asc-toolkit-bin
LOW
maintainer greenhandzdl
0 votes
scanned 2026-10-26 07:46:00.476890
Why flagged
Downloads official Huawei CANN toolkit ZIPs from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com) with explicit sha256 checksums; the non-standard host is plausibly the project's own official distribution infrastructure, and the package simply extracts and installs prebuilt vendor binaries without any obfuscated payloads or exfiltration.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads official Huawei CANN toolkit ZIPs from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com) with explicit sha256 checksums; the non-standard host is plausibly the project's own official distribution infrastructure, and the package simply extracts and installs prebuilt vendor binaries without any obfuscated payloads or exfiltration.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-x86_64.zip")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: greenhandzdl <greenhandzdl@greenhandzdl.moe>
2
# CANN 9.2.0 toolkit bundle, minus the components shipped by
3
# asc-runtime-*, asc-devkit-*, asc-tools-* and asc-bisheng-bin.
4
pkgname=asc-toolkit-bin
5
pkgver=9.2.0
6
pkgrel=1
7
pkgdesc='Huawei Ascend CANN Toolkit: GE, metadef, tbe-tik, AOE, pyACL, profiler, simulator and MindStudio tools'
8
arch=('x86_64' 'aarch64')
9
url='https://www.hiascend.com/developer/download/community/result?module=cann'
10
license=('custom:CANN-OSLA-2.0')
11
depends=('glibc' 'gcc-libs' 'bash' 'coreutils' 'python' 'asc-runtime')
12
optdepends=('asc-bisheng: Bisheng compiler driver (bisheng, hcc)'
13
'asc-devkit: Ascend C development kit (tikcpp headers, device libs)'
14
'asc-tools: operator project templates and kernel debug tools')
15
provides=('asc-toolkit')
16
conflicts=('asc-toolkit')
17
options=('!strip' '!debug' 'staticlibs')
18
makedepends=('unzip')
19
20
_zip="cann-toolkit-${pkgver}.zip"
21
source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-x86_64.zip")
22
source_aarch64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-aarch64.zip")
23
sha256sums_x86_64=('6d753badfcddcf13d1049906e40f0c26150ffc01d4ad226ad8c74f352cbf7442')
24
sha256sums_aarch64=('4c432c89b0561de21e2d9b2dd0bc7bf78d3461e4eab645c1613d72422b4bdbbf')
25
noextract=("${_zip}")
26
_libdir="${CARCH}-linux"
27
# ascendnpu-ir is the one unit whose x86_64 artifact says "x86", not "x86_64".
28
_npuir_arch=$CARCH
29
[[ $CARCH == x86_64 ]] && _npuir_arch=x86
30
31
# Every component bundled in the toolkit. The four below are packaged
32
# separately because equivalent open-source trees can be built from
33
# AtomGit (asc-runtime-git, asc-devkit-git, asc-tools-git).
34
_units=(
35
cann-ge-executor_9.2.0_linux-${CARCH}.run
36
cann-ge-compiler_9.2.0_linux-${CARCH}.run
37
cann-metadef_9.2.0_linux-${CARCH}.run
38
cann-opbase_9.2.0_linux-${CARCH}.run
39
cann-oam-tools_9.2.0_linux-${CARCH}.run
40
cann-aoe_9.2.0_linux-${CARCH}.run
41
cann-ncs_9.2.0_linux-${CARCH}.run
42
cann-graph-autofusion_9.2.0_linux-${CARCH}.run
43
cann-tbe-tik_9.2.0_linux-${CARCH}.run
44
cann-dflow-executor_9.2.0_linux-${CARCH}.run
45
cann-acl-extend_9.2.0_linux-${CARCH}.run
46
cann-pto-isa_9.2.0_linux-${CARCH}.run
47
cann-pto-as_9.2.0_linux-${CARCH}.run
48
cann-pypto_9.2.0_linux-${CARCH}.run
49
cann-hcomm_9.2.0_linux-${CARCH}.run
50
cann-simulator_9.2.0_linux-${CARCH}.run
51
pyACL_9.2.0_linux-${CARCH}.run
52
ascendnpu-ir_2.0.0_linux-${_npuir_arch}.run
53
test-ops_9.2.0_linux.run
54
)
55
# MindStudio tools (mindstudio-*, ascend-mindstudio-operator-tools) use a
56
# different installer and install outside the CANN root; they are not part
57
# of this package.
58
59
_extract_run() {
60
# makeself refuses to extract into an existing directory
61
rm -rf "$2"
62
bash "$1" --noexec --extract="$2"
63
}
64
65
prep_toolkit() {
66
cd "$srcdir"
67
[[ -f .prepared ]] && return
68
rm -rf outer inner tk payloads
69
mkdir -p outer inner
70
unzip -q "$_zip" -d outer
71
unzip -q "outer/Ascend-cann-toolkit_${pkgver}_linux-${CARCH}.zip" -d inner
72
_extract_run "inner/Ascend-cann-toolkit_${pkgver}_linux-${CARCH}.run" "$srcdir/tk"
73
mkdir -p payloads
74
local u
75
for u in "${_units[@]}"; do
76
_extract_run "tk/run_package/$u" "$srcdir/payloads/${u%%_*}"
77
done
78
touch .prepared
79
}
80
81
prepare() {
82
prep_toolkit
83
}
84
85
# Merge one component payload into the CANN root.
86
_merge_payload() {
87
local src=$1 root=$2 e w
88
[[ -d $src/$_libdir ]] && cp -a "$src/$_libdir/." "$root/$_libdir/"
89
for e in "$src"/*; do
90
[[ -e $e ]] || continue
91
case ${e##*/} in
92
"$_libdir"|set_env.sh) continue ;;
93
lib)
94
# only python wheels; the installer pip-installs them into site-packages
95
for w in "$e"/*.whl; do [[ -e $w ]] && _install_wheel "$w" "$root"; done
96
continue ;;
97
esac
98
cp -a "$e" "$root/"
99
done
100
# wheels kept in place (tools/*.whl) are also installed by upstream
101
while IFS= read -r -d '' w; do _install_wheel "$w" "$root"; done \
102
< <(find "$src" -name '*.whl' -print0)
103
}
104
105
_install_wheel() {
106
bsdtar -xf "$1" -C "$2/python/site-packages"
107
}
108
109
package() {
110
local root="$pkgdir/opt/ascend/cann-${pkgver}"
111
local u
112
install -d "$root/$_libdir" "$root/python/site-packages"
113
for u in "${_units[@]}"; do
114
_merge_payload "$srcdir/payloads/${u%%_*}" "$root"
115
done
116
117
# Root-level convenience links the upstream installer creates. Some units
118
# (test-ops) ship a top-level lib64; fold it into $_libdir/lib64 so the
119
# link can be created instead of nesting inside the real directory.
120
# Root "asc" is declared only by the devkit component and owned by
121
# asc-devkit-*.
122
local l
123
for l in bin conf devlib include lib64 pkg_inc; do
124
[[ -d $root/$_libdir/$l ]] || continue
125
if [[ -d $root/$l && ! -L $root/$l ]]; then
126
mkdir -p "$root/$_libdir/$l"
127
cp -a "$root/$l/." "$root/$_libdir/$l/"
128
rm -rf "$root/$l"
129
fi
130
ln -s "$_libdir/$l" "$root/$l"
131
done
132
133
# Replay the official installer's symlink farm (each bundled unit's
134
# filelist.csv "softlink" column): simulator chip aliases, tools/simulator,
135
# compiler/python, lib64/stub arch aliases, etc. devlib arch aliases are
136
# owned by asc-runtime-*; root arch links are created above.
137
local csv f1 f2 f3 inst f5 f6 f7 f8 links target link
138
for csv in "$root"/share/info/*/script/filelist.csv; do
139
[[ -f $csv ]] || continue
140
while IFS=, read -r f1 f2 f3 inst f5 f6 f7 f8 links _rest; do
141
[[ $links == NA || -z $links || $links == softlink ]] && continue
142
for l in ${links//;/ }; do
143
case $l in
144
asc|bin|conf|devlib|include|lib64|pkg_inc) continue ;;
145
*-linux/devlib/*) continue ;;
146
esac
147
target="$root/$inst" link="$root/$l"
148
[[ -e $target ]] || continue
149
[[ -e $link || -L $link ]] && continue
150
mkdir -p "${link%/*}"
151
ln -sfn "$(realpath --relative-to="${link%/*}" "$target")" "$link"
152
done
153
done < "$csv"
154
done
155
156
install -Dm644 "$srcdir/tk/script/eula_en.txt" \
157
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
158
159
# $root/set_env.sh and the /etc/profile.d + /etc/fish/conf.d integration are
160
# owned by asc-runtime-* (official layout: the runtime component ships the
161
# canonical CANN root env script; every component payload carries an
162
# identical copy). depends= on asc-runtime guarantees presence.
163
ln -sfn "cann-${pkgver}" "$pkgdir/opt/ascend/cann"
164
# The upstream installers build with a restrictive umask (750/640/440),
165
# which leaves a root install unreadable to non-root users (bisheng
166
# headers, cmake modules). Normalize to the Arch/AUR norm.
167
find "$pkgdir" -type d -exec chmod 755 {} +
168
find "$pkgdir" -type f -perm /111 -exec chmod 755 {} +
169
find "$pkgdir" -type f ! -perm /111 -exec chmod 644 {} +
170
}
171
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-26 07:46:00 | Low | 3 |
| 2026-10-26 07:44:04 | Medium | 2 |