stt
LOW
maintainer orphaned
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip install in prepare() is for standard build dependencies (wheel, numpy) and occurs in a controlled build environment; the source is the official Coqui STT repository, and the installed wheel in package_python-stt() is built locally from the same source, posing no remote code execution or supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install in prepare() is for standard build dependencies (wheel, numpy) and occurs in a controlled build environment; the source is the official Coqui STT repository, and the installed wheel in package_python-stt() is built locally from the same source, posing no remote code execution or supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:22
pip install -U wheel numpy
PKGBUILD
1 offending line(s) highlighted
1
pkgbase=stt
2
pkgname=('stt' 'python-stt')
3
_pkgname=STT
4
pkgver=1.3.0
5
pkgrel=1
6
pkgdesc="Coqui-STT for inference"
7
arch=('x86_64' 'aarch64' 'armv7' 'amd64')
8
url="https://github.com/coqui-ai/STT"
9
license=('MPL2')
10
makedepends=('cmake' 'bazel' 'git' 'sox' 'wget' 'swig')
11
makedepends_x86_64=('gcc10')
12
makedepends_aarch64=('aarch64-aarch64-none-elf-gcc-10.3-bin')
13
depends=('python' 'sox')
14
source=("${_pkgname}-${pkgver}::git+https://github.com/coqui-ai/STT.git#tag=v${pkgver}")
15
sha256sums=('SKIP')
16
provides=('stt' 'python-stt')
17
conflicts=('python-stt-bin' 'stt-bin')
18
19
prepare()
20
{
21
python -m ensurepip --upgrade --default-pip
22
pip install -U wheel numpy
23
cd "$srcdir/${_pkgname}-${pkgver}"
24
git submodule sync tensorflow/
25
git submodule update --init tensorflow/
26
cd tensorflow
27
ln -sf ../native_client
28
29
}
30
31
build() {
32
cd "$srcdir/${_pkgname}-${pkgver}/tensorflow"
33
export PYTHON_BIN_PATH=/usr/bin/python
34
export USE_DEFAULT_PYTHON_LIB_PATH=1
35
export TF_NEED_OPENCL_SYCL=0
36
export TF_ENABLE_XLA=1
37
export TF_NEED_MPI=0
38
export TF_SET_ANDROID_WORKSPACE=0
39
export TF_NEED_ROCM=0
40
export TF_DOWNLOAD_CLANG=0
41
export TF_NEED_CUDA=0
42
if [[ $arch == "x86_64" ]]; then
43
export CC=/usr/bin/gcc-10
44
export CXX=/usr/bin/g++-10
45
elif [[ $arch == "aarch64" ]]; then
46
export CC=/usr/bin/aarch64-none-elf-gcc
47
export CXX=/usr/bin/aarch64-none-elf-g++
48
fi;
49
export CC_OPT_FLAGS="-march=${arch}"
50
#rm .bazelversion
51
./configure
52
53
if [[ $arch == "x86_64" ]]; then
54
bazel build \
55
--workspace_status_command="bash native_client/bazel_workspace_status_cmd.sh" \
56
-c opt \
57
--copt=-mtune=generic \
58
--copt=-march=x86-64 \
59
--copt=-msse \
60
--copt=-msse2 \
61
--copt=-msse3 \
62
--copt=-msse4.1 \
63
--copt=-msse4.2 \
64
--copt=-mavx \
65
--config=noaws \
66
--config=nogcp \
67
--config=nohdfs \
68
--config=nonccl \
69
--copt="-D_GLIBCXX_USE_CXX11_ABI=0" \
70
//native_client:libstt.so
71
elif [[ $arch == "aarch64" ]]; then
72
bazel build \
73
--workspace_status_command="bash native_client/bazel_workspace_status_cmd.sh" \
74
--config=monolithic \
75
-c opt \
76
--config=elinux_aarch64 \
77
//native_client:libstt.so
78
fi;
79
cd "${srcdir}/${_pkgname}-${pkgver}/native_client"
80
if [[ $arch == "x86_64" ]]; then
81
make stt SOX_LDFLAGS="-lsox -Wl,-no-undefined"
82
elif [[ $arch == "aarch64" ]]; then
83
make TARGET=rpi3-armv8 stt SOX_LDFLAGS="-lsox -Wl,-no-undefined"
84
fi;
85
make bindings -C python
86
#make bindings -C ctcdecode
87
}
88
89
package_stt() {
90
depends=('sox' 'python-libclang')
91
cd "${srcdir}/${_pkgname}-${pkgver}/native_client"
92
PREFIX="${pkgdir}"/usr make install
93
}
94
95
package_python-stt() {
96
pkgdesc="Coqui STT Python bindings"
97
depends=('stt' 'python-numpy')
98
cd "${srcdir}/${_pkgname}-${pkgver}/native_client"
99
PIP_CONFIG_FILE=/dev/null pip install --isolated --root="$pkgdir" --ignore-installed --no-deps python/dist/STT-*.whl
100
#PIP_CONFIG_FILE=/dev/null pip install --isolated --root="$pkgdir" --ignore-installed --no-deps ctcdecode/dist/*.whl
101
#mv "$pkgdir/usr/bin/stt" "$pkgdir/usr/bin/stt_python"
102
cp -rv "${srcdir}/${_pkgname}-${pkgver}/training/coqui_stt_training" "$pkgdir"`python -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())"`
103
}
104
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |