asc-nnal-bin

LOW

maintainer greenhandzdl 0 votes scanned 2026-10-26 07:46:00.476890

View on AUR

Why flagged

Downloads official Huawei Ascend CANN binaries from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com), which is the vendor's official distribution infrastructure; checksums are provided and non-SKIP; the package extracts and installs the vendor's own closed-source libraries without executing arbitrary remote code or exfiltrating data, making this a normal -bin packaging of a proprietary SDK.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads official Huawei Ascend CANN binaries from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com), which is the vendor's official distribution infrastructure; checksums are provided and non-SKIP; the package extracts and installs the vendor's own closed-source libraries without executing arbitrary remote code or exfiltrating data, making this a normal -bin packaging of a proprietary SDK.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-nnal_${pkgver}_linux-x86_64.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: greenhandzdl <greenhandzdl@greenhandzdl.moe>
    
      2# NNAL (Ascend Transformer Boost + ASDSIP). Closed source, hence -bin.
    
      3pkgname=asc-nnal-bin
    
      4pkgver=9.2.0
    
      5pkgrel=1
    
      6pkgdesc='Huawei Ascend CANN NNAL: ATB (Ascend Transformer Boost) and ASDSIP'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://www.hiascend.com/developer/download/community/result?module=cann'
    
      9license=('custom:CANN-OSLA-2.0')
    
      10depends=('glibc' 'gcc-libs' 'bash' 'asc-toolkit' 'asc-runtime')
    
      11provides=('asc-nnal')
    
      12conflicts=('asc-nnal')
    
      13options=('!strip' '!debug' 'staticlibs')
    
      14makedepends=('unzip')
    
      15
    
      16_zip="cann-nnal-${pkgver}.zip"
    
      17source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-nnal_${pkgver}_linux-x86_64.zip")
    
      18source_aarch64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-nnal_${pkgver}_linux-aarch64.zip")
    
      19sha256sums_x86_64=('1ad4ce62596551723fab814b94b0c7e4606c6a1db3e48536939c539271216005')
    
      20sha256sums_aarch64=('71e279743f75da0523f9b9b8e352bf40870c3c314100dc1bfeda545fd4e51ac4')
    
      21noextract=("${_zip}")
    
      22
    
      23prepare() {
    
      24  cd "$srcdir"
    
      25  [[ -f .prepared ]] && return
    
      26  rm -rf outer inner tk payloads
    
      27  mkdir -p outer inner payloads
    
      28  unzip -q "$_zip" -d outer
    
      29  unzip -q "outer/Ascend-cann-nnal_${pkgver}_linux-${CARCH}.zip" -d inner
    
      30  rm -rf tk
    
      31  bash "inner/Ascend-cann-nnal_${pkgver}_linux-${CARCH}.run" --noexec --extract="$srcdir/tk"
    
      32  local u n
    
      33  for u in tk/run_package/*.run; do
    
      34    n=$(basename "$u" .run)
    
      35    bash "$u" --noexec --extract="$srcdir/payloads/$n"
    
      36  done
    
      37  touch .prepared
    
      38}
    
      39
    
      40package() {
    
      41  local b="$pkgdir/opt/ascend"
    
      42
    
      43  # ATB -> /opt/ascend/atb/{9.2.0,latest}
    
      44  local atb=$(echo "$srcdir"/payloads/Ascend-cann-atb_*)
    
      45  install -d "$b/atb/$pkgver"
    
      46  cp -a "$atb/." "$b/atb/$pkgver/"
    
      47  rm -f "$b/atb/$pkgver/set_env.sh" "$b/atb/$pkgver/install.sh"
    
      48  install -Dm755 "$atb/set_env.sh" "$b/atb/set_env.sh"
    
      49  ln -s "$pkgver" "$b/atb/latest"
    
      50
    
      51  # ASDSIP -> /opt/ascend/asdsip/{9.2.0,latest}
    
      52  local sip=$(echo "$srcdir"/payloads/Ascend-cann-SIP_*)
    
      53  install -d "$b/asdsip/$pkgver"
    
      54  cp -a "$sip/." "$b/asdsip/$pkgver/"
    
      55  rm -f "$b/asdsip/$pkgver/set_env.sh" "$b/asdsip/$pkgver/install.sh"
    
      56  install -Dm755 "$sip/set_env.sh" "$b/asdsip/set_env.sh"
    
      57  ln -s "$pkgver" "$b/asdsip/latest"
    
      58
    
      59  install -Dm644 "$srcdir/tk/script/eula_en.txt" \
    
      60    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      61
    
      62  install -Dm644 /dev/stdin "$pkgdir/etc/profile.d/ascend-nnal.sh" <<'PROFILE'
    
      63# Huawei Ascend NNAL (ATB + ASDSIP)
    
      64[ -f /opt/ascend/atb/set_env.sh ] && . /opt/ascend/atb/set_env.sh
    
      65[ -f /opt/ascend/asdsip/set_env.sh ] && . /opt/ascend/asdsip/set_env.sh
    
      66PROFILE
    
      67  # The upstream installers build with a restrictive umask (750/640/440),
    
      68  # which leaves a root install unreadable to non-root users (bisheng
    
      69  # headers, cmake modules). Normalize to the Arch/AUR norm.
    
      70  find "$pkgdir" -type d -exec chmod 755 {} +
    
      71  find "$pkgdir" -type f -perm /111 -exec chmod 755 {} +
    
      72  find "$pkgdir" -type f ! -perm /111 -exec chmod 644 {} +
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 07:46:00	Low	3
2026-10-26 07:44:04	Medium	2