python-vosk-git

LOW
maintainer dbermond 2 votes base vosk-api-git scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The non-standard host is the project's own domain (alphacephei.com), used for versioned model files that are non-executable data; the worst case of a swap is degraded test results, not code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is the project's own domain (alphacephei.com), used for versioned model files that are non-executable data; the worst case of a swap is degraded test results, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:37 "https://alphacephei.com/kaldi/models/vosk-model-small-en-us-${_model_small_ver}.zip"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Daniel Bermond <dbermond@archlinux.org>
2
3pkgbase=vosk-api-git
4pkgname=(
5 'vosk-api-git'
6 'python-vosk-git')
7pkgver=0.3.50.r20.g625e44c
8pkgrel=1
9_model_small_ver=0.15
10_model_spk_ver=0.4
11pkgdesc='Offline speech recognition toolkit (git version)'
12arch=('x86_64')
13url='https://alphacephei.com/vosk/'
14license=('Apache-2.0')
15makedepends=(
16 'cmake'
17 'git'
18 'gradle'
19 'java-environment=21'
20 'python'
21 'python-build'
22 'python-cffi'
23 'python-installer'
24 'python-requests'
25 'python-setuptools'
26 'python-srt'
27 'python-tqdm'
28 'python-websockets'
29 'python-wheel')
30checkdepends=('ffmpeg' 'python-numpy')
31source=('git+https://github.com/alphacep/vosk-api.git'
32 'git+https://github.com/xianyi/OpenBLAS.git'
33 "git+https://github.com/alphacep/clapack.git"
34 'git+https://github.com/alphacep/openfst.git'
35 'git+https://github.com/alphacep/kaldi.git#branch=vosk'
36 # models are for running tests in the check() function
37 "https://alphacephei.com/kaldi/models/vosk-model-small-en-us-${_model_small_ver}.zip"
38 "https://alphacephei.com/vosk/models/vosk-model-spk-${_model_spk_ver}.zip"
39 '010-vosk-api-gradle9.2-fix.patch')
40noextract=("vosk-model-small-en-us-${_model_small_ver}.zip")
41sha256sums=('SKIP'
42 'SKIP'
43 'SKIP'
44 'SKIP'
45 'SKIP'
46 '30f26242c4eb449f948e42cb302dd7a686cb29a3423a8367f99ff41780942498'
47 'a74d8f51144484813e16af689bb0f916b7a111e2347f467c4933c1166097b5a7'
48 '0cb76c2257a233bd5b08cb120c21d2a86082fb4ff108f40108d82bbbea01d568')
49
50prepare() {
51 local _curl='curl -sqgb "" -fLC - --retry 3 --retry-delay 3'
52 local _url='https://raw.githubusercontent.com/alphacep/vosk-api/master/travis/Dockerfile.manylinux'
53 git -C OpenBLAS config --local advice.detachedHead false
54 git -C clapack config --local advice.detachedHead false
55 git -C OpenBLAS checkout --quiet "$(awk '/xianyi\/OpenBLAS/ { print $5 }' <($_curl "$_url"))"
56 git -C clapack checkout --quiet "$(awk '/alphacep\/clapack/ { print $5 }' <($_curl "$_url"))"
57
58 mkdir -p models
59 bsdtar -x -f "vosk-model-small-en-us-${_model_small_ver}.zip" -C models
60
61 ln -sf "../../../vosk-model-spk-${_model_spk_ver}" vosk-api/python/example/model-spk
62 ln -sf ../../OpenBLAS kaldi/tools/OpenBLAS
63 ln -sf ../../clapack kaldi/tools/clapack
64 ln -sf ../../openfst kaldi/tools/openfst
65
66 patch -d vosk-api -Np1 -i "${srcdir}/010-vosk-api-gradle9.2-fix.patch"
67
68 autoreconf -fi openfst
69}
70
71pkgver() {
72 git -C vosk-api describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/go\///;s/^v//'
73}
74
75build() {
76 local _file
77 export CFLAGS+=' -ffat-lto-objects'
78 export CXXFLAGS+=' -ffat-lto-objects'
79
80 # openblas
81 CFLAGS+=' -Wno-implicit-function-declaration' \
82 make -C OpenBLAS ONLY_CBLAS='1' DYNAMIC_ARCH='1' TARGET='NEHALEM' USE_LOCKING='1' USE_THREAD='0' all
83 make -C OpenBLAS PREFIX="${srcdir}/OpenBLAS/install" install
84
85 # clapack
86 CFLAGS+=' -Wno-error=format-security -fcommon -Wno-implicit-function-declaration' \
87 cmake -B build-clapack -S clapack \
88 -DCMAKE_C_STANDARD:STRING='17' \
89 -DCMAKE_POLICY_VERSION_MINIMUM:STRING='3.5.0' \
90 -Wno-dev
91 cmake --build build-clapack
92 while read -r -d '' _file
93 do
94 cp -af "$_file" "${srcdir}/OpenBLAS/install/lib"
95 done < <(find build-clapack -type f -name 'lib*.a' -print0)
96
97 # openfst
98 cd openfst
99 CFLAGS="${CFLAGS/-O2/-O3}" \
100 CXXFLAGS="${CXXFLAGS/-O2/-O3}" \
101 ./configure \
102 --prefix="${srcdir}/kaldi/tools/openfst" \
103 --enable-static \
104 --enable-shared \
105 --enable-far \
106 --enable-ngram-fsts \
107 --enable-lookahead-fsts \
108 --with-pic \
109 --disable-bin
110 make
111 make install
112
113 # kaldi
114 cd "${srcdir}/kaldi/src"
115 CXXFLAGS="${CXXFLAGS/-O2/-O3}" ./configure --mathlib='OPENBLAS_CLAPACK' --shared --use-cuda='no'
116 sed -i 's/[[:space:]]-O1[[:space:]]/ -O3 /g' kaldi.mk
117 make online2 rnnlm
118 while read -r -d '' _file
119 do
120 rm "$_file"
121 done < <(find "${srcdir}/kaldi" -type f -name '*.o' -print0)
122
123 # vosk-api
124 export CFLAGS="${CFLAGS/ -ffat-lto-objects/}"
125 export CXXFLAGS="${CXXFLAGS/ -ffat-lto-objects/}"
126 make -C "${srcdir}/vosk-api/src" \
127 EXTRA_CFLAGS="${CXXFLAGS/-O2/-O3}" \
128 EXTRA_LDFLAGS="$LDFLAGS" \
129 KALDI_ROOT="${srcdir}/kaldi" \
130 OPENFST_ROOT="${srcdir}/kaldi/tools/openfst" \
131 OPENBLAS_ROOT="${srcdir}/kaldi/tools/OpenBLAS/install"
132
133 # java bindings
134 gradle -p "${srcdir}/vosk-api/java/lib" clean assemble
135
136 # python module
137 cd "${srcdir}/vosk-api/python"
138 python ./vosk_builder.py
139 python -m build --wheel --no-isolation
140}
141
142check() {
143 local _test
144 cd vosk-api/python/example
145
146 # https://github.com/alphacep/vosk-api/issues/1220
147 for _test in alternatives empty ffmpeg nlsml simple speaker srt text words #reset
148 do
149 printf '%s\n' "Running test_${_test}..."
150 PYTHONPATH="${PWD}/../build/lib" VOSK_MODEL_PATH="${srcdir}/models" python "./test_${_test}.py" test.wav
151 done
152}
153
154package_vosk-api-git() {
155 depends=(
156 'gcc-libs'
157 'glibc')
158 optdepends=(
159 'java-runtime: for java bindings')
160 provides=('vosk-api')
161 conflicts=('vosk-api')
162
163 install -d -m755 "${pkgdir}/usr/lib"
164 install -D -m644 vosk-api/src/vosk_api.h -t "${pkgdir}/usr/include"
165 cp -dr --no-preserve='ownership' vosk-api/src/*.so* "${pkgdir}/usr/lib"
166
167 local _ver
168 _ver="$(awk "/^version[[:space:]]=/ { gsub(/'/, \"\", \$3); print \$3 }" vosk-api/java/lib/build.gradle)"
169 install -D -m644 "vosk-api/java/lib/build/libs/vosk-${_ver}.jar" "${pkgdir}/usr/share/java/vosk.jar"
170}
171
172package_python-vosk-git() {
173 pkgdesc='Python module for vosk-api (git version)'
174 depends=(
175 'python'
176 'python-cffi'
177 'python-requests'
178 'python-srt'
179 'python-tqdm'
180 'python-websockets'
181 "vosk-api-git=${pkgver}")
182 provides=('python-vosk')
183 conflicts=('python-vosk')
184
185 local _site_pkgs
186 _site_pkgs="$(python -c 'import site; print(site.getsitepackages()[0])')"
187 python -m installer --destdir="$pkgdir" vosk-api/python/dist/*.whl
188 rm "${pkgdir}${_site_pkgs}/vosk/libvosk.so"
189 ln -s ../../../libvosk.so "${pkgdir}${_site_pkgs}/vosk/libvosk.so"
190}
191

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion