asc-tools-git
LOW
maintainer greenhandzdl
0 votes
scanned 2026-10-26 07:46:00.476890
Why flagged
Sources are the project's own git repo (atomgit.com/cann/asc-tools), a cmake helper repo (gitcode.com/cann/cmake), and two tarballs from Huawei's official OBS cloud storage (myhuaweicloud.com) with checksums provided for the non-git sources; the git sources use SKIP which is normal for VCS sources, and the build process runs the project's own build.sh against an installed CANN SDK — no unrelated remote code execution or exfiltration is present.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Sources are the project's own git repo (atomgit.com/cann/asc-tools), a cmake helper repo (gitcode.com/cann/cmake), and two tarballs from Huawei's official OBS cloud storage (myhuaweicloud.com) with checksums provided for the non-git sources; the git sources use SKIP which is normal for VCS sources, and the build process runs the project's own build.sh against an installed CANN SDK — no unrelated remote code execution or exfiltration is present.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source=("$_repo::git+https://atomgit.com/cann/asc-tools.git#branch=9.2.0" -
PKGBUILD:22
"cann-cmake::git+https://gitcode.com/cann/cmake.git#tag=master-054"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: greenhandzdl <greenhandzdl@greenhandzdl.moe>
2
# asc-tools built from the AtomGit source tree.
3
# Building requires an installed CANN root (asc-toolkit-bin + asc-devkit).
4
pkgname=asc-tools-git
5
pkgver=9.2.0.r282.2575ba72
6
pkgrel=1
7
pkgdesc='Huawei Ascend CANN developer tools (cpudebug, npuchk, msobjdump) - source build'
8
arch=('x86_64' 'aarch64')
9
url='https://atomgit.com/cann/asc-tools'
10
license=('custom:CANN-OSLA-2.0')
11
depends=('glibc' 'gcc-libs' 'bash' 'python' 'asc-devkit' 'asc-toolkit')
12
provides=('asc-tools')
13
conflicts=('asc-tools')
14
makedepends=('git' 'cmake' 'gcc' 'make' 'python' 'ccache' 'asc-devkit' 'asc-toolkit')
15
options=('!strip' '!debug' 'staticlibs')
16
17
# Build against an installed CANN root; override for staged/CI trees.
18
_cann=${ASCEND_CANN_PATH:-/opt/ascend/cann-9.2.0}
19
_repo=asc-tools
20
_3rd=https://cann-3rd.obs.cn-north-4.myhuaweicloud.com
21
source=("$_repo::git+https://atomgit.com/cann/asc-tools.git#branch=9.2.0"
22
"cann-cmake::git+https://gitcode.com/cann/cmake.git#tag=master-054"
23
"makeself-release-2.5.0.tar.gz::$_3rd/makeself/makeself-release-2.5.0.tar.gz"
24
"makeself-2.5.0.patch::$_3rd/makeself/makeself-2.5.0.patch")
25
sha256sums=('SKIP' 'SKIP'
26
'705d0376db9109a8ef1d4f3876c9997ee6bed454a23619e1dbc03d25033e46ea'
27
'abb9efe26f95db61ce927a7d046ea2c73ec908cec984ea6316892b4c8b11d784')
28
29
pkgver() {
30
cd "$_repo"
31
local v
32
v=$(sed -n 's/.*set(ASC_TOOLS_VERSION "\([^"]*\)").*/\1/p' version.cmake)
33
printf '%s.r%s.%s' "${v:-9.2.0}" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
34
}
35
36
prepare() {
37
local dir="$srcdir/3rdlib"
38
mkdir -p "$dir/pkg"
39
ln -sfn "$srcdir/cann-cmake" "$dir/cann-cmake"
40
ln -sf "$srcdir/makeself-release-2.5.0.tar.gz" "$dir/"
41
ln -sf "$srcdir/makeself-2.5.0.patch" "$dir/pkg/"
42
}
43
44
build() {
45
cd "$_repo"
46
# makepkg's x86 host flags must not leak into the bundled device toolchain
47
# build; upstream supplies its own flags. Scrub any cached configure so
48
# stale CMAKE_*_FLAGS can't be reused.
49
rm -rf build build_out
50
unset CFLAGS CXXFLAGS LDFLAGS
51
export PATH="$_cann/bin:$PATH"
52
export LD_LIBRARY_PATH="$_cann/lib64:$_cann/devlib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
53
bash build.sh --pkg --pkg-type=run --cann_path="$_cann" \
54
--cann_3rd_lib_path="$srcdir/3rdlib" -j"$(nproc)"
55
}
56
57
package() {
58
cd "$_repo"
59
local root="$pkgdir/opt/ascend/cann-9.2.0" libdir="${CARCH}-linux"
60
local run payload e w
61
62
run=$(find . -name '*.run' -type f | head -1)
63
[[ -n $run ]] || { echo 'no .run produced' >&2; return 1; }
64
payload="$srcdir/payload-git"
65
rm -rf "$payload"
66
bash "$run" --noexec --extract="$payload"
67
68
install -d "$root/$libdir" "$root/python/site-packages"
69
[[ -d $payload/$libdir ]] && cp -a "$payload/$libdir/." "$root/$libdir/"
70
for e in "$payload"/*; do
71
[[ -e $e ]] || continue
72
case ${e##*/} in
73
"$libdir"|set_env.sh) continue ;;
74
lib) continue ;;
75
esac
76
cp -a "$e" "$root/"
77
done
78
while IFS= read -r -d '' w; do
79
bsdtar -xf "$w" -C "$root/python/site-packages"
80
done < <(find "$payload" -name '*.whl' -print0)
81
# owned by asc-toolkit-bin
82
rm -f "$root/$libdir/conf/path.cfg" \
83
"$root/$libdir/bin/setenv.bash"
84
[[ -d $root/tools/cpudebug ]] && ln -sfn cpudebug "$root/tools/tikicpulib"
85
86
# Replay the official installer's symlink farm (filelist.csv "softlink"
87
# column): cpudebug arch/cmake aliases, profiler links, etc. Root arch
88
# links are owned by asc-toolkit-bin, as is toolkit/tools (oam-tools).
89
local csv f1 f2 f3 inst f5 f6 f7 f8 links l target link
90
for csv in "$root"/share/info/*/script/filelist.csv; do
91
[[ -f $csv ]] || continue
92
while IFS=, read -r f1 f2 f3 inst f5 f6 f7 f8 links _rest; do
93
[[ $links == NA || -z $links || $links == softlink ]] && continue
94
for l in ${links//;/ }; do
95
case $l in
96
asc|bin|conf|devlib|include|lib64|pkg_inc|toolkit/tools) continue ;;
97
esac
98
target="$root/$inst" link="$root/$l"
99
[[ -e $target ]] || continue
100
[[ -e $link || -L $link ]] && continue
101
mkdir -p "${link%/*}"
102
ln -sfn "$(realpath --relative-to="${link%/*}" "$target")" "$link"
103
done
104
done < "$csv"
105
done
106
107
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
108
# The upstream installers build with a restrictive umask (750/640/440),
109
# which leaves a root install unreadable to non-root users (bisheng
110
# headers, cmake modules). Normalize to the Arch/AUR norm.
111
find "$pkgdir" -type d -exec chmod 755 {} +
112
find "$pkgdir" -type f -perm /111 -exec chmod 755 {} +
113
find "$pkgdir" -type f ! -perm /111 -exec chmod 644 {} +
114
}
115
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-26 07:46:00 | Low | 3 |
| 2026-10-26 07:44:04 | Medium | 2 |