tvm

maintainer Smoolak · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install occurs in a local venv during prepare() to install build dependencies from PyPI, which is standard practice; the package builds from official Apache TVM source via git, and no untrusted remote code execution or data exfiltration is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install occurs in a local venv during prepare() to install build dependencies from PyPI, which is standard practice; the package builds from official Apache TVM source via git, and no untrusted remote code execution or data exfiltration is present.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:123 pip install setuptools numpy decorator attrs\

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  <edgar [ no ] openmail [d] cc>
    
      2_base=tvm
    
      3# pkgname="${_base}"-git
    
      4pkgname="${_base}"
    
      5pkgver=0.15.dev0.57.g108377452e
    
      6pkgrel=1
    
      7# epoch=
    
      8pkgdesc="Apache TVM, a deep learning compiler that enables access to high-performance machine learning anywhere for everyone"
    
      9arch=('x86_64')
    
      10url="https://tvm.apache.org/"
    
      11license=('Apache 2.0')
    
      12groups=()
    
      13depends=(
    
      14  # OpenCL (opencl-driver)
    
      15  "ocl-icd"
    
      16  "openmp"
    
      17  "llvm>=4.0"
    
      18  "mesa"
    
      19  "blas-openblas"
    
      20  "openmp"
    
      21  # https://tvm.apache.org/docs/install/from_source.html,
    
      22  "python-numpy"
    
      23  "python-decorator"
    
      24  "python-attrs"
    
      25  # https://github.com/apache/tvm/issues/8577
    
      26  "python38"
    
      27  # ${_base}/python/gen_requirements.py
    
      28  "python-cloudpickle"
    
      29  "python-scipy"
    
      30  "python-psutil"
    
      31  "python-tornado"
    
      32  # Submodules
    
      33  "opencl-headers"
    
      34  # Submodules in AUR
    
      35  "cnpy" # cnpy-git
    
      36  "libbacktrace" # libbacktrace-git
    
      37)
    
      38makedepends=("gcc" "cmake>=3.18" "python-pip")
    
      39checkdepends=("gtest")
    
      40optdepends=(
    
      41  # See also "${_base}"/python/gen_requirements.py
    
      42  "python-typing_extensions: for tvmc (TVM command line driver)"
    
      43  "python-tornado: for RPC Tracker, auto-tuning module"
    
      44  "python-cloudpickle: auto-tuning module"
    
      45  "python-psutil: auto-tuning module"
    
      46  "xgboost>=1.1.0: auto-tuning module"
    
      47)
    
      48# provides=()
    
      49conflicts=(tvm-git)
    
      50# replaces=()
    
      51# backup=()
    
      52options=(!staticlibs)
    
      53install=tvm.install
    
      54# changelog=
    
      55
    
      56source=("git+https://github.com/apache/tvm"
    
      57        # Submodules not in AUR
    
      58        "git+https://github.com/NVIDIA/cutlass.git"
    
      59        "git+https://github.com/dmlc/dlpack.git"
    
      60        "git+https://github.com/dmlc/dmlc-core.git"
    
      61        "git+https://github.com/agauniyal/rang.git"
    
      62        "vta-hw::git+https://github.com/apache/tvm-vta.git"
    
      63        "enable_features.diff")
    
      64sha512sums=('SKIP'
    
      65            'SKIP'
    
      66            'SKIP'
    
      67            'SKIP'
    
      68            'SKIP'
    
      69            'SKIP'
    
      70            "ec62e2a15ca5d47f1bc804d12902d21d5f228e73cb458f6c4e5f9e9ce5118c117b8274814e36fde94a1efa0b25b8dc7d59ad79556e34484a1e8fb5d7926c1729"
    
      71            "7499c01fce2facb76ebeb43799435f13b178dd0b2cf29ff0e09dd880ba2951a2e52a487a1fbb8dd392e6d3e8c5d0ac9a8d511034b176ebe395106ca0c4f3682a")
    
      72
    
      73# # For tar-ball
    
      74# source=("https://dlcdn.apache.org/tvm/tvm-v${pkgver}/apache-tvm-src-v${pkgver}.tar.gz"
    
      75#        "enable_features.diff")
    
      76# sha512sums=("328b3d5d851ac82f12a0d1402094e608dbfa5a4f6fb8d942a95b41695dc069f1cfcbe915294b3ae71bf2433e792d9e00809c63392d12d20d2f8c27476375d1dc"
    
      77#             "8750d292086f030a1e70f201b86538a7e92444b238573c01424d9f933deb5032c1b82f4b74e45289b87b64eb4267765b162eeadd69732eebea659e856f1e247c")
    
      78# noextract=()
    
      79
    
      80pkgver() {
    
      81  cd "${srcdir}"/"${_base}"
    
      82  git describe --tags --match '*.*' | tr '-' '.' | sed 's-^v--'
    
      83}
    
      84
    
      85prepare() {
    
      86  # # for tar-ball
    
      87  # rm "${srcdir}"/apache-"${_base}"-src-v"${pkgver}"*.tar.gz
    
      88  # mv "${srcdir}"/apache-"${_base}"-src-v"${pkgver}"* "${srcdir}/${_base}"
    
      89
    
      90  cd "${srcdir}/${_base}"
    
      91
    
      92  # * Update submodules
    
      93  # git submodule update --init --recursive
    
      94
    
      95  # ** Remove submodules for which there are packages
    
      96  #    (names from .gitmodules)
    
      97  for submod in cnpy OpenCL-Headers libbacktrace; do
    
      98    # https://stackoverflow.com/a/1260982
    
      99    git rm 3rdparty/"$submod"
    
      100  done
    
      101  git commit -m "Removed submodules"
    
      102
    
      103  # ** Update submodules
    
      104  #    (from AUR VCS guidelines)
    
      105  git submodule init
    
      106  for submod in cutlass dlpack dmlc-core rang vta-hw; do
    
      107    git config \
    
      108        submodule.3rdparty/"$submod".url "${srcdir}/$submod"
    
      109  done
    
      110  git -c protocol.file.allow=always submodule update
    
      111
    
      112  # https://tvm.apache.org/docs/install/from_source.html
    
      113  _build="${srcdir}"/build
    
      114  [ ! -d "${_build}" ] && mkdir "${_build}"
    
      115  patch --forward -i "${srcdir}/enable_features.diff" \
    
      116        -o "${_build}"/config.cmake \
    
      117        -d "${srcdir}/${_base}/cmake"
    
      118
    
      119  cd "${_build}"
    
      120  python3.8 -m venv env
    
      121  source env/bin/activate
    
      122  # From gen_requirements.py
    
      123  pip install setuptools numpy decorator attrs\
    
      124      cloudpickle psutil tornado scipy synr
    
      125  deactivate
    
      126}
    
      127
    
      128build() {
    
      129  _build="${srcdir}"/build
    
      130
    
      131  CONFOPTS=( -DCMAKE_INSTALL_PREFIX=/usr )
    
      132
    
      133  cd "${_build}"
    
      134  source env/bin/activate
    
      135  export TVM_LOG_DEBUG="ir/transform.cc=1,relay/ir/transform.cc=1"
    
      136  export TVM_BUILD_PATH="${_build}"
    
      137  cmake -B "${_build}" -S "${srcdir}/${_base}" ${CONFOPTS[@]}
    
      138  cmake --build "${_build}"
    
      139  deactivate
    
      140}
    
      141
    
      142check() {
    
      143  # cd "${srcdir}/${_base}"
    
      144  # _build="${srcdir}"/build
    
      145  # cd tests/scripts
    
      146  # ./task_cpp_unittest.sh "${_build}"
    
      147
    
      148  # This fails
    
      149  _build="${srcdir}"/build
    
      150  cd "${_build}"
    
      151  source env/bin/activate
    
      152  TVM_BUILD_PATH="${_build}" make -C "${_build}" cpptest
    
      153  deactivate
    
      154}
    
      155
    
      156package() {
    
      157  # cd "$srcdir/${_base}"
    
      158
    
      159  _build="${srcdir}"/build
    
      160  cd ${_build}
    
      161  source "${_build}"/env/bin/activate
    
      162  export TVM_BUILD_PATH="${_build}"
    
      163  # DESTDIR="${pkgdir}" ninja -C "${_build}" install
    
      164  # make -C "${_build}" DESTDIR="${pkgdir}" install
    
      165  DESTDIR="${pkgdir}" cmake --install "${_build}"
    
      166
    
      167  cd "${srcdir}/${_base}"/python
    
      168  # python "$srcdir/${_base}"/python/setup.py build -g --dry-run
    
      169  export TVM_LIBRARY_PATH="${pkgdir}/usr/lib"
    
      170  python setup.py install -O1 --prefix=/usr --root="${pkgdir}"
    
      171  deactivate
    
      172}
    
      173

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 01:22:21	MEDIUM	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2