xrt-xocl-dkms-git
maintainer leuko
· 0 votes
· base
xrt-git
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The .deb from packages.xilinx.com is Xilinx's own official Artifactory/package repository — this is the canonical vendor distribution channel for XRT, not a personal or unofficial host. The package extracts only the firmware blob (data.tar.gz -> lib/firmware/xilinx) from it, not executing any scripts or binaries from the .deb directly. The SKIP checksums are sloppy and mean there's no integrity pinning, but this applies equally to the git sources (which are also SKIP'd). The main source is built from the official Xilinx/XRT GitHub repo. The firmware extracted from the .deb is data (microblaze firmware blobs), not executed host code. The overall pattern is a legitimate but messy packaging of a vendor FPGA runtime with firmware extracted from the vendor's own package repository. The lack of checksums is a quality/reproducibility concern but not a supply-chain attack vector beyond what any git-based AUR package already accepts.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The .deb from packages.xilinx.com is Xilinx's own official Artifactory/package repository — this is the canonical vendor distribution channel for XRT, not a personal or unofficial host. The package extracts only the firmware blob (data.tar.gz -> lib/firmware/xilinx) from it, not executing any scripts or binaries from the .deb directly. The SKIP checksums are sloppy and mean there's no integrity pinning, but this applies equally to the git sources (which are also SKIP'd). The main source is built from the official Xilinx/XRT GitHub repo. The firmware extracted from the .deb is data (microblaze firmware blobs), not executed host code. The overall pattern is a legitimate but messy packaging of a vendor FPGA runtime with firmware extracted from the vendor's own package repository. The lack of checksums is a quality/reproducibility concern but not a supply-chain attack vector beyond what any git-based AUR package already accepts.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:70
xrt-precompiled::https://packages.xilinx.com/artifactory/debian-packages-cache/pool/xrt_202320.2.16.204_22.04-amd64-xrt.deb
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Gökçe Aydos <aur2024@aydos.de>
2
_name=xrt
3
pkgbase=$_name-git
4
pkgver=r7478.39bc63b935
5
pkgrel=1
6
pkgdesc="Xilinx runtime for Ultrascale, Versal and MPSoC-based FPGAs"
7
arch=(x86_64)
8
url='https://xilinx.github.io/XRT/master/html'
9
license=(Apache)
10
depends=(
11
# Based on src/runtime_src/tools/scripts/xrtdeps.sh
12
lsb-release # Used in tests
13
boost
14
libtiff
15
#cppcheck #TODO report upstream: not-needed since https://github.com/Xilinx/XRT/commit/0bd3e8c83840f341f028588a26cb9151fdd04542
16
#curl #TODO report upstream: not required
17
18
dkms
19
# `dkms` optdepends on all `linux-*headers`.
20
# According to https://wiki.archlinux.org/title/DKMS_package_guidelines#Dependencies
21
# `linux-*headers` should not be listed as a dependency.
22
23
elfutils
24
gcc
25
gdb
26
gnuplot
27
gnutls
28
gtest
29
json-glib
30
libdrm
31
libjpeg-turbo
32
util-linux-libs # for libuuid
33
libyaml
34
lm_sensors
35
ncurses
36
ocl-icd
37
opencl-clhpp
38
openssl
39
pciutils
40
perl
41
protobuf # includes protobuf-compiler
42
python
43
python-pip
44
rapidjson
45
strace
46
unzip
47
zlib
48
pybind11
49
50
xilinx-u280-gen3x16-xdma-base
51
# for `create_xsabin.sh` in post_install, otherwise platform file empty.
52
# Actually an optdepends, because XRT supports also other cards.
53
)
54
makedepends=(
55
cmake
56
git
57
)
58
provides=($_name)
59
conflicts=($_name)
60
options=(!debug)
61
62
# For U280 support use:
63
#$_name::git+https://github.com/xilinx/XRT#commit=39bc63b
64
#xocl-driver-fixes-for-current-kernels.patch::https://github.com/Xilinx/XRT/pull/8005.patch
65
source=(
66
$_name::git+https://github.com/xilinx/XRT
67
#xocl-driver-fixes-for-current-kernels.patch::https://github.com/Xilinx/XRT/pull/8005.patch
68
git+https://github.com/Xilinx/dma_ip_drivers
69
git+https://github.com/serge1/ELFIO
70
xrt-precompiled::https://packages.xilinx.com/artifactory/debian-packages-cache/pool/xrt_202320.2.16.204_22.04-amd64-xrt.deb
71
xsabin.install
72
)
73
sha256sums=(
74
SKIP
75
#SKIP
76
SKIP
77
SKIP
78
SKIP
79
SKIP
80
)
81
pkgver() {
82
cd $_name
83
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
84
}
85
prepare() {
86
# For U280 support uncomment:
87
#echo Patch xocl
88
#git -C xrt \
89
# apply $srcdir/xocl-driver-fixes-for-current-kernels.patch
90
91
# Submodule integration based on
92
# https://wiki.archlinux.org/title/VCS_package_guidelines#Git_submodules
93
git -C $_name config \
94
submodule.src/runtime_src/core/pcie/driver/linux/xocl/lib/libqdma.url \
95
../dma_ip_drivers
96
git -C $_name config \
97
submodule.src/runtime_src/core/common/elf.url \
98
../ELFIO
99
git -C $_name \
100
-c protocol.file.allow=always \
101
submodule update
102
mkdir microblaze-fw
103
tar xf data.tar.gz -C microblaze-fw ./lib/firmware/xilinx
104
}
105
build() {
106
cd $_name
107
mkdir -p clean-build && cd clean-build
108
local cmake_flags+=" -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/opt/xilinx -DXRT_INSTALL_PREFIX=/opt/xilinx -DXRT_DKMS_ALVEO=ON"
109
XRT_FIRMWARE_DIR="$srcdir"/microblaze-fw/lib/firmware/xilinx cmake $cmake_flags ../src
110
make
111
}
112
113
#TODO
114
# somehow test 8 fails, even it does not seem like a fail.
115
#check() {
116
# # Tests require the package to be installed in the build directory.
117
# DESTDIR=$srcdir/$_name/clean-build \
118
# make -C $_name/clean-build install
119
#
120
# cd $srcdir/$_name/clean-build
121
# ctest --output-on-failure
122
#}
123
124
pkgname=($pkgbase xrt-xocl-dkms-git)
125
package_xrt-git() {
126
depends+=(xrt-xocl-dkms-git)
127
install=xsabin.install
128
DESTDIR=$pkgdir make -C $_name/clean-build install
129
# Move /lib to /usr/lib, otherwise: `failed to commit transaction (conflicting files)`
130
mv "$pkgdir"/lib "$pkgdir"/usr
131
132
# Drivers belong to the DKMS package, move them to a temporary dir.
133
mv $pkgdir/usr/src $pkgdir/..
134
135
# Moving systemd services
136
#local dest=$pkgdir/usr/lib/systemd/system
137
#mkdir -p $dest
138
#mv $pkgdir/opt/xilinx/xrt/etc/*service $dest
139
140
# Moving binaries
141
#local dest=$pkgdir/usr/bin
142
#mkdir -p $dest
143
#mv $pkgdir/usr/local/bin/* $dest
144
#rm -r $pkgdir/usr/local/bin
145
146
# Moving appdebug
147
#mv $pkgdir/opt/xilinx/xrt/share/appdebug $pkgdir/usr/local/xrt/python
148
#rmdir $pkgdir/opt/xilinx{/xrt/share,/xrt,}
149
150
# The following lines are adapted from postinst of control.tar.gz of the debian package
151
ln -s 283bab8f654d8674968f4da57f7fa5d7 "$pkgdir"/usr/lib/firmware/xilinx/fb2b2c5a19ed63593fea95f51fbc8eb9
152
mkdir -p "$pkgdir"/opt/xilinx/firmware/u280/gen3x16-xdma/base/firmware
153
ln -s /lib/firmware/xilinx/283bab8f654d8674968f4da57f7fa5d7/partition_metadata.json "$pkgdir"/opt/xilinx/firmware/u280/gen3x16-xdma/base/partition_metadata.json
154
ln -s /lib/firmware/xilinx/283bab8f654d8674968f4da57f7fa5d7/partition.xsabin "$pkgdir"/opt/xilinx/firmware/u280/gen3x16-xdma/base/partition.xsabin
155
## I changed /opt/xilinx/xrt/share/fw to /lib/firmware/xilinx/ because XRTFW_FILES is somehow not defined in:
156
# https://github.com/Xilinx/XRT/blob/50f17b1d5a29b7af9a9abbc88815883958efdb35/src/runtime_src/ert/CMakeLists.txt#L29
157
ln -s /lib/firmware/xilinx "$pkgdir"/opt/xilinx/firmware/u280/gen3x16-xdma/base/firmware/ert-v30
158
ln -s /opt/xilinx/firmware/cmc/u280 "$pkgdir"/opt/xilinx/firmware/u280/gen3x16-xdma/base/firmware/cmc-u280
159
ln -s /opt/xilinx/firmware/sc-fw/u280 "$pkgdir"/opt/xilinx/firmware/u280/gen3x16-xdma/base/firmware/sc-fw-u280
160
}
161
package_xrt-xocl-dkms-git() {
162
pkgdesc="Drivers for Xilinx runtime (XRT)"
163
provides=(xrt-xocl-dkms)
164
conflicts=(xrt-xocl-dkms)
165
166
# Collect drivers
167
local dest=$pkgdir/usr
168
mkdir $dest
169
cp -r $pkgdir/../src $dest
170
171
cd $pkgdir
172
# AWS drivers not required
173
rm -r usr/src/xrt-aws*
174
175
# Set version
176
mv usr/src/{xrt-*,xrt-xocl-$pkgver}
177
}
178
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |