coqui-tts

maintainer AlphaJack · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install uses 'uv' to install the official 'coqui-tts' package from PyPI into a local venv, which is a normal and safe AUR packaging practice; the source is verifiable and no untrusted remote code execution occurs.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install uses 'uv' to install the official 'coqui-tts' package from PyPI into a local venv, which is a normal and safe AUR packaging practice; the source is verifiable and no untrusted remote code execution occurs.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:44 uv pip install 'coqui-tts==0.27.5'

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:44 uv pip install 'coqui-tts==0.27.5'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2# Co-maintainer: Evert Vorster <evorster at gmail dot com>
    
      3
    
      4pkgname="coqui-tts"
    
      5pkgver=0.27.5
    
      6pkgrel=2
    
      7pkgdesc="Deep learning for Text to Speech (hybrid venv)"
    
      8arch=('any')
    
      9url="https://github.com/idiap/coqui-ai-TTS"
    
      10license=('MPL-2.0')
    
      11provides=("tts" "python-tts")
    
      12conflicts=("tts" "python-tts")
    
      13replaces=("python-tts" "tts")
    
      14depends=('uv'
    
      15         'python-pytorch-cuda'
    
      16         'python-torchaudio'
    
      17         'python-torchcodec'
    
      18         'python-numpy'
    
      19         'python-scipy'
    
      20         'python-soundfile'
    
      21         'python-librosa'
    
      22         'python-inflect'
    
      23         'python-tqdm'
    
      24         'python-anyascii'
    
      25         'python-yaml'
    
      26         'python-fsspec'
    
      27         'python-packaging'
    
      28         'python-typing_extensions'
    
      29         'python-matplotlib'
    
      30         'python-transformers'
    
      31         'python-huggingface-hub')
    
      32source=('0001-replace-pyin-with-yin.patch')
    
      33sha256sums=('e5d00022730c5cce0e5a5b0cba0f64159efc9d9fab8864d9bc00276a0c2d98c3')
    
      34
    
      35makedepends=('uv')
    
      36
    
      37build() {
    
      38  # Create venv inheriting system packages (torch, numpy, scipy, librosa, etc.)
    
      39  uv venv --system-site-packages --clear venv
    
      40  source venv/bin/activate
    
      41
    
      42  # Install coqui-tts and any deps not on the system (AUR-only packages).
    
      43  # uv will install newer deps into the venv as needed.
    
      44  uv pip install 'coqui-tts==0.27.5'
    
      45
    
      46  _sp="venv/lib/python3.14/site-packages"
    
      47
    
      48  # Patch: librosa 0.11.0 removed pyin and magphase; use yin and np.abs
    
      49  patch -Np1 -d "$_sp" < "$srcdir/0001-replace-pyin-with-yin.patch"
    
      50
    
      51  # Patch: transformers 5 removed isin_mps_friendly; PyTorch has torch.isin
    
      52  sed -i 's/from transformers\.pytorch_utils import isin_mps_friendly as isin/isin = torch.isin/' \
    
      53    "$_sp/TTS/tts/layers/tortoise/autoregressive.py"
    
      54}
    
      55
    
      56package() {
    
      57  _optdir="$pkgdir/opt/$pkgname"
    
      58  install -d "$_optdir"
    
      59  cp -r venv "$_optdir/"
    
      60
    
      61  # Relocate venv: rewrite build-dir paths to install path
    
      62  _oldpath="$srcdir"
    
      63  _newpath="/opt/$pkgname"
    
      64  find "$_optdir/venv" -type f \( -name '*.cfg' -o -name 'activate*' -o -name '*.nu' -o -name '*.bat' -o -name '*.csh' -o -name '*.fish' \) \
    
      65    -exec sed -i "s|$_oldpath|$_newpath|g" {} + 2>/dev/null
    
      66  # Fix shebangs in bin/ scripts
    
      67  sed -i "s|$_oldpath/venv|$_newpath/venv|g" "$_optdir/venv/bin"/* 2>/dev/null || true
    
      68
    
      69  # Clean up caches
    
      70  rm -rf "$_optdir/venv/cache"
    
      71  find "$_optdir/venv" -name '__pycache__' -type d -exec rm -rf {} + 2>/dev/null
    
      72
    
      73  # Wrapper scripts
    
      74  install -d "$pkgdir/usr/bin"
    
      75
    
      76  {
    
      77    echo '#!/bin/bash'
    
      78    echo 'exec /opt/coqui-tts/venv/bin/tts "$@"'
    
      79  } > "$pkgdir/usr/bin/tts"
    
      80  chmod 755 "$pkgdir/usr/bin/tts"
    
      81
    
      82  {
    
      83    echo '#!/bin/bash'
    
      84    echo 'exec /opt/coqui-tts/venv/bin/tts-server "$@"'
    
      85  } > "$pkgdir/usr/bin/tts-server"
    
      86  chmod 755 "$pkgdir/usr/bin/tts-server"
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3