6pkgrel=1
    
      7pkgdesc='Huawei Ascend CANN Ascend C devkit (compiler headers, tikcpp, Ascend C libs)'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://www.hiascend.com/developer/download/community/result?module=cann'
    
      10license=('custom:CANN-OSLA-2.0')
    
      11depends=('glibc' 'gcc-libs' 'bash' 'python' 'asc-runtime' 'asc-bisheng' 'asc-toolkit')
    
      12provides=('asc-devkit')
    
      13conflicts=('asc-devkit')
    
      14options=('!strip' '!debug' 'staticlibs')
    
      15makedepends=('unzip')
    
      16
    
      17_zip="cann-toolkit-${pkgver}.zip"
    
      18source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-x86_64.zip")
    
      19source_aarch64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-aarch64.zip")
    
      20sha256sums_x86_64=('6d753badfcddcf13d1049906e40f0c26150ffc01d4ad226ad8c74f352cbf7442')
    
      21sha256sums_aarch64=('4c432c89b0561de21e2d9b2dd0bc7bf78d3461e4eab645c1613d72422b4bdbbf')
    
      22noextract=("${_zip}")
    
      23_libdir="${CARCH}-linux"
    
      24
    
      25prepare() {
    
      26  cd "$srcdir"
    
      27  [[ -f .prepared ]] && return
    
      28  rm -rf outer inner tk payload
    
      29  mkdir -p outer inner
    
      30  unzip -q "$_zip" -d outer
    
      31  unzip -q "outer/Ascend-cann-toolkit_${pkgver}_linux-${CARCH}.zip" -d inner
    
      32  rm -rf tk; bash "inner/Ascend-cann-toolkit_${pkgver}_linux-${CARCH}.run" --noexec --extract="$srcdir/tk"
    
      33  rm -rf payload; bash "tk/run_package/cann-asc-devkit_${pkgver}_linux-${CARCH}.run" --noexec --extract="$srcdir/payload"
    
      34  touch .prepared
    
      35}
    
      36
    
      37package() {
    
      38  local root="$pkgdir/opt/ascend/cann-${pkgver}"
    
      39  local src="$srcdir/payload" libdir="${CARCH}-linux" e w
    
      40
    
      41  install -d "$root/$libdir" "$root/python/site-packages"
    
      42  [[ -d $src/$libdir ]] && cp -a "$src/$libdir/." "$root/$libdir/"
    
      43  for e in "$src"/*; do
    
      44    [[ -e $e ]] || continue
    
      45    case ${e##*/} in
    
      46      "$libdir"|set_env.sh) continue ;;
    
      47      lib)
    
      48        for w in "$e"/*.whl; do
    
      49          [[ -e $w ]] && bsdtar -xf "$w" -C "$root/python/site-packages"
    
      50        done
    
      51        continue ;;
    
      52    esac
    
      53    cp -a "$e" "$root/"
    
      54  done
    
      55  rm -f "$root/$libdir/conf/path.cfg" \
    
      56        "$root/$libdir/bin/setenv.bash"
    
      57
    
      58  # Replay the official installer's symlink farm (filelist.csv "softlink"
    
      59  # column). Root arch links except "asc" are owned by asc-toolkit-bin.
    
      60  local csv f1 f2 f3 inst f5 f6 f7 f8 links l target link
    
      61  for csv in "$root"/share/info/*/script/filelist.csv; do
    
      62    [[ -f $csv ]] || continue
    
      63    while IFS=, read -r f1 f2 f3 inst f5 f6 f7 f8 links _rest; do
    
      64      [[ $links == NA || -z $links || $links == softlink ]] && continue
    
      65      for l in ${links//;/ }; do
    
      66        case $l in
    
      67          bin|conf|devlib|include|lib64|pkg_inc) continue ;;
    
      68          *-linux/devlib/*) continue ;;
    
      69        esac
    
      70        target="$root/$inst" link="$root/$l"
    
      71        [[ -e $target ]] || continue
    
      72        [[ -e $link || -L $link ]] && continue
    
      73        mkdir -p "${link%/*}"
    
      74        ln -sfn "$(realpath --relative-to="${link%/*}" "$target")" "$link"
    
      75      done
    
      76    done < "$csv"
    
      77  done
    
      78
    
      79  install -Dm644 "$srcdir/tk/script/eula_en.txt" \
    
      80    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      81  # The upstream installers build with a restrictive umask (750/640/440),
    
      82  # which leaves a root install unreadable to non-root users (bisheng
    
      83  # headers, cmake modules). Normalize to the Arch/AUR norm.
    
      84  find "$pkgdir" -type d -exec chmod 755 {} +
    
      85  find "$pkgdir" -type f -perm /111 -exec chmod 755 {} +
    
      86  find "$pkgdir" -type f ! -perm /111 -exec chmod 644 {} +
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 07:46:00	Low	3
2026-10-26 07:44:04	Medium	2