python-vosk-git

maintainer dbermond · 2 votes · base vosk-api-git · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host is the project's own domain (alphacephei.com), used for versioned model files that are non-executable data; the worst case of a swap is degraded test results, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is the project's own domain (alphacephei.com), used for versioned model files that are non-executable data; the worst case of a swap is degraded test results, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 "https://alphacephei.com/kaldi/models/vosk-model-small-en-us-${_model_small_ver}.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Daniel Bermond <dbermond@archlinux.org>
    
      2
    
      3pkgbase=vosk-api-git
    
      4pkgname=(
    
  'vosk-api-git'
    
  'python-vosk-git')
    
      7pkgver=0.3.50.r20.g625e44c
    
      8pkgrel=1
    
      9_model_small_ver=0.15
    
      10_model_spk_ver=0.4
    
      11pkgdesc='Offline speech recognition toolkit (git version)'
    
      12arch=('x86_64')
    
      13url='https://alphacephei.com/vosk/'
    
      14license=('Apache-2.0')
    
      15makedepends=(
    
  'cmake'
    
  'git'
    
  'gradle'
    
  'java-environment=21'
    
  'python'
    
  'python-build'
    
  'python-cffi'
    
  'python-installer'
    
  'python-requests'
    
  'python-setuptools'
    
  'python-srt'
    
  'python-tqdm'
    
  'python-websockets'
    
  'python-wheel')
    
      30checkdepends=('ffmpeg' 'python-numpy')
    
      31source=('git+https://github.com/alphacep/vosk-api.git'
    
      'git+https://github.com/xianyi/OpenBLAS.git'
    
      "git+https://github.com/alphacep/clapack.git"
    
      'git+https://github.com/alphacep/openfst.git'
    
      'git+https://github.com/alphacep/kaldi.git#branch=vosk'
    
      # models are for running tests in the check() function
    
      "https://alphacephei.com/kaldi/models/vosk-model-small-en-us-${_model_small_ver}.zip"
    
      "https://alphacephei.com/vosk/models/vosk-model-spk-${_model_spk_ver}.zip"
    
      '010-vosk-api-gradle9.2-fix.patch')
    
      40noextract=("vosk-model-small-en-us-${_model_small_ver}.zip")
    
      41sha256sums=('SKIP'
    
          'SKIP'
    
          'SKIP'
    
          'SKIP'
    
          'SKIP'
    
          '30f26242c4eb449f948e42cb302dd7a686cb29a3423a8367f99ff41780942498'
    
          'a74d8f51144484813e16af689bb0f916b7a111e2347f467c4933c1166097b5a7'
    
          '0cb76c2257a233bd5b08cb120c21d2a86082fb4ff108f40108d82bbbea01d568')
    
      49
    
      50prepare() {
    
  local _curl='curl -sqgb "" -fLC - --retry 3 --retry-delay 3'
    
  local _url='https://raw.githubusercontent.com/alphacep/vosk-api/master/travis/Dockerfile.manylinux'
    
  git -C OpenBLAS config --local advice.detachedHead false
    
  git -C clapack config --local advice.detachedHead false
    
  git -C OpenBLAS checkout --quiet "$(awk '/xianyi\/OpenBLAS/ { print $5 }' <($_curl "$_url"))"
    
  git -C clapack checkout --quiet "$(awk '/alphacep\/clapack/ { print $5 }' <($_curl "$_url"))"
    
  
    
  mkdir -p models
    
  bsdtar -x -f  "vosk-model-small-en-us-${_model_small_ver}.zip" -C models
    
  
    
  ln -sf "../../../vosk-model-spk-${_model_spk_ver}" vosk-api/python/example/model-spk
    
  ln -sf ../../OpenBLAS kaldi/tools/OpenBLAS
    
  ln -sf ../../clapack kaldi/tools/clapack
    
  ln -sf ../../openfst kaldi/tools/openfst
    
  
    
  patch -d vosk-api -Np1 -i "${srcdir}/010-vosk-api-gradle9.2-fix.patch"
    
  
    
  autoreconf -fi openfst
    
      69}
    
      70
    
      71pkgver() {
    
  git -C vosk-api describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/go\///;s/^v//'
    
      73}
    
      74
    
      75build() {
    
  local _file
    
  export CFLAGS+=' -ffat-lto-objects'
    
  export CXXFLAGS+=' -ffat-lto-objects'
    
  
    
  # openblas
    
  CFLAGS+=' -Wno-implicit-function-declaration' \
    
  make -C OpenBLAS ONLY_CBLAS='1' DYNAMIC_ARCH='1' TARGET='NEHALEM' USE_LOCKING='1' USE_THREAD='0' all
    
  make -C OpenBLAS PREFIX="${srcdir}/OpenBLAS/install" install
    
  
    
  # clapack
    
  CFLAGS+=' -Wno-error=format-security -fcommon -Wno-implicit-function-declaration' \
    
  cmake -B build-clapack -S clapack \
    
      -DCMAKE_C_STANDARD:STRING='17' \
    
      -DCMAKE_POLICY_VERSION_MINIMUM:STRING='3.5.0' \
    
      -Wno-dev
    
  cmake --build build-clapack
    
  while read -r -d '' _file
    
  do
    
      cp -af "$_file" "${srcdir}/OpenBLAS/install/lib"
    
  done < <(find build-clapack -type f -name 'lib*.a' -print0)
    
  
    
  # openfst
    
  cd openfst
    
  CFLAGS="${CFLAGS/-O2/-O3}" \
    
  CXXFLAGS="${CXXFLAGS/-O2/-O3}" \
    
  ./configure \
    
      --prefix="${srcdir}/kaldi/tools/openfst" \
    
      --enable-static \
    
      --enable-shared \
    
      --enable-far \
    
      --enable-ngram-fsts \
    
      --enable-lookahead-fsts \
    
      --with-pic \
    
      --disable-bin
    
  make
    
  make install
    
  
    
  # kaldi
    
  cd "${srcdir}/kaldi/src"
    
  CXXFLAGS="${CXXFLAGS/-O2/-O3}" ./configure --mathlib='OPENBLAS_CLAPACK' --shared --use-cuda='no'
    
  sed -i 's/[[:space:]]-O1[[:space:]]/ -O3 /g' kaldi.mk
    
  make online2 rnnlm
    
  while read -r -d '' _file
    
  do
    
      rm "$_file"
    
  done < <(find "${srcdir}/kaldi" -type f -name '*.o' -print0)
    
  
    
  # vosk-api
    
  export CFLAGS="${CFLAGS/ -ffat-lto-objects/}"
    
  export CXXFLAGS="${CXXFLAGS/ -ffat-lto-objects/}"
    
  make -C "${srcdir}/vosk-api/src" \
    
      EXTRA_CFLAGS="${CXXFLAGS/-O2/-O3}" \
    
      EXTRA_LDFLAGS="$LDFLAGS" \
    
      KALDI_ROOT="${srcdir}/kaldi" \
    
      OPENFST_ROOT="${srcdir}/kaldi/tools/openfst" \
    
      OPENBLAS_ROOT="${srcdir}/kaldi/tools/OpenBLAS/install"
    
  
    
  # java bindings
    
  gradle -p "${srcdir}/vosk-api/java/lib" clean assemble
    
  
    
  # python module
    
  cd "${srcdir}/vosk-api/python"
    
  python ./vosk_builder.py
    
  python -m build --wheel --no-isolation
    
      140}
    
      141
    
      142check() {
    
  local _test
    
  cd vosk-api/python/example
    
  
    
  # https://github.com/alphacep/vosk-api/issues/1220
    
  for _test in alternatives empty ffmpeg nlsml simple speaker srt text words #reset
    
  do
    
      printf '%s\n' "Running test_${_test}..."
    
      PYTHONPATH="${PWD}/../build/lib" VOSK_MODEL_PATH="${srcdir}/models" python "./test_${_test}.py" test.wav
    
  done
    
      152}
    
      153
    
      154package_vosk-api-git() {
    
  depends=(
    
      'gcc-libs'
    
      'glibc')
    
  optdepends=(
    
      'java-runtime: for java bindings')
    
  provides=('vosk-api')
    
  conflicts=('vosk-api')
    
  
    
  install -d -m755 "${pkgdir}/usr/lib"
    
  install -D -m644 vosk-api/src/vosk_api.h -t "${pkgdir}/usr/include"
    
  cp -dr --no-preserve='ownership' vosk-api/src/*.so* "${pkgdir}/usr/lib"
    
  
    
  local _ver
    
  _ver="$(awk "/^version[[:space:]]=/ { gsub(/'/, \"\", \$3); print \$3 }" vosk-api/java/lib/build.gradle)"
    
  install -D -m644 "vosk-api/java/lib/build/libs/vosk-${_ver}.jar" "${pkgdir}/usr/share/java/vosk.jar"
    
      170}
    
      171
    
      172package_python-vosk-git() {
    
  pkgdesc='Python module for vosk-api (git version)'
    
  depends=(
    
      'python'
    
      'python-cffi'
    
      'python-requests'
    
      'python-srt'
    
      'python-tqdm'
    
      'python-websockets'
    
      "vosk-api-git=${pkgver}")
    
  provides=('python-vosk')
    
  conflicts=('python-vosk')
    
  
    
  local _site_pkgs
    
  _site_pkgs="$(python -c 'import site; print(site.getsitepackages()[0])')"
    
  python -m installer --destdir="$pkgdir" vosk-api/python/dist/*.whl
    
  rm "${pkgdir}${_site_pkgs}/vosk/libvosk.so"
    
  ln -s ../../../libvosk.so "${pkgdir}${_site_pkgs}/vosk/libvosk.so"
    
      190}
    
      191

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2