sherpa-onnx
LOW
maintainer evine
3 votes
scanned 2026-10-03 00:23:04.761738
Why flagged
The package downloads source tarballs from GitHub, GitLab, and a mirror (hf-mirror.com) for building the software; hf-mirror.com is not whitelisted but hosts only a non-executable dependency (portaudio), and all sources are checksummed and used locally for compilation, posing minimal risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source tarballs from GitHub, GitLab, and a mirror (hf-mirror.com) for building the software; hf-mirror.com is not whitelisted but hosts only a non-executable dependency (portaudio), and all sources are checksummed and used locally for compilation, posing minimal risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
"pa_stable_v190700_20210406.tgz::https://hf-mirror.com/csukuangfj/sherpa-onnx-cmake-deps/resolve/main/pa_stable_v190700_20210406.tgz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: devome <evinedeng@hotmail.com>
2
3
pkgbase=sherpa-onnx
4
pkgname=("${pkgbase}" "python-${pkgbase}")
5
pkgver=1.13.7
6
pkgrel=2
7
pkgdesc="Speech-to-text, text-to-speech, speaker diarization, speech enhancement, source separation, and VAD using next-gen Kaldi with onnxruntime without Internet connection."
8
arch=("x86_64" "aarch64" "arm" "riscv64")
9
url="https://github.com/k2-fsa/${pkgbase}"
10
license=("Apache-2.0")
11
depends=("jack" "onnxruntime")
12
makedepends=("cargs" "cmake" "ninja" "pybind11" "python-build" "python-installer" "python-setuptools" "python-wheel")
13
source=("${pkgbase}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
14
"asio-asio-1-24-0.tar.gz::https://github.com/chriskohlhoff/asio/archive/refs/tags/asio-1-24-0.tar.gz"
15
"eigen-5.0.1.tar.gz::https://gitlab.com/libeigen/eigen/-/archive/5.0.1/eigen-5.0.1.tar.gz"
16
"espeak-ng-ed530aa113046142eb5115cf2fc9157854d0ffe1.zip::https://github.com/csukuangfj/espeak-ng/archive/ed530aa113046142eb5115cf2fc9157854d0ffe1.zip"
17
"hclust-cpp-2026-02-25.tar.gz::https://github.com/csukuangfj/hclust-cpp/archive/refs/tags/2026-02-25.tar.gz"
18
"json-3.12.0.tar.gz::https://github.com/nlohmann/json/archive/refs/tags/v3.12.0.tar.gz"
19
"kaldi-decoder-0.3.0.tar.gz::https://github.com/k2-fsa/kaldi-decoder/archive/refs/tags/v0.3.0.tar.gz"
20
"kaldi-native-fbank-1.22.3.tar.gz::https://github.com/csukuangfj/kaldi-native-fbank/archive/refs/tags/v1.22.3.tar.gz"
21
"kaldifst-1.8.0.tar.gz::https://github.com/k2-fsa/kaldifst/archive/refs/tags/v1.8.0.tar.gz"
22
"kissfft-febd4caeed32e33ad8b2e0bb5ea77542c40f18ec.zip::https://github.com/mborgerding/kissfft/archive/febd4caeed32e33ad8b2e0bb5ea77542c40f18ec.zip"
23
"openfst-1.8.5-2026-07-09.tar.gz::https://github.com/csukuangfj/openfst/archive/refs/tags/v1.8.5-2026-07-09.tar.gz"
24
"pa_stable_v190700_20210406.tgz::https://hf-mirror.com/csukuangfj/sherpa-onnx-cmake-deps/resolve/main/pa_stable_v190700_20210406.tgz"
25
"piper-phonemize-f3ff95afc03640bc1399e113e83361192a2fafb4.zip::https://github.com/csukuangfj/piper-phonemize/archive/f3ff95afc03640bc1399e113e83361192a2fafb4.zip"
26
"simple-sentencepiece-0.7.tar.gz::https://github.com/pkufool/simple-sentencepiece/archive/refs/tags/v0.7.tar.gz"
27
"websocketpp-b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip::https://github.com/zaphoyd/websocketpp/archive/b9aeec6eaf3d5610503439b4fae3581d9aff08e8.zip")
28
sha256sums=('ee0c20cafb34cc1f86afb2845babd941c26e46de4a9925cbe86fd55ff3557818'
29
'cbcaaba0f66722787b1a7c33afe1befb3a012b5af3ad7da7ff0f6b8c9b7a8a5b'
30
'e9c326dc8c05cd1e044c71f30f1b2e34a6161a3b6ecf445d56b53ff1669e3dec'
31
'e4e262cbe34f7fe21f91f1ba3397f2728e1f30eafbae7853f2b753a9ed13f0dd'
32
'8f14e024c709d73afb40ae69cb22de4b73dba67cbce40f2e518813da8139ab56'
33
'4b92eb0c06d10683f7447ce9406cb97cd4b453be18d7279320f7b2f025c10187'
34
'b9f34cfb4fd3b1344100eead79ef4d37aa15962274b9e3056de345021f76a1b0'
35
'9176cc66fc7ce1edf85cf355b06e320c57db6297df74277f575183468893cf61'
36
'3f247b7e5a2409071202f5e2bc6200060f66728c0a3443c03923ad2723e040b3'
37
'497103e664168ebe39580b757adbe616f6cf85a16572af581ca7bc42d0ab13fd'
38
'2ff712a32952fcb01d351121a6bc8ccf4fdc6b2aa06ce8df2b3095dedd518c0e'
39
'47efbf42c77c19a05d22e627d42873e991ec0c1357219c0d74ce6a2948cb2def'
40
'd9cca4e2bdc7d6dd8dffb96a4668283dbd3f77a9c194a3e530c1e8eba9406a5d'
41
'1748a822060a35baa9f6609f84efc8eb54dc0e74b9ece3d82367b7119fdc75af'
42
'1385135ede8191a7fbef9ec8099e3c5a673d48df0c143958216cd1690567f583')
43
noextract=( $(echo "${source[@]:1}" | sed -E 's|:\S+||g') )
44
45
prepare() {
46
cd "${pkgbase}-${pkgver}"
47
for file in ${noextract[@]}; do
48
ln -sf ../"${file}" "${file}"
49
done
50
sed -i "s|include(cargs)|find_package(Cargs CONFIG REQUIRED)|" c-api-examples/CMakeLists.txt
51
sed -i "s|^ .$| lib/pkgconfig|g" CMakeLists.txt
52
echo 'find_package(pybind11 REQUIRED)' > cmake/pybind11.cmake
53
echo "After upgrading onnxruntime, you need to rebuild ${pkgbase}."
54
}
55
56
build() {
57
local base_args=(
58
--compile-no-warning-as-error
59
-Wno-dev
60
-G Ninja
61
-DCMAKE_BUILD_TYPE=Release
62
-DSHERPA_ONNX_USE_PRE_INSTALLED_ONNXRUNTIME_IF_AVAILABLE=ON
63
)
64
export CFLAGS+=" -Wno-error=format-security"
65
export CXXFLAGS+=" -Wno-error=format-security"
66
67
cd "${pkgbase}-${pkgver}"
68
cmake "${base_args[@]}" \
69
-Bbuild_bin \
70
-DBUILD_SHARED_LIBS=ON \
71
-DCMAKE_INSTALL_PREFIX=/usr \
72
-DSHERPA_ONNX_ENABLE_BINARY=ON \
73
-DSHERPA_ONNX_ENABLE_PYTHON=OFF
74
cmake --build build_bin
75
76
SHERPA_ONNX_CMAKE_ARGS="${base_args[@]} -DSHERPA_ONNX_ENABLE_BINARY=OFF" python -m build --wheel --no-isolation
77
}
78
79
package_sherpa-onnx() {
80
cd "${pkgbase}-${pkgver}"
81
DESTDIR="${pkgdir}" cmake --install build_bin
82
install -Dm644 {README,CHANGELOG}.md -t "${pkgdir}/usr/share/doc/${pkgname}"
83
}
84
85
package_python-sherpa-onnx() {
86
pkgdesc+=" (Python bindings)"
87
depends=("alsa-lib" "onnxruntime" "pypinyin" "python-click" "python-onnxruntime" "python-sentencepiece")
88
89
cd "${pkgbase}-${pkgver}"
90
python -m installer --destdir="${pkgdir}" dist/*.whl
91
install -Dm644 {README,CHANGELOG}.md -t "${pkgdir}/usr/share/doc/${pkgname}"
92
}
93
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |