asc-devkit-git

LOW
maintainer greenhandzdl 0 votes scanned 2026-10-26 07:46:00.476890
View on AUR
Why flagged

Third-party dependencies (makeself, boost, nlohmann-json) are downloaded from a Huawei OBS bucket (cann-3rd.obs.cn-north-4.myhuaweicloud.com) which is plausibly the project's own official CDN for CANN ecosystem packages, and all non-git sources have explicit SHA-256 checksums; the git sources are SKIP'd but come from atomgit.com/cann and gitcode.com/cann which are plausible official Huawei/CANN repositories, so this is a normal source build with no obfuscated payloads or exfiltration.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Third-party dependencies (makeself, boost, nlohmann-json) are downloaded from a Huawei OBS bucket (cann-3rd.obs.cn-north-4.myhuaweicloud.com) which is plausibly the project's own official CDN for CANN ecosystem packages, and all non-git sources have explicit SHA-256 checksums; the git sources are SKIP'd but come from atomgit.com/cann and gitcode.com/cann which are plausible official Huawei/CANN repositories, so this is a normal source build with no obfuscated payloads or exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:21 source=("$_repo::git+https://atomgit.com/cann/asc-devkit.git#branch=9.2.0"
  • PKGBUILD:22 "cann-cmake::git+https://gitcode.com/cann/cmake.git#tag=master-054"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: greenhandzdl <greenhandzdl@greenhandzdl.moe>
2# Ascend C devkit built from the AtomGit source tree.
3# Building requires an installed CANN root (asc-toolkit-bin + asc-runtime + asc-bisheng).
4pkgname=asc-devkit-git
5pkgver=9.2.0.r3250.343a6e89d2
6pkgrel=1
7pkgdesc='Huawei Ascend CANN Ascend C devkit (compiler headers, tikcpp, Ascend C libs) - source build'
8arch=('x86_64' 'aarch64')
9url='https://atomgit.com/cann/asc-devkit'
10license=('custom:CANN-OSLA-2.0')
11depends=('glibc' 'gcc-libs' 'bash' 'python' 'asc-runtime' 'asc-bisheng' 'asc-toolkit')
12provides=('asc-devkit')
13conflicts=('asc-devkit')
14makedepends=('git' 'cmake' 'gcc' 'make' 'python' 'pkgconf' 'asc-runtime' 'asc-bisheng' 'asc-toolkit')
15options=('!strip' '!debug' 'staticlibs')
16
17# Build against an installed CANN root; override for staged/CI trees.
18_cann=${ASCEND_CANN_PATH:-/opt/ascend/cann-9.2.0}
19_repo=asc-devkit
20_3rd=https://cann-3rd.obs.cn-north-4.myhuaweicloud.com
21source=("$_repo::git+https://atomgit.com/cann/asc-devkit.git#branch=9.2.0"
22 "cann-cmake::git+https://gitcode.com/cann/cmake.git#tag=master-054"
23 "makeself-release-2.5.0.tar.gz::$_3rd/makeself/makeself-release-2.5.0.tar.gz"
24 "makeself-2.5.0.patch::$_3rd/makeself/makeself-2.5.0.patch"
25 "boost_1_87_0.tar.gz::$_3rd/boost/boost_1_87_0.tar.gz"
26 "json-3.12.0.tar.gz::$_3rd/json/json-3.12.0.tar.gz")
27sha256sums=('SKIP' 'SKIP'
28 '705d0376db9109a8ef1d4f3876c9997ee6bed454a23619e1dbc03d25033e46ea'
29 'abb9efe26f95db61ce927a7d046ea2c73ec908cec984ea6316892b4c8b11d784'
30 'f55c340aa49763b1925ccf02b2e83f35fdcf634c9d5164a2acb87540173c741d'
31 '4b92eb0c06d10683f7447ce9406cb97cd4b453be18d7279320f7b2f025c10187')
32
33pkgver() {
34 cd "$_repo"
35 local v
36 v=$(sed -n 's/.*set_cann_package(asc-devkit VERSION "\([^"]*\)").*/\1/p' version.cmake)
37 printf '%s.r%s.%s' "${v:-9.2.0}" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
38}
39
40prepare() {
41 local dir="$srcdir/3rdlib"
42 mkdir -p "$dir/pkg"
43 ln -sfn "$srcdir/cann-cmake" "$dir/cann-cmake"
44 ln -sf "$srcdir/makeself-release-2.5.0.tar.gz" "$dir/"
45 ln -sf "$srcdir/makeself-2.5.0.patch" "$dir/pkg/"
46 ln -sf "$srcdir/boost_1_87_0.tar.gz" "$dir/"
47 ln -sf "$srcdir/json-3.12.0.tar.gz" "$dir/"
48}
49
50build() {
51 cd "$_repo"
52 # makepkg's host flags must not leak into the bundled device
53 # toolchain build; upstream supplies its own flags. Scrub any cached
54 # configure so stale CMAKE_*_FLAGS can't be reused.
55 rm -rf build build_out
56 unset CFLAGS CXXFLAGS LDFLAGS
57 export PATH="$_cann/bin:$PATH"
58 export LD_LIBRARY_PATH="$_cann/lib64:$_cann/devlib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
59 bash build.sh --pkg --pkg-type=run --cann_path="$_cann" \
60 --cann_3rd_lib_path="$srcdir/3rdlib" -j"$(nproc)"
61}
62
63package() {
64 cd "$_repo"
65 local root="$pkgdir/opt/ascend/cann-9.2.0" libdir="${CARCH}-linux"
66 local run payload e w
67
68 run=$(find . -name '*.run' -type f | head -1)
69 [[ -n $run ]] || { echo 'no .run produced' >&2; return 1; }
70 payload="$srcdir/payload-git"
71 rm -rf "$payload"
72 bash "$run" --noexec --extract="$payload"
73
74 install -d "$root/$libdir" "$root/python/site-packages"
75 [[ -d $payload/$libdir ]] && cp -a "$payload/$libdir/." "$root/$libdir/"
76 for e in "$payload"/*; do
77 [[ -e $e ]] || continue
78 case ${e##*/} in
79 "$libdir"|set_env.sh) continue ;;
80 lib)
81 for w in "$e"/*.whl; do
82 [[ -e $w ]] && bsdtar -xf "$w" -C "$root/python/site-packages"
83 done
84 continue ;;
85 esac
86 cp -a "$e" "$root/"
87 done
88 # owned by asc-toolkit-bin
89 rm -f "$root/$libdir/conf/path.cfg" \
90 "$root/$libdir/bin/setenv.bash"
91
92 # Replay the official installer's symlink farm (filelist.csv "softlink"
93 # column). Root arch links except "asc" are owned by asc-toolkit-bin.
94 local csv f1 f2 f3 inst f5 f6 f7 f8 links l target link
95 for csv in "$root"/share/info/*/script/filelist.csv; do
96 [[ -f $csv ]] || continue
97 while IFS=, read -r f1 f2 f3 inst f5 f6 f7 f8 links _rest; do
98 [[ $links == NA || -z $links || $links == softlink ]] && continue
99 for l in ${links//;/ }; do
100 case $l in
101 bin|conf|devlib|include|lib64|pkg_inc) continue ;;
102 *-linux/devlib/*) continue ;;
103 esac
104 target="$root/$inst" link="$root/$l"
105 [[ -e $target ]] || continue
106 [[ -e $link || -L $link ]] && continue
107 mkdir -p "${link%/*}"
108 ln -sfn "$(realpath --relative-to="${link%/*}" "$target")" "$link"
109 done
110 done < "$csv"
111 done
112
113 install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
114 # The upstream installers build with a restrictive umask (750/640/440),
115 # which leaves a root install unreadable to non-root users (bisheng
116 # headers, cmake modules). Normalize to the Arch/AUR norm.
117 find "$pkgdir" -type d -exec chmod 755 {} +
118 find "$pkgdir" -type f -perm /111 -exec chmod 755 {} +
119 find "$pkgdir" -type f ! -perm /111 -exec chmod 644 {} +
120}
121

Scan history

Scanned at (UTC)SeverityRules
2026-10-26 07:46:00 Low 3
2026-10-26 07:44:04 Medium 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion