voicetype-bin

maintainer aldervall · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads a model file (ggml-base.en.bin) from huggingface.co, a non-whitelisted but legitimate and widely trusted host for machine learning models; the file is data, not executable code, and is used locally by the application, posing minimal supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a model file (ggml-base.en.bin) from huggingface.co, a non-whitelisted but legitimate and widely trusted host for machine learning models; the file is data, not executable code, and is used locally by the application, posing minimal supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:28 "ggml-base.en.bin::https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-base.en.bin"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Niklas Aldervall <aldervall@users.noreply.github.com>
2pkgname=voicetype-bin
3pkgver=1.5.3
4pkgrel=2
5pkgdesc='Local English voice transcription using whisper.cpp with hold-to-speak daemon'
6arch=('x86_64')
7url='https://github.com/aldervall/Voicetype'
8license=('MIT')
9depends=(
10 'python'
11 'python-requests'
12 'python-sounddevice'
13 'python-scipy'
14 'python-numpy'
15 'python-evdev'
16)
17optdepends=(
18 'ydotool: for auto-paste in daemon mode (recommended)'
19 'wl-clipboard: clipboard support on Wayland'
20 'xclip: clipboard support on X11'
21 'libnotify: desktop notifications'
22 'pulseaudio: audio feedback beeps'
23)
24provides=('voicetype')
25conflicts=('voicetype')
26source=(
27 "$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz"
28 "ggml-base.en.bin::https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-base.en.bin"
29)
30sha256sums=('d8f05fd160f05633b35121c735e99b00301ae6853954ca377e955fb494607337'
31 'a03779c86df3323075f5e796cb2ce5029f00ec8869eee3fdfb897afe36c6d002')
32install=voicetype.install
33
34package() {
35 cd "$srcdir/Voicetype-$pkgver"
36
37 # Install Python modules
38 install -dm755 "$pkgdir/usr/lib/voicetype"
39 install -Dm644 src/*.py -t "$pkgdir/usr/lib/voicetype/"
40 install -Dm644 src/config.py "$pkgdir/usr/lib/voicetype/config.py"
41
42 # Install whisper-server binary
43 install -dm755 "$pkgdir/usr/lib/voicetype/whisper/bin"
44 install -Dm755 .whisper/bin/whisper-server-linux-x64 \
45 "$pkgdir/usr/lib/voicetype/whisper/bin/whisper-server"
46
47 # Install helper scripts
48 install -dm755 "$pkgdir/usr/lib/voicetype/whisper/scripts"
49 install -Dm755 .whisper/scripts/*.sh -t "$pkgdir/usr/lib/voicetype/whisper/scripts/"
50
51 # Install whisper model (downloaded during build)
52 install -dm755 "$pkgdir/usr/lib/voicetype/whisper/models"
53 install -Dm644 "$srcdir/ggml-base.en.bin" "$pkgdir/usr/lib/voicetype/whisper/models/ggml-base.en.bin"
54
55 # Install sound files for audio feedback
56 install -dm755 "$pkgdir/usr/lib/voicetype/sounds"
57 install -Dm644 sounds/*.wav -t "$pkgdir/usr/lib/voicetype/sounds/"
58
59 # Install launcher scripts
60 install -Dm755 /dev/stdin "$pkgdir/usr/bin/voicetype-daemon" <<'EOF'
61#!/bin/bash
62# VoiceType daemon launcher
63cd /usr/lib
64exec python -m voicetype.voice_holdtospeak "$@"
65EOF
66
67 install -Dm755 /dev/stdin "$pkgdir/usr/bin/voicetype-input" <<'EOF'
68#!/bin/bash
69# VoiceType one-shot voice input
70cd /usr/lib
71exec python -m voicetype.voice_to_text "$@"
72EOF
73
74 install -Dm755 /dev/stdin "$pkgdir/usr/bin/voicetype-stop-server" <<'EOF'
75#!/bin/bash
76# Stop whisper.cpp server
77pkill -f "whisper-server" && echo "Whisper server stopped" || echo "No server running"
78EOF
79
80 # Install systemd user service
81 install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/voicetype-daemon.service" <<'EOF'
82[Unit]
83Description=VoiceType Hold-to-Speak Daemon
84After=graphical-session.target
85
86[Service]
87Type=simple
88ExecStart=/usr/bin/voicetype-daemon
89Restart=on-failure
90RestartSec=5
91
92[Install]
93WantedBy=default.target
94EOF
95
96 # Install license
97 install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
98
99 # Install documentation
100 install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
101}
102

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion