◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

rocm-gpu-agent

maintainer SteamedFish · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package builds from a legitimate upstream source (ROCm/gpu-agent) and uses Go vendoring for offline builds; the flagged 'external install' via `go install` in prepare() is for a build tool (protoc-gen-gogofast) required to generate code, not a runtime dependency, and poses no supply-chain risk as it is used in a controlled, reproducible build context.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate upstream source (ROCm/gpu-agent) and uses Go vendoring for offline builds; the flagged 'external install' via `go install` in prepare() is for a build tool (protoc-gen-gogofast) required to generate code, not a runtime dependency, and poses no supply-chain risk as it is used in a controlled, reproducible build context.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:173 go install github.com/gogo/protobuf/protoc-gen-gogofast@v1.3.2

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: SteamedFish <steamedfish@hotmail.com>
2# Standalone package built from https://github.com/ROCm/gpu-agent
3#
4# Provides the gpuagent C++ gRPC daemon and gpuctl Go CLI used by amdgpu-exporter.
5# The upstream Makefile is patched to use system libraries instead of the
6# submodule-built C++ dependencies that the upstream tree normally drives.
7
8pkgname=rocm-gpu-agent
9pkgver=1.5.1
10pkgrel=1
11pkgdesc="AMD ROCm GPU Agent: metrics daemon (gpuagent) and control CLI (gpuctl) for AMD Instinct GPUs"
12arch=('x86_64')
13url="https://github.com/ROCm/gpu-agent"
14license=('Apache-2.0')
15depends=(
16 'amdsmi'
17 'abseil-cpp'
18 'grpc'
19 'zeromq'
20
21 'protobuf'
22 'libev'
23)
24makedepends=(
25 'go'
26 'python'
27 'patchelf'
28 'boost'
29)
30
31_srcname="gpu-agent-${pkgver}"
32
33source=(
34 "${_srcname}.tar.gz::https://github.com/ROCm/gpu-agent/archive/refs/tags/v${pkgver}.tar.gz"
35 'gpuagent.service'
36 'gpuagent.conf'
37 'fix-base-snprintf-sizeof-pointer.patch'
38 'fix-gpu-watch-stack-overflow.patch'
39 'fix-boost-lockfree-queue-capacity.patch'
40)
41sha256sums=('011f44387aad24942b63b346f360453ba4abfb6790d493dd34401b768cc94cc6'
42 '8d35441bdbae38652e52fcfe22c7b677fdcad9a184ffe333e77507afc9d5d27e'
43 'b266380dbe91bc69ffc94ea9a9b7412f4699eda7faf22a617769faeab19ba0bb'
44 '70291528d5b84a29516cc7aa907aa5c4c6251b7b0bd6b01f6fc6fd37ee897018'
45 '1a331e00133c6ff3306d314d9084201b3ddaaa62f9b0cdc54b3f7f94a4decd32'
46 '5e31b7a994d359221553beb3561ef844f954cab8613364c98e017e8104e7be52')
47backup=('etc/gpuagent/gpuagent.conf')
48
49# ---------------------------------------------------------------------------
50# prepare(): patch the upstream Makefile to use system libraries
51# ---------------------------------------------------------------------------
52prepare() {
53 local agentdir="${srcdir}/${_srcname}/sw/nic/gpuagent"
54
55 # Use GOPROXY mirror for all go commands: this host's IPv6 route to
56 # proxy.golang.org times out (dial tcp [2607:...]:443: i/o timeout).
57 export GOPROXY="https://mirrors.aliyun.com/goproxy,direct"
58
59 # ---- 0. Fix upstream bug: sizeof(pointer) used instead of buffer size in snprintf ----
60 patch -p1 -d "${srcdir}/${_srcname}" < "${srcdir}/fix-base-snprintf-sizeof-pointer.patch"
61
62 # ---- 0b. Fix GPUWatchGet stack overflow: ~2.3 MB stack var -> heap allocation ----
63 patch -p1 -d "${srcdir}/${_srcname}" < "${srcdir}/fix-gpu-watch-stack-overflow.patch"
64
65 # ---- 0c. Fix boost >= 1.91: lockfree::queue default ctor requires static capacity ----
66 patch -p1 -d "${srcdir}/${_srcname}" < "${srcdir}/fix-boost-lockfree-queue-capacity.patch"
67
68 # ---- 1. Fix hardcoded ABS_DIR (absolute build-root path) ----
69 sed -i "s|ABS_DIR\s*:=\s*/usr/src/github.com/ROCm/gpu-agent/sw|ABS_DIR := ${srcdir}/${_srcname}/sw|g" \
70 "${agentdir}/Makefile"
71
72 # ---- 2. Use system protoc / grpc_cpp_plugin ----
73 sed -i \
74 -e 's|PROTOC\s*:=\s*${BLD_DIR}/bin/protoc|PROTOC := /usr/bin/protoc|g' \
75 -e 's|GRPC_CPP_PLUGIN\s*:=\s*${BLD_BIN_DIR}/grpc_cpp_plugin|GRPC_CPP_PLUGIN := /usr/bin/grpc_cpp_plugin|g' \
76 "${agentdir}/Makefile"
77
78 # ---- 3. Replace static lib flags with dynamic equivalents ----
79 sed -i \
80 -e 's|-l:libprotobuf\.a|-lprotobuf|g' \
81 -e 's|-l:libgrpc\.a|-lgrpc|g' \
82 -e 's|-l:libgrpc++\.a|-lgrpc++|g' \
83 -e 's|-l:libgpr\.a|-lgpr|g' \
84 -e 's|-l:libre2\.a|-lre2|g' \
85 -e 's|-l:libev\.a|-lev|g' \
86 -e 's|-l:libzmq\.a|-lzmq|g' \
87 -e 's|-l:libssl\.a|-lssl|g' \
88 -e 's|-l:libcrypto\.a|-lcrypto|g' \
89 "${agentdir}/Makefile"
90
91 # ---- 4. Remove BLD_LIB_DIR -L and -rpath flags ----
92 sed -i \
93 -e 's|-L$(BLD_LIB_DIR)||g' \
94 -e 's|-L${BLD_DIR}/lib64||g' \
95 -e 's|-L${BLD_DIR}/lib||g' \
96 -e 's|-Wl,-rpath,$(BLD_LIB_DIR)||g' \
97 -e 's|-Wl,-rpath-link,$(BLD_LIB_DIR)||g' \
98 "${agentdir}/Makefile"
99
100 # ---- 5. Redirect AMD SMI headers and libs to ROCm system paths ----
101 sed -i \
102 -e 's|INC_AMD_SMI\s*:=.*|INC_AMD_SMI := /opt/rocm/include|g' \
103 -e 's|-L${TOPDIR}/nic/third-party/rocm/amd_smi_lib/${CARCH}/lib/|-L/opt/rocm/lib|g' \
104 "${agentdir}/Makefile"
105
106 # ---- 6. Touch the build-libs stamp to skip submodule C++ dep builds ----
107 local stamp_dir="${srcdir}/${_srcname}/sw/nic/build/${CARCH}/sim/out"
108 mkdir -p "${stamp_dir}"
109 touch "${stamp_dir}/.build_libs_done"
110
111 # ---- 6b. Fix protobuf v4 API: always_print_primitive_fields was renamed ----
112 sed -i 's/always_print_primitive_fields/always_print_fields_with_no_presence/g' \
113 "${agentdir}/svc/trace.cc"
114
115 # ---- 6c. Fix abseil component lib names for abseil-cpp >= 20230802 ----
116 # absl_bad_optional_access, absl_bad_any_cast_impl, absl_bad_variant_access
117 # were merged into absl_throw_delegate; absl_low_level_hash merged into absl_hash;
118 # absl_leak_check_disable removed; absl_random_internal_pool_urbg renamed to
119 # absl_random_internal_entropy_pool; absl_flags split into sub-libs (already linked).
120 sed -i \
121 -e 's/ -labsl_bad_optional_access//g' \
122 -e 's/ -labsl_bad_any_cast_impl//g' \
123 -e 's/ -labsl_bad_variant_access//g' \
124 -e 's/ -labsl_low_level_hash//g' \
125 -e 's/ -labsl_leak_check_disable//g' \
126 -e 's/-labsl_random_internal_pool_urbg/-labsl_random_internal_entropy_pool/g' \
127 -e 's/ -labsl_flags / /g' \
128 "${agentdir}/Makefile"
129
130 # ---- 6e. Replace LDFLAGS_COMMON using pkg-config (deduplicated, --as-needed) ----
131 python3 - "${agentdir}/Makefile" <<'PYEOF'
132import sys, subprocess, re
133makefile = sys.argv[1]
134libs_raw = subprocess.check_output(
135 ['pkg-config', '--libs', 'protobuf', 'grpc++', 'grpc'],
136 text=True).split()
137seen = set()
138libs_deduped = []
139for tok in libs_raw:
140 if tok in ('-lutf8_range',): # transitively satisfied, causes namcap unused-lib warning
141 continue
142 if tok not in seen:
143 seen.add(tok)
144 libs_deduped.append(tok)
145ldflags_new = (
146 'LDFLAGS_COMMON := -Wl,--as-needed -pthread -rdynamic -no-canonical-prefixes'
147 ' -Wl,--gc-sections -Wl,-z,relro,-z,now -Wl,--build-id=md5 -Wl,--hash-style=gnu'
148 ' -lgrpc++_reflection'
149 ' -lupb_textformat_lib -lupb_json_lib -lupb_reflection_lib -lupb_wire_lib'
150 ' -lupb_message_lib -lupb_mini_descriptor_lib -lupb_mini_table_lib'
151 ' -lupb_hash_lib -lupb_mem_lib -lupb_base_lib -lupb_lex_lib'
152 ' -lcares -laddress_sorting -lev -lzmq'
153 ' ' + ' '.join(libs_deduped) +
154 ' -lutf8_validity -lrt -lm -lz\n'
155)
156with open(makefile) as f:
157 text = f.read()
158# Replace the whole multiline LDFLAGS_COMMON block
159text = re.sub(
160 r'LDFLAGS_COMMON\s*:=[^\\\n]*(?:\\\n[^\\\n]*)*(?:\n[ \t]+[^\n]*)?',
161 ldflags_new,
162 text, count=1)
163with open(makefile, 'w') as f:
164 f.write(text)
165PYEOF
166
167
168 # ---- 7. Generate protobuf Go stubs required by the CLI ----
169 # gen/go/ does not exist in the tarball; must be generated before vendoring.
170 local _gotools="${srcdir}/gotools"
171 local topdir="${srcdir}/${_srcname}/sw"
172 GOPATH="${_gotools}" GOFLAGS="-mod=mod" \
173 go install github.com/gogo/protobuf/protoc-gen-gogofast@v1.3.2
174 PATH="${_gotools}/bin:${PATH}" \
175 make -C "${agentdir}" TOPDIR="${topdir}" gen-protos
176
177 # ---- 8. Vendor Go dependencies for offline build ----
178 if [[ ! -d "${agentdir}/vendor" ]]; then
179 cd "${agentdir}"
180 go mod vendor
181 fi
182}
183
184# ---------------------------------------------------------------------------
185# build(): compile gpuagent and gpuctl
186# ---------------------------------------------------------------------------
187build() {
188 local agentdir="${srcdir}/${_srcname}/sw/nic/gpuagent"
189 local topdir="${srcdir}/${_srcname}/sw"
190 # protoc-gen-gogofast (built during prepare) must be in PATH for gen-protos
191 export GOPATH="${srcdir}/gotools"
192 export PATH="${GOPATH}/bin:${PATH}"
193 # Ensure the build-libs stamp exists (prepare() may have been skipped via -ef)
194 local stamp_dir="${srcdir}/${_srcname}/sw/nic/build/${CARCH}/sim/out"
195 mkdir -p "${stamp_dir}"
196 touch "${stamp_dir}/.build_libs_done"
197 # gpuagent C++ daemon via patched Makefile
198 make -C "${agentdir}" TOPDIR="${topdir}" gpuagent
199
200 # gpuctl pure-Go CLI (GOPROXY mirror avoids IPv6 timeout; vendored anyway)
201 export GOPROXY="https://mirrors.aliyun.com/goproxy,direct"
202 cd "${agentdir}"
203 CGO_ENABLED=1 go build \
204 -trimpath \
205 -buildmode=pie \
206 -ldflags="-s -w -linkmode=external -extldflags='-Wl,--as-needed,-z,relro,-z,now'" \
207 -mod=vendor \
208 -o "${srcdir}/gpuctl" \
209 ./cli
210}
211
212# ---------------------------------------------------------------------------
213# package(): install gpuagent + gpuctl
214# ---------------------------------------------------------------------------
215package() {
216 local bindir="${srcdir}/${_srcname}/sw/nic/build/${CARCH}/sim/bin"
217
218 install -Dm755 "${bindir}/gpuagent" "${pkgdir}/usr/bin/gpuagent"
219 install -Dm755 "${srcdir}/gpuctl" "${pkgdir}/usr/bin/gpuctl"
220
221 # Remove embedded build-time rpath; strip spurious libresolv from gpuctl
222 patchelf --remove-rpath "${pkgdir}/usr/bin/gpuagent" 2>/dev/null || true
223 patchelf --remove-needed libresolv.so.2 "${pkgdir}/usr/bin/gpuctl" 2>/dev/null || true
224
225 # systemd service unit
226 install -Dm644 "${srcdir}/gpuagent.service" \
227 "${pkgdir}/usr/lib/systemd/system/gpuagent.service"
228
229 # Default environment config (backed up on upgrade)
230 install -Dm644 "${srcdir}/gpuagent.conf" \
231 "${pkgdir}/etc/gpuagent/gpuagent.conf"
232
233 install -Dm644 "${srcdir}/${_srcname}/LICENSE" \
234 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
235}
236

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -6,8 +6,8 @@
# submodule-built C++ dependencies that the upstream tree normally drives.
pkgname=rocm-gpu-agent
-pkgver=1.4.2
-pkgrel=2
+pkgver=1.5.1
+pkgrel=1
pkgdesc="AMD ROCm GPU Agent: metrics daemon (gpuagent) and control CLI (gpuctl) for AMD Instinct GPUs"
arch=('x86_64')
url="https://github.com/ROCm/gpu-agent"
@@ -36,12 +36,14 @@
'gpuagent.conf'
'fix-base-snprintf-sizeof-pointer.patch'
'fix-gpu-watch-stack-overflow.patch'
-)
-sha256sums=('f540f6ca1221f675357f96fa561d78bf6e46345cab75401d51caf5e729fe571c'
+ 'fix-boost-lockfree-queue-capacity.patch'
+)
+sha256sums=('011f44387aad24942b63b346f360453ba4abfb6790d493dd34401b768cc94cc6'
'8d35441bdbae38652e52fcfe22c7b677fdcad9a184ffe333e77507afc9d5d27e'
'b266380dbe91bc69ffc94ea9a9b7412f4699eda7faf22a617769faeab19ba0bb'
'70291528d5b84a29516cc7aa907aa5c4c6251b7b0bd6b01f6fc6fd37ee897018'
- '1a331e00133c6ff3306d314d9084201b3ddaaa62f9b0cdc54b3f7f94a4decd32')
+ '1a331e00133c6ff3306d314d9084201b3ddaaa62f9b0cdc54b3f7f94a4decd32'
+ '5e31b7a994d359221553beb3561ef844f954cab8613364c98e017e8104e7be52')
backup=('etc/gpuagent/gpuagent.conf')
# ---------------------------------------------------------------------------
@@ -50,11 +52,18 @@
prepare() {
local agentdir="${srcdir}/${_srcname}/sw/nic/gpuagent"
+ # Use GOPROXY mirror for all go commands: this host's IPv6 route to
+ # proxy.golang.org times out (dial tcp [2607:...]:443: i/o timeout).
+ export GOPROXY="https://mirrors.aliyun.com/goproxy,direct"
+
# ---- 0. Fix upstream bug: sizeof(pointer) used instead of buffer size in snprintf ----
patch -p1 -d "${srcdir}/${_srcname}" < "${srcdir}/fix-base-snprintf-sizeof-pointer.patch"
# ---- 0b. Fix GPUWatchGet stack overflow: ~2.3 MB stack var -> heap allocation ----
patch -p1 -d "${srcdir}/${_srcname}" < "${srcdir}/fix-gpu-watch-stack-overflow.patch"
+
+ # ---- 0c. Fix boost >= 1.91: lockfree::queue default ctor requires static capacity ----
+ patch -p1 -d "${srcdir}/${_srcname}" < "${srcdir}/fix-boost-lockfree-queue-capacity.patch"
# ---- 1. Fix hardcoded ABS_DIR (absolute build-root path) ----
sed -i "s|ABS_DIR\s*:=\s*/usr/src/github.com/ROCm/gpu-agent/sw|ABS_DIR := ${srcdir}/${_srcname}/sw|g" \
@@ -188,7 +197,8 @@
# gpuagent C++ daemon via patched Makefile
make -C "${agentdir}" TOPDIR="${topdir}" gpuagent
- # gpuctl pure-Go CLI
+ # gpuctl pure-Go CLI (GOPROXY mirror avoids IPv6 timeout; vendored anyway)
+ export GOPROXY="https://mirrors.aliyun.com/goproxy,direct"
cd "${agentdir}"
CGO_ENABLED=1 go build \
-trimpath \

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 01:13:52 MEDIUM 1
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion