flite-voices

maintainer bidulock · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads voice data files from a non-whitelisted but project-related host (festvox.org), which is plausibly official; the files are not executable code but data for flite, and the build process generates simple wrapper scripts; worst case of source swap is limited to voice data tampering, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads voice data files from a non-whitelisted but project-related host (festvox.org), which is plausibly official; the files are not executable code but data for flite, and the build process generates simple wrapper scripts; worst case of source swap is limited to voice data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(http://festvox.org/flite/packed/flite-$pkgver/voices/cmu_us_{aew,ahw,aup,awb,axb,bdl,clb,eey,fem,gka,jmk,ksp,ljm,lnh,rms,rxr,slp,slt}.flitevox)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Brian Bidulock <bidulock@openss7.org>
    
      2
    
      3pkgname=flite-voices
    
      4pkgver=2.3
    
      5pkgrel=1
    
      6pkgdesc="Voices for the flite lightweight speech synthesis engine"
    
      7arch=(any)
    
      8url="http://cmuflite.org"
    
      9license=(custom)
    
      10depends=(bash flite)
    
      11source=(http://festvox.org/flite/packed/flite-$pkgver/voices/cmu_us_{aew,ahw,aup,awb,axb,bdl,clb,eey,fem,gka,jmk,ksp,ljm,lnh,rms,rxr,slp,slt}.flitevox)
    
      12
    
      13prepare() {
    
      14  mkdir $pkgname
    
      15}
    
      16build() {
    
      17  cd $pkgname
    
      18  for v in aew ahw aup awb axb bdl clb eey fem gka jmk ksp ljm lnh rms rxr slp; do
    
      19    echo -e "#!/bin/sh\nexec flite -voice /usr/lib/flite/cmu_us_${v}.flitevox \"\$@\"" >flite_cmu_us_${v}
    
      20  done
    
      21}
    
      22
    
      23package() {
    
      24  cd $pkgname
    
      25  install -d "$pkgdir/usr/bin"
    
      26  install -d "$pkgdir/usr/lib/flite"
    
      27  for v in aew ahw aup awb axb bdl clb eey fem gka jmk ksp ljm lnh rms rxr slp; do
    
      28    install -m0755 flite_cmu_us_${v} "$pkgdir/usr/bin"
    
      29    install -m0644 ../cmu_us_${v}.flitevox "$pkgdir/usr/lib/flite"
    
      30  done
    
      31  install -m0644 ../cmu_us_slt.flitevox "$pkgdir/usr/lib/flite"
    
      32}
    
      33
    
      34sha256sums=('5fd165e5ea219236e9c20e338efb140163380472f22d60c7a1f79b4997cad50c'
    
      35            '8bab5975c40ea64fbbc324c20ced3587e02aaa30aba6fa2631af4e2fb8e6f3f5'
    
      36            'c464ce87d33fe9718d96909ecf11ebd6267c47fbca97a041fbf17356504c6cc1'
    
      37            '5f9d6ff1d333f30a1ed357574e63b5c8bb2b42b56ebf988570ac020a467ef82a'
    
      38            '6d96bbf4e8ec686ee57d8cf6311ae6269d73c0a9e4fe52180468cfa1892b17ce'
    
      39            'e274b108ae41120566290ba8beb4a5141abdc9c1ae1e446c5ab2981ef4683551'
    
      40            '709bd0e8acac4374e8beb704da7e31cd254385a4c73bafb6e3390a6d1281e885'
    
      41            '875a9a6f7f3a746549138d5817bb49419ac1290a7023b014114f88bc68f0cab9'
    
      42            '8043ccd6e83cc6679e386eb888f5ed4faac664f06149aecf9529e45b3f91bc88'
    
      43            'e8a9fcb10a2a0b6d78022131277bf546fd0e650ebce03108bc4440d4d2367a65'
    
      44            'deb85a2d90cd8aef2104431cccf096cdba6485c5b83a85330a948657ae6eb5d5'
    
      45            '53927cdb7eb3f83d8db2faa79fdb8115c82e96ca71c4b095eb05c67667d36a02'
    
      46            '90b1c8b507912db357084e33ba8f83f015ae0268bb59fdd0a6298d1110fe23d2'
    
      47            'd3fb6b1c4f781fc5c9b1ea5efdc8c46c1ce5e74cf349cd78c1fae3c0e19d7c9f'
    
      48            'cf49e138caa926c2551079efe561254eb3bb50340139484d3aa20670b5cb0c55'
    
      49            'e7007354436387f721cdce03f89388507e9ca9f8a76f36c288fc950ea6b56e25'
    
      50            'd5022f507d513b3dd78705f8e747015a4c933fdbd872f1c3057a5a9915b145d3'
    
      51            'c54b0d757b943bfbffc626e95a251f1659cc2d840465daa8b858457139b94bc0')
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2