omarchy-stt-bin

LOW
maintainer sebkouba 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package installs a prebuilt binary from the project's GitHub release (normal for bin packages) and a machine learning model from a non-whitelisted host; the model is data, not executable code, and the worst case of a swap is degraded transcription, not code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt binary from the project's GitHub release (normal for bin packages) and a machine learning model from a non-whitelisted host; the model is data, not executable code, and the worst case of a swap is degraded transcription, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:20 "parakeet-v3-int8.tar.gz::https://blob.handy.computer/parakeet-v3-int8.tar.gz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Sebastian K <sjkouba@gmail.com>
2pkgname=omarchy-stt-bin
3pkgver=0.1.1
4pkgrel=1
5pkgdesc="Push-to-talk dictation system for Linux/Wayland with hotkey daemon and LLM corrections"
6arch=('x86_64')
7url="https://github.com/sebkouba/omarchy-stt"
8license=('MIT')
9depends=('wl-clipboard' 'ydotool' 'ffmpeg')
10optdepends=(
11 'xdg-desktop-portal: For hotkey daemon global shortcuts'
12 'xdg-desktop-portal-hyprland: Hyprland integration'
13 'groq-api: For LLM post-processing (API key required)'
14)
15provides=('omarchy-stt')
16conflicts=('omarchy-stt')
17install=${pkgname}.install
18source=(
19 "${pkgname}-${pkgver}.tar.gz::${url}/releases/download/v${pkgver}/omarchy-stt-${pkgver}-x86_64.tar.gz"
20 "parakeet-v3-int8.tar.gz::https://blob.handy.computer/parakeet-v3-int8.tar.gz"
21)
22sha256sums=('4e2c4ffae3c225e81acd3c15671bd2bf16bbd656faf156a220cba6c5fa816676'
23 'SKIP') # Parakeet model checksum - can be updated or left as SKIP
24
25package() {
26 cd "${srcdir}/omarchy-stt-${pkgver}-x86_64"
27
28 # Install binaries
29 install -Dm755 "hotkey-daemon" "${pkgdir}/usr/bin/hotkey-daemon"
30 install -Dm755 "transcribe-daemon" "${pkgdir}/usr/bin/transcribe-daemon"
31 install -Dm755 "transcribe-client" "${pkgdir}/usr/bin/transcribe-client"
32 install -Dm755 "recording-daemon" "${pkgdir}/usr/bin/recording-daemon"
33 install -Dm755 "list-microphones" "${pkgdir}/usr/bin/list-microphones"
34
35 # Install systemd user services
36 install -Dm644 "systemd/recording-daemon.service" \
37 "${pkgdir}/usr/lib/systemd/user/recording-daemon.service"
38 install -Dm644 "systemd/transcribe-daemon.service" \
39 "${pkgdir}/usr/lib/systemd/user/transcribe-daemon.service"
40 install -Dm644 "systemd/hotkey-daemon.service" \
41 "${pkgdir}/usr/lib/systemd/user/hotkey-daemon.service"
42
43 # Install Parakeet model
44 install -dm755 "${pkgdir}/usr/share/omarchy-stt/models"
45 cp -r "${srcdir}/parakeet-tdt-0.6b-v3-int8" \
46 "${pkgdir}/usr/share/omarchy-stt/models/"
47
48 # Install example configuration
49 install -Dm644 "config/config.toml.example" \
50 "${pkgdir}/usr/share/omarchy-stt/config.toml.example"
51 if [ -f "config/transcription_corrections.json.example" ]; then
52 install -Dm644 "config/transcription_corrections.json.example" \
53 "${pkgdir}/usr/share/omarchy-stt/transcription_corrections.json.example"
54 fi
55
56 # Install documentation
57 install -Dm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
58 install -Dm644 "SETUP.md" "${pkgdir}/usr/share/doc/${pkgname}/SETUP.md"
59 install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
60}
61

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion