asc-tools-bin
LOW
maintainer greenhandzdl
0 votes
scanned 2026-10-26 07:46:00.476890
Why flagged
Downloads official Huawei CANN toolkit ZIPs from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com) with sha256 checksums; the non-standard host is plausibly the project's own official distribution infrastructure, and the package simply extracts prebuilt binaries from the vendor's official installer bundle rather than running arbitrary remote code.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads official Huawei CANN toolkit ZIPs from Huawei's own OBS cloud storage (ascend-repo.obs.cn-east-2.myhuaweicloud.com) with sha256 checksums; the non-standard host is plausibly the project's own official distribution infrastructure, and the package simply extracts prebuilt binaries from the vendor's official installer bundle rather than running arbitrary remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-x86_64.zip")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: greenhandzdl <greenhandzdl@greenhandzdl.moe>
2
# CANN asc-tools as shipped in the official 9.2.0 toolkit bundle.
3
# Prefer asc-tools-git if you want the AtomGit source build.
4
pkgname=asc-tools-bin
5
pkgver=9.2.0
6
pkgrel=1
7
pkgdesc='Huawei Ascend CANN developer tools (cpudebug, msobjdump, operator_cmp, show_kernel_debug_data)'
8
arch=('x86_64' 'aarch64')
9
url='https://www.hiascend.com/developer/download/community/result?module=cann'
10
license=('custom:CANN-OSLA-2.0')
11
depends=('glibc' 'gcc-libs' 'bash' 'python' 'asc-devkit' 'asc-toolkit')
12
provides=('asc-tools')
13
conflicts=('asc-tools')
14
options=('!strip' '!debug' 'staticlibs')
15
makedepends=('unzip')
16
17
_zip="cann-toolkit-${pkgver}.zip"
18
source_x86_64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-x86_64.zip")
19
source_aarch64=("${_zip}::https://ascend-repo.obs.cn-east-2.myhuaweicloud.com/CANN/CANN%20${pkgver}/Ascend-cann-toolkit_${pkgver}_linux-aarch64.zip")
20
sha256sums_x86_64=('6d753badfcddcf13d1049906e40f0c26150ffc01d4ad226ad8c74f352cbf7442')
21
sha256sums_aarch64=('4c432c89b0561de21e2d9b2dd0bc7bf78d3461e4eab645c1613d72422b4bdbbf')
22
noextract=("${_zip}")
23
_libdir="${CARCH}-linux"
24
25
prepare() {
26
cd "$srcdir"
27
[[ -f .prepared ]] && return
28
rm -rf outer inner tk payload
29
mkdir -p outer inner
30
unzip -q "$_zip" -d outer
31
unzip -q "outer/Ascend-cann-toolkit_${pkgver}_linux-${CARCH}.zip" -d inner
32
rm -rf tk; bash "inner/Ascend-cann-toolkit_${pkgver}_linux-${CARCH}.run" --noexec --extract="$srcdir/tk"
33
rm -rf payload; bash "tk/run_package/cann-asc-tools_${pkgver}_linux-${CARCH}.run" --noexec --extract="$srcdir/payload"
34
touch .prepared
35
}
36
37
package() {
38
local root="$pkgdir/opt/ascend/cann-${pkgver}"
39
local src="$srcdir/payload" libdir="${CARCH}-linux" e w
40
41
install -d "$root/$libdir" "$root/python/site-packages"
42
[[ -d $src/$libdir ]] && cp -a "$src/$libdir/." "$root/$libdir/"
43
for e in "$src"/*; do
44
[[ -e $e ]] || continue
45
case ${e##*/} in
46
"$libdir"|set_env.sh) continue ;;
47
lib)
48
for w in "$e"/*.whl; do
49
[[ -e $w ]] && bsdtar -xf "$w" -C "$root/python/site-packages"
50
done
51
continue ;;
52
esac
53
cp -a "$e" "$root/"
54
done
55
while IFS= read -r -d '' w; do
56
bsdtar -xf "$w" -C "$root/python/site-packages"
57
done < <(find "$src" -name '*.whl' -print0)
58
rm -f "$root/$libdir/conf/path.cfg" \
59
"$root/$libdir/bin/setenv.bash"
60
61
[[ -d $root/tools/cpudebug ]] && ln -sfn cpudebug "$root/tools/tikicpulib"
62
63
# Replay the official installer's symlink farm (filelist.csv "softlink"
64
# column): cpudebug arch/cmake aliases, profiler links, etc. Root arch
65
# links are owned by asc-toolkit-bin, as is toolkit/tools (oam-tools).
66
local csv f1 f2 f3 inst f5 f6 f7 f8 links l target link
67
for csv in "$root"/share/info/*/script/filelist.csv; do
68
[[ -f $csv ]] || continue
69
while IFS=, read -r f1 f2 f3 inst f5 f6 f7 f8 links _rest; do
70
[[ $links == NA || -z $links || $links == softlink ]] && continue
71
for l in ${links//;/ }; do
72
case $l in
73
asc|bin|conf|devlib|include|lib64|pkg_inc|toolkit/tools) continue ;;
74
esac
75
target="$root/$inst" link="$root/$l"
76
[[ -e $target ]] || continue
77
[[ -e $link || -L $link ]] && continue
78
mkdir -p "${link%/*}"
79
ln -sfn "$(realpath --relative-to="${link%/*}" "$target")" "$link"
80
done
81
done < "$csv"
82
done
83
84
install -Dm644 "$srcdir/tk/script/eula_en.txt" \
85
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
86
# The upstream installers build with a restrictive umask (750/640/440),
87
# which leaves a root install unreadable to non-root users (bisheng
88
# headers, cmake modules). Normalize to the Arch/AUR norm.
89
find "$pkgdir" -type d -exec chmod 755 {} +
90
find "$pkgdir" -type f -perm /111 -exec chmod 755 {} +
91
find "$pkgdir" -type f ! -perm /111 -exec chmod 644 {} +
92
}
93
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-26 07:46:00 | Low | 3 |
| 2026-10-26 07:44:04 | Medium | 2 |