asc-runtime-bin
LOW
maintainer greenhandzdl
0 votes
scanned 2026-10-26 07:46:00.476890
Why flagged
Downloads official Huawei CANN toolkit ZIPs from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com), which is the vendor's official distribution infrastructure; checksums are provided and non-SKIP; the .run files are extracted with --noexec rather than executed as installers; the only concern is that the host is not a well-known whitelist entry, but it is plausibly the project's own official download endpoint.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads official Huawei CANN toolkit ZIPs from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com), which is the vendor's official distribution infrastructure; checksums are provided and non-SKIP; the .run files are extracted with --noexec rather than executed as installers; the only concern is that the host is not a well-known whitelist entry, but it is plausibly the project's own official download endpoint.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-x86_64.zip")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: greenhandzdl <greenhandzdl@greenhandzdl.moe>
2
# CANN npu-runtime as shipped in the official 9.2.0 toolkit bundle.
3
# Prefer asc-runtime-git if you want the AtomGit source build.
4
pkgname=asc-runtime-bin
5
pkgver=9.2.0
6
pkgrel=1
7
pkgdesc='Huawei Ascend CANN NPU runtime (ACL, GE client, HCCL, mmpa)'
8
arch=('x86_64' 'aarch64')
9
url='https://www.hiascend.com/developer/download/community/result?module=cann'
10
license=('custom:CANN-OSLA-2.0')
11
depends=('glibc' 'gcc-libs' 'bash')
12
provides=('asc-runtime')
13
conflicts=('asc-runtime')
14
options=('!strip' '!debug' 'staticlibs')
15
makedepends=('unzip')
16
17
_zip="cann-toolkit-${pkgver}.zip"
18
source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-x86_64.zip")
19
source_aarch64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-aarch64.zip")
20
sha256sums_x86_64=('6d753badfcddcf13d1049906e40f0c26150ffc01d4ad226ad8c74f352cbf7442')
21
sha256sums_aarch64=('4c432c89b0561de21e2d9b2dd0bc7bf78d3461e4eab645c1613d72422b4bdbbf')
22
noextract=("${_zip}")
23
_libdir="${CARCH}-linux"
24
25
prepare() {
26
cd "$srcdir"
27
[[ -f .prepared ]] && return
28
rm -rf outer inner tk payload
29
mkdir -p outer inner
30
unzip -q "$_zip" -d outer
31
unzip -q "outer/Ascend-cann-toolkit_${pkgver}_linux-${CARCH}.zip" -d inner
32
rm -rf tk; bash "inner/Ascend-cann-toolkit_${pkgver}_linux-${CARCH}.run" --noexec --extract="$srcdir/tk"
33
rm -rf payload; bash "tk/run_package/cann-npu-runtime_${pkgver}_linux-${CARCH}.run" --noexec --extract="$srcdir/payload"
34
touch .prepared
35
}
36
37
package() {
38
local root="$pkgdir/opt/ascend/cann-${pkgver}"
39
local src="$srcdir/payload" libdir="${CARCH}-linux" e
40
41
install -d "$root/$libdir"
42
[[ -d $src/$libdir ]] && cp -a "$src/$libdir/." "$root/$libdir/"
43
for e in "$src"/*; do
44
[[ -e $e ]] || continue
45
case ${e##*/} in
46
"$libdir"|set_env.sh) continue ;;
47
esac
48
cp -a "$e" "$root/"
49
done
50
# the canonical CANN root env script; officially shipped by the runtime
51
# component (identical copy in every component payload)
52
install -Dm755 "$src/set_env.sh" "$root/set_env.sh"
53
# also shipped by asc-toolkit-bin (ge-executor); the base package owns them
54
rm -f "$root/$libdir/conf/path.cfg" \
55
"$root/$libdir/lib64/libhost_ascend_protobuf.a"
56
57
# Replay the official installer's symlink farm (filelist.csv "softlink"
58
# column): devlib arch aliases, runtime/include/acl, include/driver, etc.
59
# Root arch links are owned by asc-toolkit-bin.
60
local csv f1 f2 f3 inst f5 f6 f7 f8 links l target link
61
for csv in "$root"/share/info/*/script/filelist.csv; do
62
[[ -f $csv ]] || continue
63
while IFS=, read -r f1 f2 f3 inst f5 f6 f7 f8 links _rest; do
64
[[ $links == NA || -z $links || $links == softlink ]] && continue
65
for l in ${links//;/ }; do
66
case $l in
67
asc|bin|conf|devlib|include|lib64|pkg_inc) continue ;;
68
esac
69
target="$root/$inst" link="$root/$l"
70
[[ -e $target ]] || continue
71
[[ -e $link || -L $link ]] && continue
72
mkdir -p "${link%/*}"
73
ln -sfn "$(realpath --relative-to="${link%/*}" "$target")" "$link"
74
done
75
done < "$csv"
76
done
77
78
# Shell integration is owned by the runtime (the base component every other
79
# CANN package depends on): bash gets the vendor set_env.sh, fish gets a
80
# native port because it never reads /etc/profile.d.
81
install -Dm644 /dev/stdin "$pkgdir/etc/profile.d/ascend-cann.sh" <<'PROFILE'
82
# Huawei Ascend CANN 9.2.0
83
if [ -f /opt/ascend/cann-9.2.0/set_env.sh ]; then
84
. /opt/ascend/cann-9.2.0/set_env.sh
85
# Driverless hosts (simulator): the vendor script appends ".../devlib", but
86
# libascend_hal.so actually lives in devlib/<arch>. Append that too, last,
87
# so it never shadows the real lib64 or driver copies.
88
case ":$LD_LIBRARY_PATH:" in
89
*:/opt/ascend/cann-9.2.0/devlib:*)
90
case ":$LD_LIBRARY_PATH:" in
91
*:/opt/ascend/cann-9.2.0/devlib/*:*) ;;
92
*) export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/opt/ascend/cann-9.2.0/devlib/$(uname -m)" ;;
93
esac
94
;;
95
esac
96
fi
97
PROFILE
98
99
install -Dm644 /dev/stdin "$pkgdir/etc/fish/conf.d/ascend-cann.fish" <<'FISH'
100
# Huawei Ascend CANN 9.2.0 - fish port of /opt/ascend/cann-9.2.0/set_env.sh
101
set -l cann /opt/ascend/cann-9.2.0
102
set -l arch (uname -m)
103
104
# Re-sourcing must not duplicate entries; drop stale CANN paths first, like
105
# the vendor script's remove_env.
106
if set -q PATH
107
set -gx PATH (string match -v -- '/opt/ascend/cann*' $PATH)
108
end
109
if set -q LD_LIBRARY_PATH
110
set -gx LD_LIBRARY_PATH (string match -v -- '/opt/ascend/cann*' $LD_LIBRARY_PATH)
111
end
112
if set -q PYTHONPATH
113
set -gx PYTHONPATH (string match -v -- '/opt/ascend/cann*' $PYTHONPATH)
114
end
115
if set -q CMAKE_PREFIX_PATH
116
set -gx CMAKE_PREFIX_PATH (string match -v -- '/opt/ascend/cann*' $CMAKE_PREFIX_PATH)
117
end
118
119
set -gx ASCEND_HOME_PATH $cann
120
set -gx ASCEND_TOOLKIT_HOME $cann
121
set -gx ASCEND_OPP_PATH $cann/opp
122
set -gx ASCEND_AICPU_PATH $cann
123
set -gx TOOLCHAIN_HOME $cann/toolkit
124
125
contains -- /sbin $PATH; or set -gx PATH $PATH /sbin
126
127
set -gx PATH $cann/bin \
128
$cann/tools/ccec_compiler/bin \
129
$cann/tools/profiler/bin \
130
$cann/tools/ascend_system_advisor/asys \
131
$cann/tools/show_kernel_debug_data \
132
$cann/tools/msobjdump \
133
$PATH
134
135
set -gx LD_LIBRARY_PATH $cann/lib64 \
136
$cann/lib64/plugin/opskernel \
137
$cann/lib64/plugin/nnengine \
138
$cann/opp/built-in/op_impl/ai_core/tbe/op_tiling/lib/linux/$arch \
139
/usr/local/Ascend/driver/lib64 \
140
/usr/local/Ascend/driver/lib64/common \
141
/usr/local/Ascend/driver/lib64/driver \
142
$LD_LIBRARY_PATH
143
144
# Driverless hosts (simulator): the CPU hal lives in devlib/<arch>; append it
145
# last so it never shadows the real lib64 or driver copies.
146
set -l has_driver 0
147
if test -f /etc/ascend_install.info
148
set has_driver 1
149
else if test -e /usr/local/Ascend/driver/lib64/libascend_hal.so
150
set has_driver 1
151
else if command -q ldconfig; and ldconfig -p 2>/dev/null | string match -q -- '*libascend_hal.so*'
152
set has_driver 1
153
end
154
if test $has_driver -eq 0
155
set -gx LD_LIBRARY_PATH $LD_LIBRARY_PATH $cann/devlib $cann/devlib/$arch
156
end
157
158
set -gx PYTHONPATH $cann/python/site-packages \
159
$cann/opp/built-in/op_impl/ai_core/tbe \
160
$PYTHONPATH
161
162
set -gx CMAKE_PREFIX_PATH $cann/lib64/cmake \
163
$cann/toolkit/tools/tikicpulib/lib/cmake \
164
$CMAKE_PREFIX_PATH
165
FISH
166
167
install -Dm644 "$srcdir/tk/script/eula_en.txt" \
168
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
169
# The upstream installers build with a restrictive umask (750/640/440),
170
# which leaves a root install unreadable to non-root users (bisheng
171
# headers, cmake modules). Normalize to the Arch/AUR norm.
172
find "$pkgdir" -type d -exec chmod 755 {} +
173
find "$pkgdir" -type f -perm /111 -exec chmod 755 {} +
174
find "$pkgdir" -type f ! -perm /111 -exec chmod 644 {} +
175
}
176
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-26 07:46:00 | Low | 3 |
| 2026-10-26 07:44:04 | Medium | 2 |