已合并
chore: update amct graph package url #305
fujun19创建于 5 天前
chore: update amct graph package url #305
已合并
共 3 个文件变更+5-3
| @@ -29,6 +29,7 @@ | |||
| 29 | | 依赖 | 不涉及 | cmake/third_party/protobuf.cmake | https://gitcode.com/cann-src-third-party/protobuf/releases/download/v3.13.0/protobuf-3.13.0.tar.gz | 从gitcode下载protobuf源码，作用编译依赖 | | 29 | | 依赖 | 不涉及 | cmake/third_party/protobuf.cmake | https://gitcode.com/cann-src-third-party/protobuf/releases/download/v3.13.0/protobuf-3.13.0.tar.gz | 从gitcode下载protobuf源码，作用编译依赖 | |
| 30 | | 依赖 | 不涉及 | cmake/third_party/protobuf.cmake | https://gitcode.com/cann-src-third-party/abseil-cpp/releases/download/20230802.1/abseil-cpp-20230802.1.tar.gz | 从gitcode下载abseil源码，作用编译依赖 | | 30 | | 依赖 | 不涉及 | cmake/third_party/protobuf.cmake | https://gitcode.com/cann-src-third-party/abseil-cpp/releases/download/20230802.1/abseil-cpp-20230802.1.tar.gz | 从gitcode下载abseil源码，作用编译依赖 | |
| 31 | | 依赖 | 不涉及 | cmake/fetch_cann_cmake.cmake | https://cann-3rd.obs.cn-north-4.myhuaweicloud.com/cmake/cmake-master-049.tar.gz | 从gitcode下载cann cmake源码，作用编译依赖 | | 31 | | 依赖 | 不涉及 | cmake/fetch_cann_cmake.cmake | https://cann-3rd.obs.cn-north-4.myhuaweicloud.com/cmake/cmake-master-049.tar.gz | 从gitcode下载cann cmake源码，作用编译依赖 | |
| 32 | +| 依赖 | 不涉及 | install_graph.sh | https://ascend-cann.obs.cn-north-4.myhuaweicloud.com/CANN/20260902_newest/cann-amct-graph_9.2.0_linux-${ARCH}.tar.gz | 从OBS下载amct-graph包，作用构建依赖 | | ||
| 32 | --- | 33 | --- |
| 33 | 34 | ||
| 34 | ## 漏洞机制说明 | 35 | ## 漏洞机制说明 |
| @@ -29,6 +29,7 @@ The public network addresses contained in this project code are declared as foll | |||
| 29 | | Dependency | Not involved | cmake/third_party/protobuf.cmake | https://gitcode.com/cann-src-third-party/protobuf/releases/download/v3.13.0/protobuf-3.13.0.tar.gz | Download protobuf source code from gitcode, serves as compilation dependency | | 29 | | Dependency | Not involved | cmake/third_party/protobuf.cmake | https://gitcode.com/cann-src-third-party/protobuf/releases/download/v3.13.0/protobuf-3.13.0.tar.gz | Download protobuf source code from gitcode, serves as compilation dependency | |
| 30 | | Dependency | Not involved | cmake/third_party/protobuf.cmake | https://gitcode.com/cann-src-third-party/abseil-cpp/releases/download/20230802.1/abseil-cpp-20230802.1.tar.gz | Download abseil source code from gitcode, serves as compilation dependency | | 30 | | Dependency | Not involved | cmake/third_party/protobuf.cmake | https://gitcode.com/cann-src-third-party/abseil-cpp/releases/download/20230802.1/abseil-cpp-20230802.1.tar.gz | Download abseil source code from gitcode, serves as compilation dependency | |
| 31 | | Dependency | Not involved | cmake/fetch_cann_cmake.cmake | https://cann-3rd.obs.cn-north-4.myhuaweicloud.com/cmake/cmake-master-049.tar.gz | Download cann cmake source code from gitcode, serves as compilation dependency | | 31 | | Dependency | Not involved | cmake/fetch_cann_cmake.cmake | https://cann-3rd.obs.cn-north-4.myhuaweicloud.com/cmake/cmake-master-049.tar.gz | Download cann cmake source code from gitcode, serves as compilation dependency | |
| 32 | +| Dependency | Not involved | install_graph.sh | https://ascend-cann.obs.cn-north-4.myhuaweicloud.com/CANN/20260902_newest/cann-amct-graph_9.2.0_linux-${ARCH}.tar.gz | Download the amct-graph package from OBS as a build dependency | | ||
| 32 | --- | 33 | --- |
| 33 | 34 | ||
| 34 | ## Vulnerability Mechanism Description | 35 | ## Vulnerability Mechanism Description |
| @@ -5,7 +5,7 @@ | |||
| 5 | # Licensed under the Apache License, Version 2.0 (the "License"); | 5 | # Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | # you may not use this file except in compliance with the License. | 6 | # you may not use this file except in compliance with the License. |
| 7 | # You may obtain a copy of the License at | 7 | # You may obtain a copy of the License at |
| 8 | -# | 8 | +# |
| 9 | # http://www.apache.org/licenses/LICENSE-2.0 | 9 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | 10 | ||
| 11 | # Unless required by applicable law or agreed to in writing, software | 11 | # Unless required by applicable law or agreed to in writing, software |
| @@ -22,7 +22,7 @@ echo "工作目录: $WORKING_DIR" | |||
| 22 | # Define default values | 22 | # Define default values |
| 23 | ARCH="$(uname -m)" | 23 | ARCH="$(uname -m)" |
| 24 | BASE_NAME="cann-amct-graph" | 24 | BASE_NAME="cann-amct-graph" |
| 25 | -SOURCE_URL="https://ascend-cann.obs.cn-north-4.myhuaweicloud.com/CANN/20260520_newest/${BASE_NAME}_9.1.0_linux-${ARCH}.tar.gz" | 25 | +SOURCE_URL="https://ascend-cann.obs.cn-north-4.myhuaweicloud.com/CANN/20260902_newest/${BASE_NAME}_9.2.0_linux-${ARCH}.tar.gz" |
ZZ 【一般】【Minor】【异议】runtime 仓已登记同类华为云 OBS 上的 CANN 自有二进制，本条暂不能关闭。 【你的反驳】ascend-cann.obs… 是 cann 专用二进制下载地址，暂不要求在 SECURITY 中声明。 【为什么不认同】cann/runtime 的 SECURITY.md:33 登记了 cann-3rd.obs.cn-north-4.myhuaweicloud.com 上的 acl-compat_9.2.0_linux-${TARGET_ARCH}.tar.gz，用途写明「从huaweicloud下载二进制依赖」——同样是华为云 OBS 上的 CANN 自有二进制包，照样登记。本仓 SECURITY.md:25 界定的范围是「本项目代码中包含的公网地址」，未按用途或归属豁免。 【怎样能关掉】「暂不要求」是流程口径，我在本仓和 .gitcode/ 下查不到成文依据，无法自行核实。请贴出豁免 ascend-cann 桶的规定或对应门禁配置位置，我据此关闭。 【更正上一轮】我写的「会被门禁拦」超出可证实范围：本仓 .gitcode/ 下没有公网地址扫描门禁配置。这条按「发布件安全声明完整性」看，不按门禁拦截看。   | |||
| 26 | BUNDLE_DIR="${WORKING_DIR}/amctgraph" | 26 | BUNDLE_DIR="${WORKING_DIR}/amctgraph" |
| 27 | OUTPUT_FILE="${BASE_NAME}_*_linux-${ARCH}.tar.gz" | 27 | OUTPUT_FILE="${BASE_NAME}_*_linux-${ARCH}.tar.gz" |
| 28 | AMCT_GRAPH_FILE="${BASE_NAME}_linux-${ARCH}.tar.gz" | 28 | AMCT_GRAPH_FILE="${BASE_NAME}_linux-${ARCH}.tar.gz" |
| @@ -76,4 +76,4 @@ echo "Package created successfully!" | |||
| 76 | echo "Location: $BUNDLE_DIR/" | 76 | echo "Location: $BUNDLE_DIR/" |
| 77 | echo "Package type: Tool Compatibility Package" | 77 | echo "Package type: Tool Compatibility Package" |
| 78 | echo "Architecture: $ARCH" | 78 | echo "Architecture: $ARCH" |
| 79 | -echo "==============================================" | 79 | +echo "==============================================" |
【一般】【Minor】install_graph.sh 的 OBS 下载地址未登记进 SECURITY.md 公网地址声明表。
【问题】本行的 ascend-cann.obs.cn-north-4.myhuaweicloud.com 是全仓唯一一处未登记的外联下载地址。SECURITY.md:29-31 与 SECURITY_en.md 的「公网地址声明」表已登记 protobuf、abseil、cann cmake 三个 URL，独缺 install_graph.sh。
【影响】发布的公网地址扫描要求代码内所有外联地址在声明表可查，这条查不到会被门禁拦；读安全声明的人会以为构建期只从 gitcode 和 cann-3rd 下载。
【建议】两份 SECURITY 表各补一行：类型「依赖」、文件名 install_graph.sh、URL 填本行地址、用途「从 OBS 下载 amct-graph 包，作用构建依赖」。改完 grep -rn "ascend-cann.obs" 应命中三个文件。