◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

python-sherpa-onnx

maintainer evine · 3 votes · base sherpa-onnx · scanned 2026-08-18 07:39:23.787586
MEDIUM
View on AUR ↗
Why flagged One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:24 "pa_stable_v190700_20210406.tgz::http://files.portaudio.com/archives/pa_stable_v190700_20210406.tgz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: devome <evinedeng@hotmail.com>
2
3pkgbase=sherpa-onnx
4pkgname=("${pkgbase}" "python-${pkgbase}")
5pkgver=1.13.6
6pkgrel=1
7pkgdesc="Speech-to-text, text-to-speech, speaker diarization, speech enhancement, source separation, and VAD using next-gen Kaldi with onnxruntime without Internet connection."
8arch=("x86_64" "aarch64" "arm" "riscv64")
9url="https://github.com/k2-fsa/${pkgbase}"
10license=("Apache-2.0")
11depends=("jack" "onnxruntime")
12makedepends=("cargs" "cmake" "ninja" "pybind11" "python-build" "python-installer" "python-setuptools" "python-wheel")
13source=("${pkgbase}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
14 "asio-asio-1-24-0.tar.gz::https://github.com/chriskohlhoff/asio/archive/refs/tags/asio-1-24-0.tar.gz"
15 "eigen-5.0.1.tar.gz::https://gitlab.com/libeigen/eigen/-/archive/5.0.1/eigen-5.0.1.tar.gz"
16 "espeak-ng-ed530aa113046142eb5115cf2fc9157854d0ffe1.zip::https://github.com/csukuangfj/espeak-ng/archive/ed530aa113046142eb5115cf2fc9157854d0ffe1.zip"
17 "hclust-cpp-2026-02-25.tar.gz::https://github.com/csukuangfj/hclust-cpp/archive/refs/tags/2026-02-25.tar.gz"
18 "json-3.12.0.tar.gz::https://github.com/nlohmann/json/archive/refs/tags/v3.12.0.tar.gz"
19 "kaldi-decoder-0.3.0.tar.gz::https://github.com/k2-fsa/kaldi-decoder/archive/refs/tags/v0.3.0.tar.gz"
20 "kaldi-native-fbank-1.22.3.tar.gz::https://github.com/csukuangfj/kaldi-native-fbank/archive/refs/tags/v1.22.3.tar.gz"
21 "kaldifst-1.8.0.tar.gz::https://github.com/k2-fsa/kaldifst/archive/refs/tags/v1.8.0.tar.gz"
22 "kissfft-febd4caeed32e33ad8b2e0bb5ea77542c40f18ec.zip::https://github.com/mborgerding/kissfft/archive/febd4caeed32e33ad8b2e0bb5ea77542c40f18ec.zip"
23 "openfst-1.8.5-2026-07-09.tar.gz::https://github.com/csukuangfj/openfst/archive/refs/tags/v1.8.5-2026-07-09.tar.gz"
24 "pa_stable_v190700_20210406.tgz::http://files.portaudio.com/archives/pa_stable_v190700_20210406.tgz"
25 "piper-phonemize-f3ff95afc03640bc1399e113e83361192a2fafb4.zip::https://github.com/csukuangfj/piper-phonemize/archive/f3ff95afc03640bc1399e113e83361192a2fafb4.zip"
26 "simple-sentencepiece-0.7.tar.gz::https://github.com/pkufool/simple-sentencepiece/archive/refs/tags/v0.7.tar.gz"
27 "websocketpp-b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip::https://github.com/zaphoyd/websocketpp/archive/b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip")
28sha256sums=('78f5d10f957d2de1867a1e08395e9ec2ec388911c853dd141887396667f3ff34'
29 'cbcaaba0f66722787b1a7c33afe1befb3a012b5af3ad7da7ff0f6b8c9b7a8a5b'
30 'e9c326dc8c05cd1e044c71f30f1b2e34a6161a3b6ecf445d56b53ff1669e3dec'
31 'e4e262cbe34f7fe21f91f1ba3397f2728e1f30eafbae7853f2b753a9ed13f0dd'
32 '8f14e024c709d73afb40ae69cb22de4b73dba67cbce40f2e518813da8139ab56'
33 '4b92eb0c06d10683f7447ce9406cb97cd4b453be18d7279320f7b2f025c10187'
34 'b9f34cfb4fd3b1344100eead79ef4d37aa15962274b9e3056de345021f76a1b0'
35 '9176cc66fc7ce1edf85cf355b06e320c57db6297df74277f575183468893cf61'
36 '3f247b7e5a2409071202f5e2bc6200060f66728c0a3443c03923ad2723e040b3'
37 '497103e664168ebe39580b757adbe616f6cf85a16572af581ca7bc42d0ab13fd'
38 '2ff712a32952fcb01d351121a6bc8ccf4fdc6b2aa06ce8df2b3095dedd518c0e'
39 '47efbf42c77c19a05d22e627d42873e991ec0c1357219c0d74ce6a2948cb2def'
40 'd9cca4e2bdc7d6dd8dffb96a4668283dbd3f77a9c194a3e530c1e8eba9406a5d'
41 '1748a822060a35baa9f6609f84efc8eb54dc0e74b9ece3d82367b7119fdc75af'
42 '1385135ede8191a7fbef9ec8099e3c5a673d48df0c143958216cd1690567f583')
43noextract=( $(echo "${source[@]:1}" | sed -E 's|:\S+||g') )
44
45prepare() {
46 cd "${pkgbase}-${pkgver}"
47 for file in ${noextract[@]}; do
48 ln -sf ../"${file}" "${file}"
49 done
50 sed -i "s|include(cargs)|find_package(Cargs CONFIG REQUIRED)|" c-api-examples/CMakeLists.txt
51 sed -i "s|^ .$| lib/pkgconfig|g" CMakeLists.txt
52 echo 'find_package(pybind11 REQUIRED)' > cmake/pybind11.cmake
53 echo "After upgrading onnxruntime, you need to rebuild ${pkgbase}."
54}
55
56build() {
57 local base_args=(
58 --compile-no-warning-as-error
59 -Wno-dev
60 -G Ninja
61 -DCMAKE_BUILD_TYPE=Release
62 -DSHERPA_ONNX_USE_PRE_INSTALLED_ONNXRUNTIME_IF_AVAILABLE=ON
63 )
64 export CFLAGS+=" -Wno-error=format-security"
65 export CXXFLAGS+=" -Wno-error=format-security"
66
67 cd "${pkgbase}-${pkgver}"
68 cmake "${base_args[@]}" \
69 -Bbuild_bin \
70 -DBUILD_SHARED_LIBS=ON \
71 -DCMAKE_INSTALL_PREFIX=/usr \
72 -DSHERPA_ONNX_ENABLE_BINARY=ON \
73 -DSHERPA_ONNX_ENABLE_PYTHON=OFF
74 cmake --build build_bin
75
76 SHERPA_ONNX_CMAKE_ARGS="${base_args[@]} -DSHERPA_ONNX_ENABLE_BINARY=OFF" python -m build --wheel --no-isolation
77}
78
79package_sherpa-onnx() {
80 cd "${pkgbase}-${pkgver}"
81 DESTDIR="${pkgdir}" cmake --install build_bin
82 install -Dm644 {README,CHANGELOG}.md -t "${pkgdir}/usr/share/doc/${pkgname}"
83}
84
85package_python-sherpa-onnx() {
86 pkgdesc+=" (Python bindings)"
87 depends=("alsa-lib" "onnxruntime" "pypinyin" "python-click" "python-onnxruntime" "python-sentencepiece")
88
89 cd "${pkgbase}-${pkgver}"
90 python -m installer --destdir="${pkgdir}" dist/*.whl
91 install -Dm644 {README,CHANGELOG}.md -t "${pkgdir}/usr/share/doc/${pkgname}"
92}
93

Changes since previous scan

--- PKGBUILD @ 2026-08-12 00:27
+++ PKGBUILD @ 2026-08-18 07:39
@@ -2,13 +2,13 @@
pkgbase=sherpa-onnx
pkgname=("${pkgbase}" "python-${pkgbase}")
-pkgver=1.13.5
+pkgver=1.13.6
pkgrel=1
pkgdesc="Speech-to-text, text-to-speech, speaker diarization, speech enhancement, source separation, and VAD using next-gen Kaldi with onnxruntime without Internet connection."
arch=("x86_64" "aarch64" "arm" "riscv64")
url="https://github.com/k2-fsa/${pkgbase}"
license=("Apache-2.0")
-depends=("jack" "onnxruntime" "protobuf")
+depends=("jack" "onnxruntime")
makedepends=("cargs" "cmake" "ninja" "pybind11" "python-build" "python-installer" "python-setuptools" "python-wheel")
source=("${pkgbase}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
"asio-asio-1-24-0.tar.gz::https://github.com/chriskohlhoff/asio/archive/refs/tags/asio-1-24-0.tar.gz"
@@ -25,7 +25,7 @@
"piper-phonemize-f3ff95afc03640bc1399e113e83361192a2fafb4.zip::https://github.com/csukuangfj/piper-phonemize/archive/f3ff95afc03640bc1399e113e83361192a2fafb4.zip"
"simple-sentencepiece-0.7.tar.gz::https://github.com/pkufool/simple-sentencepiece/archive/refs/tags/v0.7.tar.gz"
"websocketpp-b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip::https://github.com/zaphoyd/websocketpp/archive/b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip")
-sha256sums=('99f520db7364a06be0c174a385d03f9ccdbfe08f61146055229e4a990e285262'
+sha256sums=('78f5d10f957d2de1867a1e08395e9ec2ec388911c853dd141887396667f3ff34'
'cbcaaba0f66722787b1a7c33afe1befb3a012b5af3ad7da7ff0f6b8c9b7a8a5b'
'e9c326dc8c05cd1e044c71f30f1b2e34a6161a3b6ecf445d56b53ff1669e3dec'
'e4e262cbe34f7fe21f91f1ba3397f2728e1f30eafbae7853f2b753a9ed13f0dd'
@@ -50,6 +50,7 @@
sed -i "s|include(cargs)|find_package(Cargs CONFIG REQUIRED)|" c-api-examples/CMakeLists.txt
sed -i "s|^ .$| lib/pkgconfig|g" CMakeLists.txt
echo 'find_package(pybind11 REQUIRED)' > cmake/pybind11.cmake
+ echo "After upgrading onnxruntime, you need to rebuild ${pkgbase}."
}
build() {
@@ -83,7 +84,7 @@
package_python-sherpa-onnx() {
pkgdesc+=" (Python bindings)"
- depends=("python-click" "python-onnxruntime")
+ depends=("alsa-lib" "onnxruntime" "pypinyin" "python-click" "python-onnxruntime" "python-sentencepiece")
cd "${pkgbase}-${pkgver}"
python -m installer --destdir="${pkgdir}" dist/*.whl

Scan history

Scanned at (UTC)SeverityRules
2026-08-18 07:39:23 MEDIUM 1
2026-08-12 00:27:08 CLEAN 2
2026-08-11 15:21:23 MEDIUM 1
2026-07-08 00:26:52 CLEAN 2
2026-07-07 17:25:23 MEDIUM 1
2026-07-07 15:25:04 MEDIUM 1
2026-06-19 22:34:54 CLEAN 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion