rocm-gpu-agent
LOW
maintainer orphaned
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from a legitimate upstream source (ROCm/gpu-agent) and uses Go vendoring for offline builds; the flagged 'external install' via `go install` in prepare() is for a build tool (protoc-gen-gogofast) required to generate code, not a runtime dependency, and poses no supply-chain risk as it is used in a controlled, reproducible build context.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate upstream source (ROCm/gpu-agent) and uses Go vendoring for offline builds; the flagged 'external install' via `go install` in prepare() is for a build tool (protoc-gen-gogofast) required to generate code, not a runtime dependency, and poses no supply-chain risk as it is used in a controlled, reproducible build context.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:173
go install github.com/gogo/protobuf/protoc-gen-gogofast@v1.3.2
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: SteamedFish <steamedfish@hotmail.com>
2
# Standalone package built from https://github.com/ROCm/gpu-agent
3
#
4
# Provides the gpuagent C++ gRPC daemon and gpuctl Go CLI used by amdgpu-exporter.
5
# The upstream Makefile is patched to use system libraries instead of the
6
# submodule-built C++ dependencies that the upstream tree normally drives.
7
8
pkgname=rocm-gpu-agent
9
pkgver=1.5.1
10
pkgrel=1
11
pkgdesc="AMD ROCm GPU Agent: metrics daemon (gpuagent) and control CLI (gpuctl) for AMD Instinct GPUs"
12
arch=('x86_64')
13
url="https://github.com/ROCm/gpu-agent"
14
license=('Apache-2.0')
15
depends=(
16
'amdsmi'
17
'abseil-cpp'
18
'grpc'
19
'zeromq'
20
21
'protobuf'
22
'libev'
23
)
24
makedepends=(
25
'go'
26
'python'
27
'patchelf'
28
'boost'
29
)
30
31
_srcname="gpu-agent-${pkgver}"
32
33
source=(
34
"${_srcname}.tar.gz::https://github.com/ROCm/gpu-agent/archive/refs/tags/v${pkgver}.tar.gz"
35
'gpuagent.service'
36
'gpuagent.conf'
37
'fix-base-snprintf-sizeof-pointer.patch'
38
'fix-gpu-watch-stack-overflow.patch'
39
'fix-boost-lockfree-queue-capacity.patch'
40
)
41
sha256sums=('011f44387aad24942b63b346f360453ba4abfb6790d493dd34401b768cc94cc6'
42
'8d35441bdbae38652e52fcfe22c7b677fdcad9a184ffe333e77507afc9d5d27e'
43
'b266380dbe91bc69ffc94ea9a9b7412f4699eda7faf22a617769faeab19ba0bb'
44
'70291528d5b84a29516cc7aa907aa5c4c6251b7b0bd6b01f6fc6fd37ee897018'
45
'1a331e00133c6ff3306d314d9084201b3ddaaa62f9b0cdc54b3f7f94a4decd32'
46
'5e31b7a994d359221553beb3561ef844f954cab8613364c98e017e8104e7be52')
47
backup=('etc/gpuagent/gpuagent.conf')
48
49
# ---------------------------------------------------------------------------
50
# prepare(): patch the upstream Makefile to use system libraries
51
# ---------------------------------------------------------------------------
52
prepare() {
53
local agentdir="${srcdir}/${_srcname}/sw/nic/gpuagent"
54
55
# Use GOPROXY mirror for all go commands: this host's IPv6 route to
56
# proxy.golang.org times out (dial tcp [2607:...]:443: i/o timeout).
57
export GOPROXY="https://mirrors.aliyun.com/goproxy,direct"
58
59
# ---- 0. Fix upstream bug: sizeof(pointer) used instead of buffer size in snprintf ----
60
patch -p1 -d "${srcdir}/${_srcname}" < "${srcdir}/fix-base-snprintf-sizeof-pointer.patch"
61
62
# ---- 0b. Fix GPUWatchGet stack overflow: ~2.3 MB stack var -> heap allocation ----
63
patch -p1 -d "${srcdir}/${_srcname}" < "${srcdir}/fix-gpu-watch-stack-overflow.patch"
64
65
# ---- 0c. Fix boost >= 1.91: lockfree::queue default ctor requires static capacity ----
66
patch -p1 -d "${srcdir}/${_srcname}" < "${srcdir}/fix-boost-lockfree-queue-capacity.patch"
67
68
# ---- 1. Fix hardcoded ABS_DIR (absolute build-root path) ----
69
sed -i "s|ABS_DIR\s*:=\s*/usr/src/github.com/ROCm/gpu-agent/sw|ABS_DIR := ${srcdir}/${_srcname}/sw|g" \
70
"${agentdir}/Makefile"
71
72
# ---- 2. Use system protoc / grpc_cpp_plugin ----
73
sed -i \
74
-e 's|PROTOC\s*:=\s*${BLD_DIR}/bin/protoc|PROTOC := /usr/bin/protoc|g' \
75
-e 's|GRPC_CPP_PLUGIN\s*:=\s*${BLD_BIN_DIR}/grpc_cpp_plugin|GRPC_CPP_PLUGIN := /usr/bin/grpc_cpp_plugin|g' \
76
"${agentdir}/Makefile"
77
78
# ---- 3. Replace static lib flags with dynamic equivalents ----
79
sed -i \
80
-e 's|-l:libprotobuf\.a|-lprotobuf|g' \
81
-e 's|-l:libgrpc\.a|-lgrpc|g' \
82
-e 's|-l:libgrpc++\.a|-lgrpc++|g' \
83
-e 's|-l:libgpr\.a|-lgpr|g' \
84
-e 's|-l:libre2\.a|-lre2|g' \
85
-e 's|-l:libev\.a|-lev|g' \
86
-e 's|-l:libzmq\.a|-lzmq|g' \
87
-e 's|-l:libssl\.a|-lssl|g' \
88
-e 's|-l:libcrypto\.a|-lcrypto|g' \
89
"${agentdir}/Makefile"
90
91
# ---- 4. Remove BLD_LIB_DIR -L and -rpath flags ----
92
sed -i \
93
-e 's|-L$(BLD_LIB_DIR)||g' \
94
-e 's|-L${BLD_DIR}/lib64||g' \
95
-e 's|-L${BLD_DIR}/lib||g' \
96
-e 's|-Wl,-rpath,$(BLD_LIB_DIR)||g' \
97
-e 's|-Wl,-rpath-link,$(BLD_LIB_DIR)||g' \
98
"${agentdir}/Makefile"
99
100
# ---- 5. Redirect AMD SMI headers and libs to ROCm system paths ----
101
sed -i \
102
-e 's|INC_AMD_SMI\s*:=.*|INC_AMD_SMI := /opt/rocm/include|g' \
103
-e 's|-L${TOPDIR}/nic/third-party/rocm/amd_smi_lib/${CARCH}/lib/|-L/opt/rocm/lib|g' \
104
"${agentdir}/Makefile"
105
106
# ---- 6. Touch the build-libs stamp to skip submodule C++ dep builds ----
107
local stamp_dir="${srcdir}/${_srcname}/sw/nic/build/${CARCH}/sim/out"
108
mkdir -p "${stamp_dir}"
109
touch "${stamp_dir}/.build_libs_done"
110
111
# ---- 6b. Fix protobuf v4 API: always_print_primitive_fields was renamed ----
112
sed -i 's/always_print_primitive_fields/always_print_fields_with_no_presence/g' \
113
"${agentdir}/svc/trace.cc"
114
115
# ---- 6c. Fix abseil component lib names for abseil-cpp >= 20230802 ----
116
# absl_bad_optional_access, absl_bad_any_cast_impl, absl_bad_variant_access
117
# were merged into absl_throw_delegate; absl_low_level_hash merged into absl_hash;
118
# absl_leak_check_disable removed; absl_random_internal_pool_urbg renamed to
119
# absl_random_internal_entropy_pool; absl_flags split into sub-libs (already linked).
120
sed -i \
121
-e 's/ -labsl_bad_optional_access//g' \
122
-e 's/ -labsl_bad_any_cast_impl//g' \
123
-e 's/ -labsl_bad_variant_access//g' \
124
-e 's/ -labsl_low_level_hash//g' \
125
-e 's/ -labsl_leak_check_disable//g' \
126
-e 's/-labsl_random_internal_pool_urbg/-labsl_random_internal_entropy_pool/g' \
127
-e 's/ -labsl_flags / /g' \
128
"${agentdir}/Makefile"
129
130
# ---- 6e. Replace LDFLAGS_COMMON using pkg-config (deduplicated, --as-needed) ----
131
python3 - "${agentdir}/Makefile" <<'PYEOF'
132
import sys, subprocess, re
133
makefile = sys.argv[1]
134
libs_raw = subprocess.check_output(
135
['pkg-config', '--libs', 'protobuf', 'grpc++', 'grpc'],
136
text=True).split()
137
seen = set()
138
libs_deduped = []
139
for tok in libs_raw:
140
if tok in ('-lutf8_range',): # transitively satisfied, causes namcap unused-lib warning
141
continue
142
if tok not in seen:
143
seen.add(tok)
144
libs_deduped.append(tok)
145
ldflags_new = (
146
'LDFLAGS_COMMON := -Wl,--as-needed -pthread -rdynamic -no-canonical-prefixes'
147
' -Wl,--gc-sections -Wl,-z,relro,-z,now -Wl,--build-id=md5 -Wl,--hash-style=gnu'
148
' -lgrpc++_reflection'
149
' -lupb_textformat_lib -lupb_json_lib -lupb_reflection_lib -lupb_wire_lib'
150
' -lupb_message_lib -lupb_mini_descriptor_lib -lupb_mini_table_lib'
151
' -lupb_hash_lib -lupb_mem_lib -lupb_base_lib -lupb_lex_lib'
152
' -lcares -laddress_sorting -lev -lzmq'
153
' ' + ' '.join(libs_deduped) +
154
' -lutf8_validity -lrt -lm -lz\n'
155
)
156
with open(makefile) as f:
157
text = f.read()
158
# Replace the whole multiline LDFLAGS_COMMON block
159
text = re.sub(
160
r'LDFLAGS_COMMON\s*:=[^\\\n]*(?:\\\n[^\\\n]*)*(?:\n[ \t]+[^\n]*)?',
161
ldflags_new,
162
text, count=1)
163
with open(makefile, 'w') as f:
164
f.write(text)
165
PYEOF
166
167
168
# ---- 7. Generate protobuf Go stubs required by the CLI ----
169
# gen/go/ does not exist in the tarball; must be generated before vendoring.
170
local _gotools="${srcdir}/gotools"
171
local topdir="${srcdir}/${_srcname}/sw"
172
GOPATH="${_gotools}" GOFLAGS="-mod=mod" \
173
go install github.com/gogo/protobuf/protoc-gen-gogofast@v1.3.2
174
PATH="${_gotools}/bin:${PATH}" \
175
make -C "${agentdir}" TOPDIR="${topdir}" gen-protos
176
177
# ---- 8. Vendor Go dependencies for offline build ----
178
if [[ ! -d "${agentdir}/vendor" ]]; then
179
cd "${agentdir}"
180
go mod vendor
181
fi
182
}
183
184
# ---------------------------------------------------------------------------
185
# build(): compile gpuagent and gpuctl
186
# ---------------------------------------------------------------------------
187
build() {
188
local agentdir="${srcdir}/${_srcname}/sw/nic/gpuagent"
189
local topdir="${srcdir}/${_srcname}/sw"
190
# protoc-gen-gogofast (built during prepare) must be in PATH for gen-protos
191
export GOPATH="${srcdir}/gotools"
192
export PATH="${GOPATH}/bin:${PATH}"
193
# Ensure the build-libs stamp exists (prepare() may have been skipped via -ef)
194
local stamp_dir="${srcdir}/${_srcname}/sw/nic/build/${CARCH}/sim/out"
195
mkdir -p "${stamp_dir}"
196
touch "${stamp_dir}/.build_libs_done"
197
# gpuagent C++ daemon via patched Makefile
198
make -C "${agentdir}" TOPDIR="${topdir}" gpuagent
199
200
# gpuctl pure-Go CLI (GOPROXY mirror avoids IPv6 timeout; vendored anyway)
201
export GOPROXY="https://mirrors.aliyun.com/goproxy,direct"
202
cd "${agentdir}"
203
CGO_ENABLED=1 go build \
204
-trimpath \
205
-buildmode=pie \
206
-ldflags="-s -w -linkmode=external -extldflags='-Wl,--as-needed,-z,relro,-z,now'" \
207
-mod=vendor \
208
-o "${srcdir}/gpuctl" \
209
./cli
210
}
211
212
# ---------------------------------------------------------------------------
213
# package(): install gpuagent + gpuctl
214
# ---------------------------------------------------------------------------
215
package() {
216
local bindir="${srcdir}/${_srcname}/sw/nic/build/${CARCH}/sim/bin"
217
218
install -Dm755 "${bindir}/gpuagent" "${pkgdir}/usr/bin/gpuagent"
219
install -Dm755 "${srcdir}/gpuctl" "${pkgdir}/usr/bin/gpuctl"
220
221
# Remove embedded build-time rpath; strip spurious libresolv from gpuctl
222
patchelf --remove-rpath "${pkgdir}/usr/bin/gpuagent" 2>/dev/null || true
223
patchelf --remove-needed libresolv.so.2 "${pkgdir}/usr/bin/gpuctl" 2>/dev/null || true
224
225
# systemd service unit
226
install -Dm644 "${srcdir}/gpuagent.service" \
227
"${pkgdir}/usr/lib/systemd/system/gpuagent.service"
228
229
# Default environment config (backed up on upgrade)
230
install -Dm644 "${srcdir}/gpuagent.conf" \
231
"${pkgdir}/etc/gpuagent/gpuagent.conf"
232
233
install -Dm644 "${srcdir}/${_srcname}/LICENSE" \
234
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
235
}
236
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |