sherpa-onnx

maintainer evine · 3 votes · scanned 2026-08-18 07:39:23.787586

MEDIUM

Why flagged One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "pa_stable_v190700_20210406.tgz::http://files.portaudio.com/archives/pa_stable_v190700_20210406.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: devome <evinedeng@hotmail.com>
    
      2
    
      3pkgbase=sherpa-onnx
    
      4pkgname=("${pkgbase}" "python-${pkgbase}")
    
      5pkgver=1.13.6
    
      6pkgrel=1
    
      7pkgdesc="Speech-to-text, text-to-speech, speaker diarization, speech enhancement, source separation, and VAD using next-gen Kaldi with onnxruntime without Internet connection."
    
      8arch=("x86_64" "aarch64" "arm" "riscv64")
    
      9url="https://github.com/k2-fsa/${pkgbase}"
    
      10license=("Apache-2.0")
    
      11depends=("jack" "onnxruntime")
    
      12makedepends=("cargs" "cmake" "ninja" "pybind11" "python-build" "python-installer" "python-setuptools" "python-wheel")
    
      13source=("${pkgbase}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      14        "asio-asio-1-24-0.tar.gz::https://github.com/chriskohlhoff/asio/archive/refs/tags/asio-1-24-0.tar.gz"
    
      15        "eigen-5.0.1.tar.gz::https://gitlab.com/libeigen/eigen/-/archive/5.0.1/eigen-5.0.1.tar.gz"
    
      16        "espeak-ng-ed530aa113046142eb5115cf2fc9157854d0ffe1.zip::https://github.com/csukuangfj/espeak-ng/archive/ed530aa113046142eb5115cf2fc9157854d0ffe1.zip"
    
      17        "hclust-cpp-2026-02-25.tar.gz::https://github.com/csukuangfj/hclust-cpp/archive/refs/tags/2026-02-25.tar.gz"
    
      18        "json-3.12.0.tar.gz::https://github.com/nlohmann/json/archive/refs/tags/v3.12.0.tar.gz"
    
      19        "kaldi-decoder-0.3.0.tar.gz::https://github.com/k2-fsa/kaldi-decoder/archive/refs/tags/v0.3.0.tar.gz"
    
      20        "kaldi-native-fbank-1.22.3.tar.gz::https://github.com/csukuangfj/kaldi-native-fbank/archive/refs/tags/v1.22.3.tar.gz"
    
      21        "kaldifst-1.8.0.tar.gz::https://github.com/k2-fsa/kaldifst/archive/refs/tags/v1.8.0.tar.gz"
    
      22        "kissfft-febd4caeed32e33ad8b2e0bb5ea77542c40f18ec.zip::https://github.com/mborgerding/kissfft/archive/febd4caeed32e33ad8b2e0bb5ea77542c40f18ec.zip"
    
      23        "openfst-1.8.5-2026-07-09.tar.gz::https://github.com/csukuangfj/openfst/archive/refs/tags/v1.8.5-2026-07-09.tar.gz"
    
      24        "pa_stable_v190700_20210406.tgz::http://files.portaudio.com/archives/pa_stable_v190700_20210406.tgz"
    
      25        "piper-phonemize-f3ff95afc03640bc1399e113e83361192a2fafb4.zip::https://github.com/csukuangfj/piper-phonemize/archive/f3ff95afc03640bc1399e113e83361192a2fafb4.zip"
    
      26        "simple-sentencepiece-0.7.tar.gz::https://github.com/pkufool/simple-sentencepiece/archive/refs/tags/v0.7.tar.gz"
    
      27        "websocketpp-b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip::https://github.com/zaphoyd/websocketpp/archive/b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip")
    
      28sha256sums=('78f5d10f957d2de1867a1e08395e9ec2ec388911c853dd141887396667f3ff34'
    
      29            'cbcaaba0f66722787b1a7c33afe1befb3a012b5af3ad7da7ff0f6b8c9b7a8a5b'
    
      30            'e9c326dc8c05cd1e044c71f30f1b2e34a6161a3b6ecf445d56b53ff1669e3dec'
    
      31            'e4e262cbe34f7fe21f91f1ba3397f2728e1f30eafbae7853f2b753a9ed13f0dd'
    
      32            '8f14e024c709d73afb40ae69cb22de4b73dba67cbce40f2e518813da8139ab56'
    
      33            '4b92eb0c06d10683f7447ce9406cb97cd4b453be18d7279320f7b2f025c10187'
    
      34            'b9f34cfb4fd3b1344100eead79ef4d37aa15962274b9e3056de345021f76a1b0'
    
      35            '9176cc66fc7ce1edf85cf355b06e320c57db6297df74277f575183468893cf61'
    
      36            '3f247b7e5a2409071202f5e2bc6200060f66728c0a3443c03923ad2723e040b3'
    
      37            '497103e664168ebe39580b757adbe616f6cf85a16572af581ca7bc42d0ab13fd'
    
      38            '2ff712a32952fcb01d351121a6bc8ccf4fdc6b2aa06ce8df2b3095dedd518c0e'
    
      39            '47efbf42c77c19a05d22e627d42873e991ec0c1357219c0d74ce6a2948cb2def'
    
      40            'd9cca4e2bdc7d6dd8dffb96a4668283dbd3f77a9c194a3e530c1e8eba9406a5d'
    
      41            '1748a822060a35baa9f6609f84efc8eb54dc0e74b9ece3d82367b7119fdc75af'
    
      42            '1385135ede8191a7fbef9ec8099e3c5a673d48df0c143958216cd1690567f583')
    
      43noextract=( $(echo "${source[@]:1}" | sed -E 's|:\S+||g') )
    
      44
    
      45prepare() {
    
      46    cd "${pkgbase}-${pkgver}"
    
      47    for file in ${noextract[@]}; do
    
      48        ln -sf ../"${file}" "${file}"
    
      49    done
    
      50    sed -i "s|include(cargs)|find_package(Cargs CONFIG REQUIRED)|" c-api-examples/CMakeLists.txt
    
      51    sed -i "s|^    .$|    lib/pkgconfig|g" CMakeLists.txt
    
      52    echo 'find_package(pybind11 REQUIRED)' > cmake/pybind11.cmake
    
      53    echo "After upgrading onnxruntime, you need to rebuild ${pkgbase}."
    
      54}
    
      55
    
      56build() {
    
      57    local base_args=(
    
      58        --compile-no-warning-as-error
    
      59        -Wno-dev
    
      60        -G Ninja
    
      61        -DCMAKE_BUILD_TYPE=Release
    
      62        -DSHERPA_ONNX_USE_PRE_INSTALLED_ONNXRUNTIME_IF_AVAILABLE=ON
    
      63    )
    
      64    export CFLAGS+=" -Wno-error=format-security"
    
      65    export CXXFLAGS+=" -Wno-error=format-security"
    
      66
    
      67    cd "${pkgbase}-${pkgver}"
    
      68    cmake "${base_args[@]}" \
    
      69        -Bbuild_bin \
    
      70        -DBUILD_SHARED_LIBS=ON \
    
      71        -DCMAKE_INSTALL_PREFIX=/usr \
    
      72        -DSHERPA_ONNX_ENABLE_BINARY=ON \
    
      73        -DSHERPA_ONNX_ENABLE_PYTHON=OFF
    
      74    cmake --build build_bin
    
      75    
    
      76    SHERPA_ONNX_CMAKE_ARGS="${base_args[@]} -DSHERPA_ONNX_ENABLE_BINARY=OFF" python -m build --wheel --no-isolation
    
      77}
    
      78
    
      79package_sherpa-onnx() {
    
      80    cd "${pkgbase}-${pkgver}"
    
      81    DESTDIR="${pkgdir}" cmake --install build_bin
    
      82    install -Dm644 {README,CHANGELOG}.md -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      83}
    
      84
    
      85package_python-sherpa-onnx() {
    
      86    pkgdesc+=" (Python bindings)"
    
      87    depends=("alsa-lib" "onnxruntime" "pypinyin" "python-click" "python-onnxruntime" "python-sentencepiece")
    
      88
    
      89    cd "${pkgbase}-${pkgver}"
    
      90    python -m installer --destdir="${pkgdir}" dist/*.whl
    
      91    install -Dm644 {README,CHANGELOG}.md -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      92}
    
      93

Changes since previous scan

--- PKGBUILD @ 2026-08-12 00:27
+++ PKGBUILD @ 2026-08-18 07:39
@@ -2,13 +2,13 @@
 
 pkgbase=sherpa-onnx
 pkgname=("${pkgbase}" "python-${pkgbase}")
-pkgver=1.13.5
+pkgver=1.13.6
 pkgrel=1
 pkgdesc="Speech-to-text, text-to-speech, speaker diarization, speech enhancement, source separation, and VAD using next-gen Kaldi with onnxruntime without Internet connection."
 arch=("x86_64" "aarch64" "arm" "riscv64")
 url="https://github.com/k2-fsa/${pkgbase}"
 license=("Apache-2.0")
-depends=("jack" "onnxruntime" "protobuf")
+depends=("jack" "onnxruntime")
 makedepends=("cargs" "cmake" "ninja" "pybind11" "python-build" "python-installer" "python-setuptools" "python-wheel")
 source=("${pkgbase}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
         "asio-asio-1-24-0.tar.gz::https://github.com/chriskohlhoff/asio/archive/refs/tags/asio-1-24-0.tar.gz"
@@ -25,7 +25,7 @@
         "piper-phonemize-f3ff95afc03640bc1399e113e83361192a2fafb4.zip::https://github.com/csukuangfj/piper-phonemize/archive/f3ff95afc03640bc1399e113e83361192a2fafb4.zip"
         "simple-sentencepiece-0.7.tar.gz::https://github.com/pkufool/simple-sentencepiece/archive/refs/tags/v0.7.tar.gz"
         "websocketpp-b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip::https://github.com/zaphoyd/websocketpp/archive/b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip")
-sha256sums=('99f520db7364a06be0c174a385d03f9ccdbfe08f61146055229e4a990e285262'
+sha256sums=('78f5d10f957d2de1867a1e08395e9ec2ec388911c853dd141887396667f3ff34'
             'cbcaaba0f66722787b1a7c33afe1befb3a012b5af3ad7da7ff0f6b8c9b7a8a5b'
             'e9c326dc8c05cd1e044c71f30f1b2e34a6161a3b6ecf445d56b53ff1669e3dec'
             'e4e262cbe34f7fe21f91f1ba3397f2728e1f30eafbae7853f2b753a9ed13f0dd'
@@ -50,6 +50,7 @@
     sed -i "s|include(cargs)|find_package(Cargs CONFIG REQUIRED)|" c-api-examples/CMakeLists.txt
     sed -i "s|^    .$|    lib/pkgconfig|g" CMakeLists.txt
     echo 'find_package(pybind11 REQUIRED)' > cmake/pybind11.cmake
+    echo "After upgrading onnxruntime, you need to rebuild ${pkgbase}."
 }
 
 build() {
@@ -83,7 +84,7 @@
 
 package_python-sherpa-onnx() {
     pkgdesc+=" (Python bindings)"
-    depends=("python-click" "python-onnxruntime")
+    depends=("alsa-lib" "onnxruntime" "pypinyin" "python-click" "python-onnxruntime" "python-sentencepiece")
 
     cd "${pkgbase}-${pkgver}"
     python -m installer --destdir="${pkgdir}" dist/*.whl

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 07:39:23	MEDIUM	1
2026-08-12 00:27:08	CLEAN	2
2026-08-11 15:21:23	MEDIUM	1
2026-07-08 00:26:52	CLEAN	2
2026-07-07 17:25:23	MEDIUM	1
2026-07-07 15:25:04	MEDIUM	1
2026-06-19 22:34:54	CLEAN	2