python-stt-bin

maintainer skeilnet · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs prebuilt Python wheels from the project's official GitHub releases, which is a common and acceptable practice; the wheels are verified against known checksums, reducing supply-chain risk, and the pip install in prepare() is for build dependencies only, not arbitrary external packages.

Triggered rules

LOW pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums. Severity reduced: python-* packages routinely use pip.

PKGBUILD:40 pip install -U wheel numpy

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The package installs prebuilt Python wheels from the project's official GitHub releases, which is a common and acceptable practice; the wheels are verified against known checksums, reducing supply-chain risk, and the pip install in prepare() is for build dependencies only, not arbitrary external packages.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=python-stt-bin 
    
      2_pkgname=STT
    
      3pkgver=1.4.0
    
      4pkgrel=1
    
      5pkgdesc="Coqui-STT - Python native client + CTC decoder."
    
      6arch=('x86_64' 'armv7h' 'aarch64')
    
      7url="https://github.com/coqui-ai/STT"
    
      8license=('MPL2')
    
      9makedepends=('wget' 'tar')
    
      10provides=('python-stt')
    
      11conflicts=('python-stt')
    
      12
    
      13# Set all sources.
    
      14_src_base_url="https://github.com/coqui-ai/STT/releases/download/v$pkgver"
    
      15_raw_base_url="https://raw.githubusercontent.com/coqui-ai/STT/v$pkgver"
    
      16
    
      17# amd64
    
      18source_x86_64=("$_src_base_url/stt-${pkgver}-cp310-cp310-manylinux_2_24_x86_64.whl"
    
      19               "$_src_base_url/coqui_stt_ctcdecoder-${pkgver}-cp310-cp310-manylinux_2_24_x86_64.whl"
    
      20                )
    
      21sha512sums_x86_64=('ed90874b04964e5c76f45521137a51d663fbeda505c45b0a19d267538e1a0a2106dfbf968a2c411b566917417b0dcd70459fd03bb0502fa78c27585c579668f2'
    
      22                   '9f26ac886e1c7e62eeaeacf35f64121fdaa82e7f5edae08fe729a3985f10982dcef644a16858d2a62bfc78a10f819933854c2b191ec57bdb20a9a61a3728decb'
    
      23                    )
    
      24
    
      25# armv7h
    
      26source_armv7h=("$_src_base_url/stt-${pkgver}-cp37-cp37m-linux_armv7l.whl"
    
      27               )
    
      28sha512sums_armv7h=('1d9811c71020e493be8070d82b5d73d5815a454a1b9d0381798f15b4ed1a39c5cd3381c944cb106089e62402f016d18b8066010d1d4462518ada09cdc421d274'
    
      29                   )
    
      30
    
      31# aarch64
    
      32source_aarch64=("$_src_base_url/stt-${pkgver}-cp37-cp37m-linux_aarch64.whl"
    
      33               )
    
      34sha512sums_aarch64=('61062cfd914f48bc4c7c04867f5261a4c8800ed79b4519335d4f8ef672df0308b5fccd176849dcf23af412eb138bb71034f0b276f5f1f6ef9ea726d95bcb7c24'
    
      35                    )
    
      36
    
      37prepare()
    
      38{
    
      39  python -m ensurepip --upgrade --default-pip
    
      40  pip install -U wheel numpy
    
      41}
    
      42
    
      43package() {
    
      44  # Create installation directories.
    
      45	#mkdir -p "$pkgdir/usr/lib"
    
      46	#mkdir -p "$pkgdir/usr/include"
    
      47	#mkdir -p "$pkgdir/usr/lib/pkgconfig"
    
      48
    
      49  # Separately get a copy of the TFLite library.
    
      50  # Unfortunately, due to files having the same name, this cannot be done with the sources section.
    
      51  # Note: At this time, only x86_64 Linux has a prebuilt TFLite library.
    
      52  MACHINE_TYPE=`uname -m`
    
      53  if [ ${MACHINE_TYPE} == 'x86_64' ]; then
    
      54    # Download the STT Wheel.
    
      55    local stt_fname="stt-${pkgver}-cp310-cp310-manylinux_2_24_x86_64.whl"
    
      56    local stt_sum="ed90874b04964e5c76f45521137a51d663fbeda505c45b0a19d267538e1a0a2106dfbf968a2c411b566917417b0dcd70459fd03bb0502fa78c27585c579668f2"
    
      57    wget "$_src_base_url/$stt_fname" -q -O "$srcdir/$stt_fname"
    
      58    local stt_sum_check=$(sha512sum "$stt_fname" | awk '{print $1}')
    
      59    if [ ${stt_sum_checkv} != "$stt_sum" ]; then
    
      60      # Bail!
    
      61      echo "Verifying STT\'s checksum failed!" 1>&2
    
      62      exit 1
    
      63    fi
    
      64
    
      65    # Download the CTC Decoder Wheel.
    
      66    local ctc_fname="coqui_stt_ctcdecoder-${pkgver}-cp310-cp310-manylinux_2_24_x86_64.whl"
    
      67    local ctc_sum="9f26ac886e1c7e62eeaeacf35f64121fdaa82e7f5edae08fe729a3985f10982dcef644a16858d2a62bfc78a10f819933854c2b191ec57bdb20a9a61a3728decb"
    
      68    wget "$_src_base_url/$ctc_fname" -q -O "$srcdir/$ctc_fname"
    
      69    local ctc_sum_check=$(sha512sum "$ctc_fname" | awk '{print $1}')
    
      70    if [ ${ctc_sum_check} != "$ctc_sum" ]; then
    
      71      # Bail!
    
      72      echo "Verifying CTC Decoder\'s checksum failed!" 1>&2
    
      73      exit 1
    
      74    fi
    
      75  elif [ ${MACHINE_TYPE} == 'armv7h' ]; then
    
      76    # Download the STT Wheel.
    
      77    local stt_fname="stt-${pkgver}-cp37-cp37m-linux_armv7l.whl"
    
      78    local stt_sum="1d9811c71020e493be8070d82b5d73d5815a454a1b9d0381798f15b4ed1a39c5cd3381c944cb106089e62402f016d18b8066010d1d4462518ada09cdc421d274"
    
      79    wget "$_src_base_url/$stt_fname" -q -O "$srcdir/$stt_fname"
    
      80    local stt_sum_check=$(sha512sum "$stt_fname" | awk '{print $1}')
    
      81    if [ "${stt_sum_checkv}" != "${stt_sum}" ]; then
    
      82      # Bail!
    
      83      echo "Verifying STT\'s checksum failed!" 1>&2
    
      84      exit 1
    
      85    fi
    
      86  elif [ ${MACHINE_TYPE} == 'aarch64' ]; then
    
      87    # Download the STT Wheel.
    
      88    local stt_fname="stt-${pkgver}-cp37-cp37m-linux_aarch64.whl"
    
      89    local stt_sum="61062cfd914f48bc4c7c04867f5261a4c8800ed79b4519335d4f8ef672df0308b5fccd176849dcf23af412eb138bb71034f0b276f5f1f6ef9ea726d95bcb7c24"
    
      90    wget "$_src_base_url/$stt_fname" -q -O "$srcdir/$stt_fname"
    
      91    local stt_sum_check=$(sha512sum "$stt_fname" | awk '{print $1}')
    
      92    if [ "${stt_sum_checkv}" != "${stt_sum}" ]; then
    
      93      # Bail!
    
      94      echo "Verifying STT\'s checksum failed!" 1>&2
    
      95      exit 1
    
      96    fi
    
      97  fi
    
      98
    
      99  # Python bindings
    
      100  PIP_CONFIG_FILE=/dev/null pip install --isolated --root="$pkgdir" --ignore-installed --no-deps stt-*.whl
    
      101  PIP_CONFIG_FILE=/dev/null pip install --isolated --root="$pkgdir" --ignore-installed --no-deps coqui_stt_ctcdecoder-*.whl
    
      102}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2