vrct

maintainer openglfreak · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source and installs declared dependencies; the pip and npm installs are part of the project's build process using its own requirements.txt and package.json, and the PyTorch index is an official vendor domain, posing no supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source and installs declared dependencies; the pip and npm installs are part of the project's build process using its own requirements.txt and package.json, and the PyTorch index is an official vendor domain, posing no supply-chain risk.

4 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:127 npm install vite

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:131 with_pyenv python3 -m pip install --upgrade pip
PKGBUILD:132 with_pyenv python3 -m pip install --prefer-binary --extra-index-url "https://download.pytorch.org/whl/${_torch_platform:-cpu}" -r requirements.txt

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:135 cargo install tauri-cli

MEDIUM Package install from an untrusted index/registry host install_untrusted_index

An install command is pointed at a custom package index / registry on a non-allowlisted host (--index-url / --registry / --extra-index-url), a classic dependency-confusion vector.

PKGBUILD:132 with_pyenv python3 -m pip install --prefer-binary --extra-index-url "https://download.pytorch.org/whl/${_torch_platform:-cpu}" -r requirements.txt

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Reyka Matthies <openglfreak at googlemail dot com>
    
      2
    
      3#_torch_platform=cu130
    
      4#_torch_platform=rocm7.2
    
      5_torch_platform=cpu
    
      6_vendored_portaudio=true
    
      7
    
      8_name='VRCT'
    
      9pkgname='vrct'
    
      10pkgver=3.4.3
    
      11pkgrel=1
    
      12pkgdesc='VRChat Chatbox Translator & Transcription'
    
      13arch=('x86_64')
    
      14url='https://misyaguziya.github.io/VRCT-Docs/'
    
      15license=('MIT')
    
      16_tauri_depends=('cairo' 'desktop-file-utils' 'gdk-pixbuf2' 'glib2' 'gtk3' 'libsoup' 'pango' 'webkit2gtk-4.1' 'appmenu-gtk-module')
    
      17_python_depends=('libsqlite3.so' 'libuuid.so' 'libbz2.so' 'libexpat.so' 'libffi.so' 'libnsl.so' 'libcrypt.so' 'libssl.so' 'libz.so' 'libzstd.so' 'tzdata' 'mpdecimal')
    
      18depends=("${_tauri_depends[@]}" "${_python_depends[@]}" 'hicolor-icon-theme')
    
      19makedepends=('npm' 'pyenv' 'cargo' 'autoconf-archive' 'automake')
    
      20_portaudio_commit=b0fe9de7ec86ebe5a26086f1d662ab74d7ebfae4
    
      21source=("$_name-$pkgver.tar.gz::https://github.com/misyaguziya/VRCT/archive/refs/tags/v$pkgver.tar.gz"
    
      22        '0001-Fix-Make-spec-files-platform-agnostic.patch'
    
      23        '0002-Fix-Fix-logo-SVG-reference-on-case-sensitive-file-sy.patch'
    
      24        '0003-Fix-Fix-requirements.txt-on-systems-without-PyAudioW.patch'
    
      25        '0004-Fix-Do-not-crash-in-recorder-or-transcriber-if-PyAud.patch'
    
      26        '0005-Fix-Support-microphone-input-on-systems-without-PyAu.patch'
    
      27        '0006-Feat-Support-speaker-input-on-systems-that-have-Puls.patch'
    
      28        '0007-Fix-Use-XDG-base-directories-for-config-and-logs-on-.patch'
    
      29        '0008-Fix-Download-models-to-data-dir-instead-of-local-dir.patch'
    
      30        '0009-Fix-Use-correct-program-to-open-folder-on-each-opera.patch'
    
      31        '0010-Feat-Allow-building-Tauri-App-AppImage.patch'
    
      32        '0011-Fix-Fix-error-when-running-PyInstaller.patch'
    
      33        '0012-Fix-Ignore-stderr-output-from-alsa-lib.patch'
    
      34        'disable-updater.patch'
    
      35        'vrct.sh'
    
      36        'VRCT.desktop')
    
      37sha256sums=('6fd90892c27d79f5e8c44a087885d05d81f47cbb9e41e0c53bd51808f6c38dfa'
    
      38            '9525773077fad654d5ad2293ccdd7730d4629c6ebf2064de67d03aca76ca870d'
    
      39            'dc5c95c0f5aed4d12870462f892ca574601c1d241cf5e70f54e6efaf9001ff3b'
    
      40            'e857d9ddb87b784c56122c53d9eb89ccbfcc5e211f6831b4159e3fe11095f5da'
    
      41            '6e05fca2f60b8026b51981f31446b2b2011b5461f959ec1c82129e7bda51ee6d'
    
      42            'cd6b79fc8da541d071f0072a55fed5005331706a5c70ae9e4c22ef6855983599'
    
      43            'a18f9ede8e089258603a79e3fba57a45f2f98289af9e09713fdc05c6bf87b47a'
    
      44            'a8ccb61517a2dd9dc8bc8807f01ead65134cf3dbd66cf976ec3226ea4575e733'
    
      45            '8f304819765df67513008b9f234efd52277206da2033827fad21b0a195692391'
    
      46            '6ac6e6dba2bf9829228886c9b6fc422ca89183412f04c3d9c3666226cd23cb1b'
    
      47            'ce3d700ce4a3e20077537a7dbb3befb45b172089d12c2eb0cc0b51a057a46219'
    
      48            '841a9fd040ba0d3691a0c5bd6cb6c53fe5a27dc2bb5f04c5af1bdf508b5d69f3'
    
      49            'f6ec0daf4271b649618b6e7bddc79b5ba1e433b1a32c333b903f09b53ebc20ae'
    
      50            'c6495d8530a36b4dab9a92c264c6e532a00d9d9a658145422c1fa78a61ab4692'
    
      51            '31722c9cff0ad36cee5a81b68eda86b9b30463e743f44561ea31df4078b85d91'
    
      52            '82438e4c5fa472144badef10b1dbdcdbf5313e079af46e23231be43e9c6b18cd')
    
      53b2sums=('0e8991c859ab8622362bc58fc6ad4e1a0a0382feac8021bb2a1754dd45e7407faeb493c89bec31196b1f1d2169cb2027ab58e5d55311e633155ba279d77384fc'
    
      54        'cad6a467d8a181150062095d39ff5eff746fa90e7edca57da43e17b9c25b5371e6934ff08844c0b55feb02473a567fb9a55187738416eb3c4fdc12f82c7a3943'
    
      55        'dcb7152de750dc57fe188f43b4ef7d6bc24a9184862169a948da62523c7b509e4396780f7102d89bf9e31ba30f0e4b755db0bb8358c832e207ab069f176c50f3'
    
      56        'f0bc24ec33df831aadd9e614e3099d5749fbdcaf9979c0c78c0f0ee91a108790afa35c813e6ca195b65ff67f50fc1758092fbba5cf06af2f420ffe74111e4cf4'
    
      57        '8b0d2b8f9c8a6db7db70ccfc06980ce54ab04ae42ee4026cf38b72d02fc44a6f002c5ba5acba197fa61d3fcdb65c90a2afc471c5bcb4aff2296edd187e8f52cc'
    
      58        'f6202b7c24220f36f59a512abb9757f8c0f9bea35d3064f6f13a22e56245e614a2f453ed43a10e6b9e3baa20a944104d7a6dafb6385d57741281f60093efafb5'
    
      59        '1202055efdf0f49de8b192d45a0e16ecf88d5c07fac9eb9cc73961ed18cc84eff2088da36afeb870cdab4611a161394ef7714f01f800fb6cdbdd4c3608d6e983'
    
      60        '837bc2b7c3ee843235bec818e8a2f5188188626f42295bfb38e28d7bda11018add1dbfcebe8c7fb2fd5186a3a0b25f7b8534df28272dc7b00390050ae1606422'
    
      61        'c3910e5fb01d5ba65e8abc040e7ed16c3f37cc02f72c403bd36600d87550505188c6c893efdfff986a9bb5e0111aa917f2b8993522603487061d7c48c6668705'
    
      62        'ff68ca012f313d25a84577f8a6567bb71720624dee36b0e54b522dae89ba53aa51c8d7aac6e082cd3a442aa58e94fb574f76aa5d4b1ae9036b716b3f3bc88ac3'
    
      63        '5439e25390165985cd687e3e5bdb999c9d806d8dd4d8e78077d0d2d3269f6aee8099899b45966974a7d8d4d64b8631725fdd9decb6cef10bdf4544517a524c6b'
    
      64        '2676b344946aa8be35a5cc1f3f822bebb2365fa44b1fae317f1820b6377a0d7c676ebda1e05b3caef8218494febf7ec774712a0392c42c31ef950b22b129a4e6'
    
      65        '8414836083602c01510b26021811dc01c08872dbb40ad5c1f62f2065601ed8052af0c959a166f9f882430b60d02338be4cab43156112b801dbddebf935e3def8'
    
      66        '7bb8301814751a6b75f2ee0ded34084b5705c7af8fe56f2cf0b259f153a952b0fae7e0f877b8a4739a194e4c4ab490bcd13d69b678e7ebf369e7f8198a790b9c'
    
      67        'cc661ecd970724a77af1278ab20d7d3eafc22119fb94ff7e310ee3eeb68af67d8c88d9e1e38c49117b8a45fbaedef4a506798cbc63214370a76105877b24763d'
    
      68        'ba6c3b3b03b860665f4db26609ca70ddf678acd79b85a62285d1b512431e7aca312118721fb808721fdadeced146443020808548adce825fb22a4f7e954a1816')
    
      69
    
      70if [ "${_vendored_portaudio:-}" = true ] && ! [ "${GENINTEG:-}" = 1 ]; then
    
      71    depends+=('libasound.so' 'libsndio.so' 'libjack.so' 'libpulse.so')
    
      72    source+=("portaudio-$_portaudio_commit.tar.gz::https://github.com/PortAudio/portaudio/archive/$_portaudio_commit.tar.gz")
    
      73    : && sha256sums+=('b64ebc99216f260f035e010d4f8812a8646f82cb906bc5ff0850c8cb88c9f1e0')
    
      74    : && b2sums+=('2b903163aa7468dcbd6987b5ef28a8c41dd2b40943d4db93d028b4d9b786f0677f7fad1adaf3a42603f485b6ac3ff7f43cf19430074dc02745b484530c7b23ad')
    
      75else
    
      76    depends+=('libportaudio.so')
    
      77fi
    
      78
    
      79if check_option 'lto' 'y'; then
    
      80    export CARGO_PROFILE_RELEASE_LTO=true CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
    
      81fi
    
      82if check_option 'debug' 'y'; then
    
      83    export CARGO_PROFILE_RELEASE_DEBUG=2
    
      84fi
    
      85
    
      86with_pyenv() (
    
      87    export PYENV_VERSION=3.12
    
      88    . "$srcdir/$_name-$pkgver/.venv/bin/activate"
    
      89    exec "$@"
    
      90)
    
      91
    
      92prepare() {
    
      93    if [ "${_vendored_portaudio:-}" = true ]; then
    
      94        cd "$srcdir/portaudio-$_portaudio_commit"
    
      95
    
      96        (
    
      97            cd bindings/cpp
    
      98            autoreconf -fiv
    
      99        )
    
      100        autoreconf -fiv
    
      101    fi
    
      102
    
      103    cd "$srcdir/$_name-$pkgver"
    
      104
    
      105    for patch in ../*.patch; do
    
      106        msg2 "$(gettext "Applying patch file %s")" "${patch#../}"
    
      107        patch -Np1 -i "$patch"
    
      108    done
    
      109
    
      110    patch -Np1 <<'EOF'
    
      111diff --git a/spec/backend.spec b/spec/backend.spec
    
      112index e53f29ce..81e82b7d 100644
    
      113--- a/spec/backend.spec
    
      114+++ b/spec/backend.spec
    
      115@@ -24,6 +24,7 @@ a = Analysis(
    
      116     noarchive=False,
    
      117     optimize=0,
    
      118 )
    
      119+a.exclude_system_libraries()
    
      120 pyz = PYZ(a.pure)
    
      121 
    
      122 try:
    
      123EOF
    
      124
    
      125    npm install --omit=dev
    
      126    npm audit fix --omit=dev --force
    
      127    npm install vite
    
      128
    
      129    pyenv install --skip-existing 3.12
    
      130    PYENV_VERSION=3.12 pyenv exec python3 -m venv .venv
    
      131    with_pyenv python3 -m pip install --upgrade pip
    
      132    with_pyenv python3 -m pip install --prefer-binary --extra-index-url "https://download.pytorch.org/whl/${_torch_platform:-cpu}" -r requirements.txt
    
      133
    
      134    export RUSTUP_TOOLCHAIN=stable
    
      135    cargo install tauri-cli
    
      136    cd src-tauri
    
      137    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      138    cd ..
    
      139}
    
      140
    
      141build() {
    
      142    if [ "${_vendored_portaudio:-}" = true ]; then
    
      143        cd "$srcdir/portaudio-$_portaudio_commit"
    
      144
    
      145        local configure_options=(
    
      146            --prefix="/opt/$pkgname/_internal"
    
      147            --libdir="/opt/$pkgname/_internal"
    
      148            --includedir="/portaudio_include"
    
      149            --enable-cxx
    
      150        )
    
      151
    
      152        ./configure "${configure_options[@]}"
    
      153        make -j1
    
      154    fi
    
      155
    
      156    cd "$srcdir/$_name-$pkgver"
    
      157
    
      158    npm run vite build
    
      159
    
      160    mkdir .venv/Lib
    
      161    ln -s ../lib/python3.12/site-packages -t .venv/Lib
    
      162    with_pyenv python3 -m PyInstaller spec/backend.spec --distpath src-tauri/bin --clean --noconfirm --log-level ERROR
    
      163
    
      164    export CFLAGS+=' -ffat-lto-objects'
    
      165    export RUSTUP_TOOLCHAIN=stable
    
      166    cd src-tauri
    
      167    cargo tauri build --no-bundle
    
      168    cd ..
    
      169
    
      170    find src-tauri/target/release/_internal -type f -name '*.so' -exec chrpath --replace "\$ORIGIN:/opt/$_pkgname/_internal" \{\} \;
    
      171    find src-tauri/target/release/_internal -type f -name '*.so.*' -exec chrpath --replace "\$ORIGIN:/opt/$_pkgname/_internal" \{\} \;
    
      172}
    
      173
    
      174package() {
    
      175    install -d -Dm755 "$pkgdir/opt"
    
      176    install -d -Dm755 "$pkgdir/opt/$pkgname"
    
      177    if [ "${_vendored_portaudio:-}" = true ]; then
    
      178        make -C "$srcdir/portaudio-$_portaudio_commit" DESTDIR="$pkgdir" install
    
      179        rm -r "$pkgdir/opt/vrct/_internal/pkgconfig"
    
      180        rm -r "$pkgdir/portaudio_include"
    
      181    fi
    
      182    install -Dm755 "$srcdir/$_name-$pkgver/src-tauri/target/release/VRCT" -t "$pkgdir/opt/$pkgname"
    
      183    install -Dm755 "$srcdir/$_name-$pkgver/src-tauri/target/release/VRCT-sidecar" -t "$pkgdir/opt/$pkgname"
    
      184    cp -a "$srcdir/$_name-$pkgver/src-tauri/target/release/_internal" -t "$pkgdir/opt/$pkgname"
    
      185    install -d -Dm755 "$pkgdir/usr"
    
      186    install -d -Dm755 "$pkgdir/usr/bin"
    
      187    install -Dm755 "$srcdir/$pkgname.sh" "$pkgdir/usr/bin/$pkgname"
    
      188    install -d -Dm755 "$pkgdir/usr/share"
    
      189    install -d -Dm755 "$pkgdir/usr/share/applications"
    
      190    install -Dm644 VRCT.desktop -t "$pkgdir/usr/share/applications"
    
      191    install -d -Dm755 "$pkgdir/usr/share/icons"
    
      192    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor"
    
      193    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor/32x32"
    
      194    install -Dm644 "$srcdir/$_name-$pkgver/src-tauri/icons/32x32.png" "$pkgdir/usr/share/icons/hicolor/32x32/apps/$pkgname.png"
    
      195    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor/128x128"
    
      196    install -Dm644 "$srcdir/$_name-$pkgver/src-tauri/icons/128x128.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/$pkgname.png"
    
      197    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor/256x256"
    
      198    install -Dm644 "$srcdir/$_name-$pkgver/src-tauri/icons/128x128@2x.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.png"
    
      199    install -Dm644 "$srcdir/$_name-$pkgver/src-tauri/icons/icon.ico" "$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.ico"
    
      200    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor/512x512"
    
      201    install -Dm644 "$srcdir/$_name-$pkgver/src-tauri/icons/icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
    
      202    install -d -Dm755 "$pkgdir/usr/share/licenses"
    
      203    install -d -Dm755 "$pkgdir/usr/share/licenses/$pkgname"
    
      204    install -Dm644 "$srcdir/$_name-$pkgver/LICENSE" -t "$pkgdir/usr/share/licenses/$pkgname"
    
      205}
    
      206

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	5
2026-08-02 00:16:08	LOW	5
2026-08-01 00:11:18	LOW	5
2026-07-31 00:14:10	LOW	5
2026-07-30 00:17:23	LOW	5
2026-07-29 00:25:53	LOW	5
2026-07-28 00:07:28	LOW	5
2026-07-27 00:24:32	LOW	5
2026-07-26 00:07:32	LOW	5
2026-07-25 00:13:44	LOW	5
2026-07-24 00:02:28	LOW	5
2026-07-23 00:14:47	LOW	5
2026-07-22 00:29:32	LOW	5
2026-07-21 00:24:15	LOW	5
2026-07-20 00:19:49	LOW	5
2026-07-19 00:17:08	LOW	5
2026-07-18 00:14:48	LOW	5
2026-07-17 00:06:16	LOW	5
2026-07-16 00:05:41	LOW	5
2026-07-15 00:09:25	LOW	5