libtorch-rocm
MEDIUM
maintainer selebray1998
0 votes
scanned 2026-10-26 03:43:44.749651
Why flagged
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
source=("libtorch-shared-with-deps-${pkgver}+rocm${_rocm_ver}.zip::https://download.pytorch.org/libtorch/rocm${_rocm_ver}/libtorch-shared-with-deps-${pkgver}%2Brocm${_rocm_ver}.zip"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Selene Bray-Hernandez <selebray1998@gmail.com>
2
# Maintainer: Aaron Liu
3
# Contributor: Zhirui Dai <daizhirui at hotmail dot com>
4
5
pkgname=libtorch-rocm
6
pkgver=2.12.0
7
pkgrel=3
8
pkgdesc="PyTorch but C++ as an isolated folder, with ROCm included"
9
arch=('x86_64')
10
url='https://docs.pytorch.org/cppdocs/installing.html'
11
license=('BSD-3-Clause')
12
# Bound tied to the pinned _rocm_ver: libtorch links against the ROCm runtime it
13
# was built with, and a mismatch shows up as an undefined HIP symbol at dlopen()
14
# (surfacing as a generic module-load failure in audacity-openvino).
15
depends=(pybind11 'rocm-core>=7.2')
16
makedepends=(python)
17
replaces=(libtorch-cxx11abi-rocm)
18
provides=("libtorch=${pkgver}")
19
conflicts=(libtorch)
20
21
# Pinned, not probed: sha256sums below are for this exact artifact, so the
22
# ROCm version must not vary per host. Bump together with pkgver.
23
_rocm_ver=7.2
24
25
# Use a filename without URL encoding to avoid extraction issues
26
source=("libtorch-shared-with-deps-${pkgver}+rocm${_rocm_ver}.zip::https://download.pytorch.org/libtorch/rocm${_rocm_ver}/libtorch-shared-with-deps-${pkgver}%2Brocm${_rocm_ver}.zip"
27
"https://github.com/pytorch/pytorch/raw/refs/tags/v${pkgver}/LICENSE")
28
# Upstream publishes no checksum sidecars for these zips (listing is browsable,
29
# but *.sha256 / SHA256SUMS return 403), so these are hashes of the artifacts we
30
# actually fetched. They are coupled: pkgver, _rocm_ver and both sums must move
31
# together, or the build fails the validity check by design.
32
# Upstream re-push under the same name => the sum stops matching for everyone:
33
# verify `curl -sIL <url> | grep -i content-length` against the archive size
34
# first, then bump pkgrel and update the sum.
35
sha256sums=('8c740f551d52f4318cdd3908890cfb22f280b40620feb2538432c2c75ab0db55'
36
'bd018feef8825e88181c84eb7e3aa4eafb8f08a20d9fd6ef948569610c4a3e43')
37
options=('!debug' '!strip' '!libtool' '!staticlibs' '!zipman')
38
39
pkgver() {
40
# Read the version from the extracted pre-built package instead of querying
41
# api.github.com. The old scrape was anonymous (60 req/h rate limit) and
42
# returned an empty string on 403, aborting the build with
43
# "pkgver is not allowed to be empty". It also reported whatever release
44
# was newest, not the one source=() actually pinned via ${pkgver}.
45
local bv
46
bv=$(cat libtorch/build-version 2>/dev/null)
47
bv=${bv%%+*} # "2.12.0+rocm7.1" -> "2.12.0"
48
if [ -z "$bv" ]; then
49
# No build-version file: keep the pinned value rather than emitting an
50
# empty version (which is what aborted the reported build).
51
bv=$pkgver
52
elif [ "$bv" != "$pkgver" ]; then
53
# Refuse to silently relabel the archive. source=() is expanded from the
54
# static $pkgver before pkgver() runs, so echoing $bv here would ship
55
# binaries of one release under another release's name and provides=().
56
printf 'error: archive contains libtorch %s but PKGBUILD pins %s\n' \
57
"$bv" "$pkgver" >&2
58
printf 'error: update pkgver and sha256sums together\n' >&2
59
return 1
60
fi
61
printf '%s\n' "$bv"
62
}
63
64
prepare() {
65
# Remove bundled pybind11 headers as we use system pybind11
66
rm -r libtorch/include/pybind11
67
68
# Fix ELF load command alignment in libtorch_cpu.so.
69
# Pre-built PyTorch ROCm binaries sometimes ship zero-length LOAD
70
# segments with misaligned p_offset, which glibc rejects with
71
# "ELF load command address/offset not page-aligned".
72
python3 -c "
73
import struct
74
with open('libtorch/lib/libtorch_cpu.so', 'r+b') as f:
75
f.seek(32)
76
e_phoff = struct.unpack('<Q', f.read(8))[0]
77
f.seek(56)
78
e_phnum = struct.unpack('<H', f.read(2))[0]
79
fixed = 0
80
for i in range(e_phnum):
81
entry_off = e_phoff + i * 56
82
f.seek(entry_off)
83
data = f.read(56)
84
p_type, p_flags, p_offset, p_vaddr, p_paddr, p_filesz, p_memsz, p_align = struct.unpack('<IIQQQQQQ', data)
85
if p_type != 1 or p_filesz or p_memsz: # non-zero PT_LOAD
86
continue
87
if (p_vaddr - p_offset) & (p_align - 1) == 0:
88
continue
89
f.seek(entry_off + 8)
90
f.write(struct.pack('<Q', p_vaddr))
91
print(f'Fixed segment {i}: p_offset 0x{p_offset:x} -> 0x{p_vaddr:x}')
92
fixed += 1
93
if fixed:
94
print(f'Fixed {fixed} ELF segment(s) in libtorch_cpu.so')
95
else:
96
print('No ELF alignment issues in libtorch_cpu.so')
97
"
98
99
# Suppress rocshmem warning in downstream builds.
100
# rocshmem is not packaged in Arch; the find_package call in LoadHIP.cmake
101
# is optional (not REQUIRED) but still emits a CMake warning when missing.
102
sed -i '/find_package_and_print_version(rocshmem)/s/^/# /' \
103
libtorch/share/cmake/Caffe2/public/LoadHIP.cmake
104
}
105
106
package() {
107
# Install to /opt/libtorch
108
install -dm755 "${pkgdir}/opt"
109
mv libtorch "${pkgdir}/opt/"
110
111
# Install license
112
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/libtorch/LICENSE"
113
}
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-10-26 03:43@@ -2,47 +2,63 @@ # Maintainer: Aaron Liu # Contributor: Zhirui Dai <daizhirui at hotmail dot com> -# Probe which ROCm version has a libtorch binary for the current pkgver.-# Tries the system version first, then known fallbacks.-_detect_rocm_ver() {- local sysver=$(pacman -Q rocm-core 2>/dev/null | awk '{print $2}' | cut -d. -f1-2)- for v in "$sysver" "7.2" "7.1" "6.2" "6.1" "6.0"; do- [ -n "$v" ] || continue- if curl -sfI --max-time 5 \- "https://download.pytorch.org/libtorch/rocm$v/libtorch-shared-with-deps-${pkgver}%2Brocm$v.zip" \- >/dev/null 2>&1; then- echo "$v"- return 0- fi- done- echo "7.1"-}-_rocm_ver=$(_detect_rocm_ver)- pkgname=libtorch-rocm pkgver=2.12.0-pkgrel=2+pkgrel=3 pkgdesc="PyTorch but C++ as an isolated folder, with ROCm included" arch=('x86_64') url='https://docs.pytorch.org/cppdocs/installing.html' license=('BSD-3-Clause')-depends=(pybind11 rocm-core)-makedepends=(curl python)+# Bound tied to the pinned _rocm_ver: libtorch links against the ROCm runtime it+# was built with, and a mismatch shows up as an undefined HIP symbol at dlopen()+# (surfacing as a generic module-load failure in audacity-openvino).+depends=(pybind11 'rocm-core>=7.2')+makedepends=(python) replaces=(libtorch-cxx11abi-rocm) provides=("libtorch=${pkgver}") conflicts=(libtorch)++# Pinned, not probed: sha256sums below are for this exact artifact, so the+# ROCm version must not vary per host. Bump together with pkgver.+_rocm_ver=7.2+ # Use a filename without URL encoding to avoid extraction issues source=("libtorch-shared-with-deps-${pkgver}+rocm${_rocm_ver}.zip::https://download.pytorch.org/libtorch/rocm${_rocm_ver}/libtorch-shared-with-deps-${pkgver}%2Brocm${_rocm_ver}.zip" "https://github.com/pytorch/pytorch/raw/refs/tags/v${pkgver}/LICENSE")-sha256sums=('SKIP'- 'SKIP')+# Upstream publishes no checksum sidecars for these zips (listing is browsable,+# but *.sha256 / SHA256SUMS return 403), so these are hashes of the artifacts we+# actually fetched. They are coupled: pkgver, _rocm_ver and both sums must move+# together, or the build fails the validity check by design.+# Upstream re-push under the same name => the sum stops matching for everyone:+# verify `curl -sIL <url> | grep -i content-length` against the archive size+# first, then bump pkgrel and update the sum.+sha256sums=('8c740f551d52f4318cdd3908890cfb22f280b40620feb2538432c2c75ab0db55'+ 'bd018feef8825e88181c84eb7e3aa4eafb8f08a20d9fd6ef948569610c4a3e43') options=('!debug' '!strip' '!libtool' '!staticlibs' '!zipman') pkgver() {- curl -sL https://api.github.com/repos/pytorch/pytorch/releases/latest |- grep '"tag_name":' |- sed 's/.*: "//;s/",//' |- sed 's/^v//'+ # Read the version from the extracted pre-built package instead of querying+ # api.github.com. The old scrape was anonymous (60 req/h rate limit) and+ # returned an empty string on 403, aborting the build with+ # "pkgver is not allowed to be empty". It also reported whatever release+ # was newest, not the one source=() actually pinned via ${pkgver}.+ local bv+ bv=$(cat libtorch/build-version 2>/dev/null)+ bv=${bv%%+*} # "2.12.0+rocm7.1" -> "2.12.0"+ if [ -z "$bv" ]; then+ # No build-version file: keep the pinned value rather than emitting an+ # empty version (which is what aborted the reported build).+ bv=$pkgver+ elif [ "$bv" != "$pkgver" ]; then+ # Refuse to silently relabel the archive. source=() is expanded from the+ # static $pkgver before pkgver() runs, so echoing $bv here would ship+ # binaries of one release under another release's name and provides=().+ printf 'error: archive contains libtorch %s but PKGBUILD pins %s\n' \+ "$bv" "$pkgver" >&2+ printf 'error: update pkgver and sha256sums together\n' >&2+ return 1+ fi+ printf '%s\n' "$bv" } prepare() {@@ -79,6 +95,12 @@ else: print('No ELF alignment issues in libtorch_cpu.so') "++ # Suppress rocshmem warning in downstream builds.+ # rocshmem is not packaged in Arch; the find_package call in LoadHIP.cmake+ # is optional (not REQUIRED) but still emits a CMake warning when missing.+ sed -i '/find_package_and_print_version(rocshmem)/s/^/# /' \+ libtorch/share/cmake/Caffe2/public/LoadHIP.cmake } package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-26 03:43:44 | Medium | 1 |
| 2026-06-19 19:07:35 | Clean | 2 |
| 2026-06-18 16:11:54 | Medium | 1 |