rocm-gfx1153-bin

maintainer luciddream · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Downloads a prebuilt ROCm tarball from repo.amd.com, which is AMD's own official repository infrastructure, with a sha256 checksum provided; the package installs vendor-supplied binaries but from the project's own official domain, making this a normal (if large) binary packaging rather than a supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads a prebuilt ROCm tarball from repo.amd.com, which is AMD's own official repository infrastructure, with a sha256 checksum provided; the package installs vendor-supplied binaries but from the project's own official domain, making this a normal (if large) binary packaging rather than a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "https://repo.amd.com/rocm/tarball-multi-arch/therock-dist-linux-gfx1153-7.14.0.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: George Sofianos <george at sofianos dot dev>
    
      2
    
      3# Release notes https://rocm.docs.amd.com/en/latest/about/release-notes.html
    
      4pkgname=rocm-gfx1153-bin
    
      5pkgdesc="ROCm Core SDK and TheRock Build System - Ryzen AI 5/7 - Gorgon Point"
    
      6pkgver=7.14.0
    
      7pkgrel=1
    
      8epoch=0
    
      9arch=('x86_64')
    
      10url='http://www.amd.com'
    
      11license=('custom:AMD')
    
      12depends=('ocl-icd' 'gcc-libs')
    
      13provides=('opencl-driver' 'amdrocm-amdsmi' 'amdrocm-llvm' 'amdrocm-runtime' 'amdrocm-fft' 'amdrocm-blas' 'amdrocm-sparse' 'amdrocm-solver' 'amdrocm-dnn' 'amdrocm-rand' 'amdrocm-ccl' 'amdrocm-profiler' 'amdrocm-profiler-base' 'amdrocm-base' 'amdrocm-ck'
    
      14'amdrocm-debugger' 'amdrocm-hipify' 'amdrocm-opencl' 'amdrocm-decode' 'amdrocm-jpeg' 'amdrocm-rccl' 'amdrocm-rocshmem' 'amdrocm-rdc' 'amdrocm-sysdeps')
    
      15conflicts=('opencl-amd' 'opencl-amd-dev' 'rocm-bin' 'rocm-gfx101x-bin' 'rocm-gfx103x-bin' 'rocm-gfx110x-bin' 'rocm-gfx120x-bin' 'rocm-gfx1150-bin' 'rocm-gfx1151-bin' 'rocm-gfx1152-bin' 'rocm-opencl-runtime' 'rocm' 'rocm-core' 'comgr' 'rocm-hip' 'hip' 'hsa-rocr' 'rocminfo' 'hip-runtime-amd' 'rocm-device-libs' 'rocm-language-runtime' 'rocm-hip-runtime' 'rocm-ocl-icd' 'rocm-opencl-icd-loader' 'rocm-dbgapi' 'rocm-debug-agent' 'rocm-gdb'
    
      16'rocprofiler' 'rocprofiler-plugins' 'rocprofiler-register' 'roctracer' 'hsa-amd-aqlprofile' 'rocm-openmp' 'openmp-extras-runtime' 'rocm-cmake' 'rocm-smi-lib' 'amdsmi' 'amd-smi-lib' 'composable-kernel' 'hipcc' 'rocm-llvm' 'rocblas' 'rocsolver' 'hipblas' 'hipblas-common' 'hipblaslt' 'hiprand' 'rocdecode' 'rocjpeg' 'rocprim' 'hipcub' 'rocfft' 'hipfft' 'hipify-clang' 'hipsolver' 'rocsparse' 'hipsparse' 'hipsparselt' 'hiptensor' 'rccl' 'rocrand' 'rocalution' 'rocm-hip-libraries' 'rocthrust' 'rocprofiler-compute' 'rocprofiler-debug' 'rocprofiler-systems' 'rocm-hip-sdk' 'rocm-opencl' 'rocm-opencl-runtime' 'rocm-opencl-sdk' 'rocwmma' 'rocprofiler-sdk' 'rocprofiler-sdk-roctx' 'rocprofiler-sdk-rocpd' 'rocm-developer-tools' 'rocshmem' 'miopen' 'miopen-hip' 
    
      17'rocm-ml-libraries' 'rocm-ml-sdk')
    
      18optdepends=('clinfo')
    
      19options=('!strip')
    
      20
    
      21source=(
    
      22"https://repo.amd.com/rocm/tarball-multi-arch/therock-dist-linux-gfx1153-7.14.0.tar.gz"
    
      23)
    
      24
    
      25sha256sums=(
    
      26"56dc233ace740364dca06ca12c22749a85e5f5f54ae3812ca24426d3c5eb787d"
    
      27)
    
      28
    
      29prepare() {
    
      30    mkdir -p "${srcdir}/opt/rocm/core"
    
      31    bsdtar xf therock-dist-linux-gfx1153-7.14.0.tar.gz -C ${srcdir}/opt/rocm/core
    
      32}
    
      33
    
      34package() {
    
      35    mv "${srcdir}/opt/" "${pkgdir}/"
    
      36
    
      37    mkdir -p "${pkgdir}/opt/amdgpu/share/libdrm"
    
      38    cd "${pkgdir}/opt/amdgpu/share/libdrm"
    
      39    ln -s /usr/share/libdrm/amdgpu.ids amdgpu.ids
    
      40
    
      41    mkdir -p "${pkgdir}/etc/OpenCL/vendors"
    
      42    echo /opt/rocm/core/lib/opencl/libamdocl64.so > "${pkgdir}/etc/OpenCL/vendors/amdocl64.icd"
    
      43
    
      44    mkdir -p "${pkgdir}/etc/ld.so.conf.d"
    
      45    echo /opt/rocm/core/lib >> "$pkgdir/etc/ld.so.conf.d/rocm-bin.conf"
    
      46
    
      47    mkdir -p "${pkgdir}/etc/profile.d"
    
      48    echo export PATH="\${PATH}:/opt/rocm/core/bin:/opt/rocm/core/lib/llvm/bin" > "$pkgdir/etc/profile.d/rocm-bin.sh"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 17:58:31	LOW	3
2026-07-16 17:52:43	MEDIUM	2