asc-runtime-git

LOW
maintainer greenhandzdl 0 votes scanned 2026-10-26 07:46:00.476890
View on AUR
Why flagged

Package builds Huawei CANN NPU runtime from its official AtomGit source tree; third-party dependencies are fetched from Huawei's own OBS storage and gitcode.com with explicit SHA256 checksums (only the two git sources use SKIP, which is normal for git+https sources); no obfuscated payloads, no exfiltration, no untrusted prebuilt binaries from swappable hosts.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Package builds Huawei CANN NPU runtime from its official AtomGit source tree; third-party dependencies are fetched from Huawei's own OBS storage and gitcode.com with explicit SHA256 checksums (only the two git sources use SKIP, which is normal for git+https sources); no obfuscated payloads, no exfiltration, no untrusted prebuilt binaries from swappable hosts.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:36 source=("$_repo::git+https://atomgit.com/cann/runtime.git#branch=9.2.0"
  • PKGBUILD:37 "cann-cmake::git+https://gitcode.com/cann/cmake.git#tag=master-054"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: greenhandzdl <greenhandzdl@greenhandzdl.moe>
2# CANN NPU runtime built from the AtomGit source tree.
3pkgname=asc-runtime-git
4pkgver=9.2.0.r3025.0d259c501b
5pkgrel=1
6pkgdesc='Huawei Ascend CANN NPU runtime (ACL, GE client, HCCL, mmpa) - source build'
7arch=('x86_64' 'aarch64')
8url='https://atomgit.com/cann/runtime'
9license=('custom:CANN-OSLA-2.0')
10depends=('glibc' 'gcc-libs' 'bash')
11provides=('asc-runtime')
12conflicts=('asc-runtime')
13makedepends=('git' 'cmake' 'gcc' 'make' 'gperf' 'python' 'ccache' 'autoconf' 'libtool')
14options=('!strip' '!debug' 'staticlibs')
15
16_repo=runtime
17_3rd=https://cann-3rd.obs.cn-north-4.myhuaweicloud.com
18# Third-party archives the upstream build would download at configure time.
19# Declaring them here keeps the build reproducible and offline-capable; they
20# are staged into upstream's --cann_3rd_lib_path cache in prepare().
21_3rd_srcs=(
22 "makeself-release-2.5.0.tar.gz::$_3rd/makeself/makeself-release-2.5.0.tar.gz"
23 "makeself-2.5.0.patch::$_3rd/makeself/makeself-2.5.0.patch"
24 "json-3.12.0.tar.gz::$_3rd/json/json-3.12.0.tar.gz"
25 "libboundscheck-v1.1.16.tar.gz::$_3rd/libboundscheck/libboundscheck-v1.1.16.tar.gz"
26 "protobuf-25.1.tar.gz::$_3rd/protobuf/protobuf-25.1.tar.gz"
27 "boost_1_87_0.tar.gz::$_3rd/boost/boost_1_87_0.tar.gz"
28 "mockcpp-2.7.tar.gz::$_3rd/mockcpp/mockcpp-2.7.tar.gz"
29 "mockcpp-2.7-h5.patch::https://gitcode.com/cann-src-third-party/mockcpp/releases/download/v2.7-h5/mockcpp-2.7-h5.patch"
30 "googletest-1.14.0.tar.gz::$_3rd/googletest/googletest-1.14.0.tar.gz"
31 "eigen-5.0.0.tar.gz::$_3rd/eigen/eigen-5.0.0.tar.gz"
32 "libseccomp-2.5.4.tar.gz::$_3rd/libseccomp/libseccomp-2.5.4.tar.gz"
33 "abseil-cpp-20230802.1.tar.gz::$_3rd/abseil-cpp/abseil-cpp-20230802.1.tar.gz"
34 "backport-CVE-2025-0838.patch::https://gitcode.com/cann-src-third-party/abseil-cpp/releases/download/20230802.1-h0/backport-CVE-2025-0838.patch"
35)
36source=("$_repo::git+https://atomgit.com/cann/runtime.git#branch=9.2.0"
37 "cann-cmake::git+https://gitcode.com/cann/cmake.git#tag=master-054"
38 "${_3rd_srcs[@]}")
39sha256sums=('SKIP' 'SKIP'
40 '705d0376db9109a8ef1d4f3876c9997ee6bed454a23619e1dbc03d25033e46ea'
41 'abb9efe26f95db61ce927a7d046ea2c73ec908cec984ea6316892b4c8b11d784'
42 '4b92eb0c06d10683f7447ce9406cb97cd4b453be18d7279320f7b2f025c10187'
43 'aee8368ef04a42a499edd5bfebce529e7f32dd138bfed383d316e48af4e45d2c'
44 '9bd87b8280ef720d3240514f884e56a712f2218f0d693b48050c836028940a42'
45 'f55c340aa49763b1925ccf02b2e83f35fdcf634c9d5164a2acb87540173c741d'
46 '73ab0a8b6d1052361c2cebd85e022c0396f928d2e077bf132790ae3be766f603'
47 '65a2aac5e8ffe1a0eb983e4455972ef70b9850d4283ea7d4cc83e3cb97e98c5e'
48 '8ad598c73ad796e0d8280b082cebd82a630d73e73cd3c70057938a6501bba5d7'
49 '93f7f0462988b934e632a9fba58af55192ffceae38e8f46233f4f62cb1e79370'
50 '96bbadb4384716272a6d2be82801dc564f7aab345febfe9b698b70fc606e3f75'
51 '987ce98f02eefbaf930d6e38ab16aa05737234d7afbab2d5c4ea7adbe50c28ed'
52 'a4e4ef6fc4f4c1ed871a3472c5e650068aaadaad2adfef2c8ccb00918bb36d8c')
53
54pkgver() {
55 cd "$_repo"
56 local v
57 v=$(sed -n 's/.*set_cann_package(npu-runtime VERSION "\([^"]*\)").*/\1/p' version.cmake)
58 printf '%s.r%s.%s' "${v:-9.2.0}" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
59}
60
61prepare() {
62 # splay the downloaded archives into upstream's cache layout
63 local dir="$srcdir/3rdlib"
64 mkdir -p "$dir/pkg" "$dir/abseil-cpp"
65 ln -sfn "$srcdir/cann-cmake" "$dir/cann-cmake"
66 ln -sf "$srcdir/makeself-2.5.0.patch" "$dir/pkg/"
67 ln -sf "$srcdir/mockcpp-2.7-h5.patch" "$dir/"
68 ln -sf "$srcdir/abseil-cpp-20230802.1.tar.gz" "$dir/abseil-cpp/"
69 ln -sf "$srcdir/backport-CVE-2025-0838.patch" "$dir/abseil-cpp/"
70 local f
71 for f in makeself-release-2.5.0.tar.gz json-3.12.0.tar.gz \
72 libboundscheck-v1.1.16.tar.gz protobuf-25.1.tar.gz \
73 boost_1_87_0.tar.gz mockcpp-2.7.tar.gz googletest-1.14.0.tar.gz \
74 eigen-5.0.0.tar.gz libseccomp-2.5.4.tar.gz; do
75 ln -sf "$srcdir/$f" "$dir/"
76 done
77}
78
79build() {
80 cd "$_repo"
81 # stale caches hide flag changes (host-only vs host+device) and can skip
82 # configure steps that the previous build already satisfied
83 rm -rf build build_out
84 # Arch's host flags (gcc, -march=x86-64, -fcf-protection) must not leak
85 # into the aarch64 device cross-build that the same make invocation
86 # launches; upstream supplies its own flags for both sides.
87 unset CFLAGS CXXFLAGS LDFLAGS
88 # gcc 16 false-positive on the COW string headers under upstream -Werror
89 export CXXFLAGS="-Wno-error=maybe-uninitialized -Wno-maybe-uninitialized"
90 # Upstream builds the device-side libs (lib64/device) only when
91 # TOOLCHAIN_DIR names the CANN device compiler; without it the build is
92 # host-only. asc-devkit-git's device build links against those libs, so
93 # use the installed toolchain when there is one.
94 local cann=/opt/ascend/cann-9.2.0 hcc=/opt/ascend/cann-9.2.0/toolkit/toolchain/hcc
95 local extra=()
96 if [[ -x $hcc/bin/aarch64-target-linux-gnu-g++ ]]; then
97 export TOOLCHAIN_DIR=$hcc
98 extra=(--ascend_install_path="$cann")
99 fi
100 bash build.sh --pkg "${extra[@]}" \
101 --cann_3rd_lib_path="$srcdir/3rdlib" -j"$(nproc)"
102}
103
104package() {
105 cd "$_repo"
106 local root="$pkgdir/opt/ascend/cann-9.2.0" libdir="${CARCH}-linux"
107 local run payload e
108
109 run=$(find . -name '*.run' -type f | head -1)
110 [[ -n $run ]] || { echo 'no .run produced' >&2; return 1; }
111 payload="$srcdir/payload-git"
112 rm -rf "$payload"
113 bash "$run" --noexec --extract="$payload"
114
115 install -d "$root/$libdir"
116 [[ -d $payload/$libdir ]] && cp -a "$payload/$libdir/." "$root/$libdir/"
117 for e in "$payload"/*; do
118 [[ -e $e ]] || continue
119 case ${e##*/} in
120 "$libdir"|set_env.sh) continue ;;
121 esac
122 cp -a "$e" "$root/"
123 done
124 # the canonical CANN root env script; officially shipped by the runtime
125 # component (identical copy in every component payload)
126 install -Dm755 "$payload/set_env.sh" "$root/set_env.sh"
127 # also shipped by asc-toolkit-bin (ge-executor); the base package owns them
128 rm -f "$root/$libdir/conf/path.cfg" \
129 "$root/$libdir/lib64/libhost_ascend_protobuf.a"
130
131 # Replay the official installer's symlink farm (filelist.csv "softlink"
132 # column): devlib arch aliases, runtime/include/acl, include/driver, etc.
133 # Root arch links are owned by asc-toolkit-bin.
134 local csv f1 f2 f3 inst f5 f6 f7 f8 links l target link
135 for csv in "$root"/share/info/*/script/filelist.csv; do
136 [[ -f $csv ]] || continue
137 while IFS=, read -r f1 f2 f3 inst f5 f6 f7 f8 links _rest; do
138 [[ $links == NA || -z $links || $links == softlink ]] && continue
139 for l in ${links//;/ }; do
140 case $l in
141 asc|bin|conf|devlib|include|lib64|pkg_inc) continue ;;
142 esac
143 target="$root/$inst" link="$root/$l"
144 [[ -e $target ]] || continue
145 [[ -e $link || -L $link ]] && continue
146 mkdir -p "${link%/*}"
147 ln -sfn "$(realpath --relative-to="${link%/*}" "$target")" "$link"
148 done
149 done < "$csv"
150 done
151
152 # Shell integration is owned by the runtime (the base component every other
153 # CANN package depends on): bash gets the vendor set_env.sh, fish gets a
154 # native port because it never reads /etc/profile.d.
155 install -Dm644 /dev/stdin "$pkgdir/etc/profile.d/ascend-cann.sh" <<'PROFILE'
156# Huawei Ascend CANN 9.2.0
157if [ -f /opt/ascend/cann-9.2.0/set_env.sh ]; then
158 . /opt/ascend/cann-9.2.0/set_env.sh
159 # Driverless hosts (simulator): the vendor script appends ".../devlib", but
160 # libascend_hal.so actually lives in devlib/<arch>. Append that too, last,
161 # so it never shadows the real lib64 or driver copies.
162 case ":$LD_LIBRARY_PATH:" in
163 *:/opt/ascend/cann-9.2.0/devlib:*)
164 case ":$LD_LIBRARY_PATH:" in
165 *:/opt/ascend/cann-9.2.0/devlib/*:*) ;;
166 *) export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/opt/ascend/cann-9.2.0/devlib/$(uname -m)" ;;
167 esac
168 ;;
169 esac
170fi
171PROFILE
172
173 install -Dm644 /dev/stdin "$pkgdir/etc/fish/conf.d/ascend-cann.fish" <<'FISH'
174# Huawei Ascend CANN 9.2.0 - fish port of /opt/ascend/cann-9.2.0/set_env.sh
175set -l cann /opt/ascend/cann-9.2.0
176set -l arch (uname -m)
177
178# Re-sourcing must not duplicate entries; drop stale CANN paths first, like
179# the vendor script's remove_env.
180if set -q PATH
181 set -gx PATH (string match -v -- '/opt/ascend/cann*' $PATH)
182end
183if set -q LD_LIBRARY_PATH
184 set -gx LD_LIBRARY_PATH (string match -v -- '/opt/ascend/cann*' $LD_LIBRARY_PATH)
185end
186if set -q PYTHONPATH
187 set -gx PYTHONPATH (string match -v -- '/opt/ascend/cann*' $PYTHONPATH)
188end
189if set -q CMAKE_PREFIX_PATH
190 set -gx CMAKE_PREFIX_PATH (string match -v -- '/opt/ascend/cann*' $CMAKE_PREFIX_PATH)
191end
192
193set -gx ASCEND_HOME_PATH $cann
194set -gx ASCEND_TOOLKIT_HOME $cann
195set -gx ASCEND_OPP_PATH $cann/opp
196set -gx ASCEND_AICPU_PATH $cann
197set -gx TOOLCHAIN_HOME $cann/toolkit
198
199contains -- /sbin $PATH; or set -gx PATH $PATH /sbin
200
201set -gx PATH $cann/bin \
202 $cann/tools/ccec_compiler/bin \
203 $cann/tools/profiler/bin \
204 $cann/tools/ascend_system_advisor/asys \
205 $cann/tools/show_kernel_debug_data \
206 $cann/tools/msobjdump \
207 $PATH
208
209set -gx LD_LIBRARY_PATH $cann/lib64 \
210 $cann/lib64/plugin/opskernel \
211 $cann/lib64/plugin/nnengine \
212 $cann/opp/built-in/op_impl/ai_core/tbe/op_tiling/lib/linux/$arch \
213 /usr/local/Ascend/driver/lib64 \
214 /usr/local/Ascend/driver/lib64/common \
215 /usr/local/Ascend/driver/lib64/driver \
216 $LD_LIBRARY_PATH
217
218# Driverless hosts (simulator): the CPU hal lives in devlib/<arch>; append it
219# last so it never shadows the real lib64 or driver copies.
220set -l has_driver 0
221if test -f /etc/ascend_install.info
222 set has_driver 1
223else if test -e /usr/local/Ascend/driver/lib64/libascend_hal.so
224 set has_driver 1
225else if command -q ldconfig; and ldconfig -p 2>/dev/null | string match -q -- '*libascend_hal.so*'
226 set has_driver 1
227end
228if test $has_driver -eq 0
229 set -gx LD_LIBRARY_PATH $LD_LIBRARY_PATH $cann/devlib $cann/devlib/$arch
230end
231
232set -gx PYTHONPATH $cann/python/site-packages \
233 $cann/opp/built-in/op_impl/ai_core/tbe \
234 $PYTHONPATH
235
236set -gx CMAKE_PREFIX_PATH $cann/lib64/cmake \
237 $cann/toolkit/tools/tikicpulib/lib/cmake \
238 $CMAKE_PREFIX_PATH
239FISH
240
241 install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
242 # The upstream installers build with a restrictive umask (750/640/440),
243 # which leaves a root install unreadable to non-root users (bisheng
244 # headers, cmake modules). Normalize to the Arch/AUR norm.
245 find "$pkgdir" -type d -exec chmod 755 {} +
246 find "$pkgdir" -type f -perm /111 -exec chmod 755 {} +
247 find "$pkgdir" -type f ! -perm /111 -exec chmod 644 {} +
248}
249

Scan history

Scanned at (UTC)SeverityRules
2026-10-26 07:46:00 Low 3
2026-10-26 07:44:04 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion