vrct-git

maintainer openglfreak · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs dependencies via npm, pip, and cargo as part of building the application from its official source; the extra-index-url for PyTorch is from the official pytorch.org domain, and all actions occur during build within the project's context, posing no remote code execution or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package installs dependencies via npm, pip, and cargo as part of building the application from its official source; the extra-index-url for PyTorch is from the official pytorch.org domain, and all actions occur during build within the project's context, posing no remote code execution or supply-chain risk.

4 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:133 npm install vite

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:137 with_pyenv python3 -m pip install --upgrade pip
PKGBUILD:138 with_pyenv python3 -m pip install --prefer-binary --extra-index-url "https://download.pytorch.org/whl/${_torch_platform:-cpu}" -r requirements.txt

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:141 cargo install tauri-cli

MEDIUM Package install from an untrusted index/registry host install_untrusted_index

An install command is pointed at a custom package index / registry on a non-allowlisted host (--index-url / --registry / --extra-index-url), a classic dependency-confusion vector.

PKGBUILD:138 with_pyenv python3 -m pip install --prefer-binary --extra-index-url "https://download.pytorch.org/whl/${_torch_platform:-cpu}" -r requirements.txt

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Reyka Matthies <openglfreak at googlemail dot com>
    
      2
    
      3#_torch_platform=cu130
    
      4#_torch_platform=rocm7.2
    
      5_torch_platform=cpu
    
      6_vendored_portaudio=true
    
      7
    
      8_name='VRCT'
    
      9_pkgname='vrct'
    
      10pkgname="$_pkgname-git"
    
      11pkgver=3.4.3
    
      12pkgrel=1
    
      13pkgdesc='VRChat Chatbox Translator & Transcription (Git version)'
    
      14arch=('x86_64')
    
      15url='https://misyaguziya.github.io/VRCT-Docs/'
    
      16license=('MIT')
    
      17_tauri_depends=('cairo' 'desktop-file-utils' 'gdk-pixbuf2' 'glib2' 'gtk3' 'libsoup' 'pango' 'webkit2gtk-4.1' 'appmenu-gtk-module')
    
      18_python_depends=('libsqlite3.so' 'libuuid.so' 'libbz2.so' 'libexpat.so' 'libffi.so' 'libnsl.so' 'libcrypt.so' 'libssl.so' 'libz.so' 'libzstd.so' 'tzdata' 'mpdecimal')
    
      19depends=("${_tauri_depends[@]}" "${_python_depends[@]}" 'hicolor-icon-theme')
    
      20makedepends=('npm' 'pyenv' 'cargo' 'git' 'autoconf-archive' 'automake')
    
      21conflicts=("$_pkgname")
    
      22provides=("$_pkgname")
    
      23source=("git+https://github.com/misyaguziya/VRCT.git"
    
      24        '0001-Fix-Make-spec-files-platform-agnostic.patch'
    
      25        '0002-Fix-Fix-logo-SVG-reference-on-case-sensitive-file-sy.patch'
    
      26        '0003-Fix-Fix-requirements.txt-on-systems-without-PyAudioW.patch'
    
      27        '0004-Fix-Do-not-crash-in-recorder-or-transcriber-if-PyAud.patch'
    
      28        '0005-Fix-Support-microphone-input-on-systems-without-PyAu.patch'
    
      29        '0006-Feat-Support-speaker-input-on-systems-that-have-Puls.patch'
    
      30        '0007-Fix-Use-XDG-base-directories-for-config-and-logs-on-.patch'
    
      31        '0008-Fix-Download-models-to-data-dir-instead-of-local-dir.patch'
    
      32        '0009-Fix-Use-correct-program-to-open-folder-on-each-opera.patch'
    
      33        '0010-Feat-Allow-building-Tauri-App-AppImage.patch'
    
      34        '0011-Fix-Fix-error-when-running-PyInstaller.patch'
    
      35        '0012-Fix-Ignore-stderr-output-from-alsa-lib.patch'
    
      36        'disable-updater.patch'
    
      37        'vrct.sh'
    
      38        'VRCT.desktop')
    
      39sha256sums=('SKIP'
    
      40            '9525773077fad654d5ad2293ccdd7730d4629c6ebf2064de67d03aca76ca870d'
    
      41            'dc5c95c0f5aed4d12870462f892ca574601c1d241cf5e70f54e6efaf9001ff3b'
    
      42            'e857d9ddb87b784c56122c53d9eb89ccbfcc5e211f6831b4159e3fe11095f5da'
    
      43            '6e05fca2f60b8026b51981f31446b2b2011b5461f959ec1c82129e7bda51ee6d'
    
      44            'cd6b79fc8da541d071f0072a55fed5005331706a5c70ae9e4c22ef6855983599'
    
      45            'a18f9ede8e089258603a79e3fba57a45f2f98289af9e09713fdc05c6bf87b47a'
    
      46            'a8ccb61517a2dd9dc8bc8807f01ead65134cf3dbd66cf976ec3226ea4575e733'
    
      47            '8f304819765df67513008b9f234efd52277206da2033827fad21b0a195692391'
    
      48            '6ac6e6dba2bf9829228886c9b6fc422ca89183412f04c3d9c3666226cd23cb1b'
    
      49            'ce3d700ce4a3e20077537a7dbb3befb45b172089d12c2eb0cc0b51a057a46219'
    
      50            '841a9fd040ba0d3691a0c5bd6cb6c53fe5a27dc2bb5f04c5af1bdf508b5d69f3'
    
      51            'f6ec0daf4271b649618b6e7bddc79b5ba1e433b1a32c333b903f09b53ebc20ae'
    
      52            'c6495d8530a36b4dab9a92c264c6e532a00d9d9a658145422c1fa78a61ab4692'
    
      53            '31722c9cff0ad36cee5a81b68eda86b9b30463e743f44561ea31df4078b85d91'
    
      54            '82438e4c5fa472144badef10b1dbdcdbf5313e079af46e23231be43e9c6b18cd')
    
      55b2sums=('SKIP'
    
      56        'cad6a467d8a181150062095d39ff5eff746fa90e7edca57da43e17b9c25b5371e6934ff08844c0b55feb02473a567fb9a55187738416eb3c4fdc12f82c7a3943'
    
      57        'dcb7152de750dc57fe188f43b4ef7d6bc24a9184862169a948da62523c7b509e4396780f7102d89bf9e31ba30f0e4b755db0bb8358c832e207ab069f176c50f3'
    
      58        'f0bc24ec33df831aadd9e614e3099d5749fbdcaf9979c0c78c0f0ee91a108790afa35c813e6ca195b65ff67f50fc1758092fbba5cf06af2f420ffe74111e4cf4'
    
      59        '8b0d2b8f9c8a6db7db70ccfc06980ce54ab04ae42ee4026cf38b72d02fc44a6f002c5ba5acba197fa61d3fcdb65c90a2afc471c5bcb4aff2296edd187e8f52cc'
    
      60        'f6202b7c24220f36f59a512abb9757f8c0f9bea35d3064f6f13a22e56245e614a2f453ed43a10e6b9e3baa20a944104d7a6dafb6385d57741281f60093efafb5'
    
      61        '1202055efdf0f49de8b192d45a0e16ecf88d5c07fac9eb9cc73961ed18cc84eff2088da36afeb870cdab4611a161394ef7714f01f800fb6cdbdd4c3608d6e983'
    
      62        '837bc2b7c3ee843235bec818e8a2f5188188626f42295bfb38e28d7bda11018add1dbfcebe8c7fb2fd5186a3a0b25f7b8534df28272dc7b00390050ae1606422'
    
      63        'c3910e5fb01d5ba65e8abc040e7ed16c3f37cc02f72c403bd36600d87550505188c6c893efdfff986a9bb5e0111aa917f2b8993522603487061d7c48c6668705'
    
      64        'ff68ca012f313d25a84577f8a6567bb71720624dee36b0e54b522dae89ba53aa51c8d7aac6e082cd3a442aa58e94fb574f76aa5d4b1ae9036b716b3f3bc88ac3'
    
      65        '5439e25390165985cd687e3e5bdb999c9d806d8dd4d8e78077d0d2d3269f6aee8099899b45966974a7d8d4d64b8631725fdd9decb6cef10bdf4544517a524c6b'
    
      66        '2676b344946aa8be35a5cc1f3f822bebb2365fa44b1fae317f1820b6377a0d7c676ebda1e05b3caef8218494febf7ec774712a0392c42c31ef950b22b129a4e6'
    
      67        '8414836083602c01510b26021811dc01c08872dbb40ad5c1f62f2065601ed8052af0c959a166f9f882430b60d02338be4cab43156112b801dbddebf935e3def8'
    
      68        '7bb8301814751a6b75f2ee0ded34084b5705c7af8fe56f2cf0b259f153a952b0fae7e0f877b8a4739a194e4c4ab490bcd13d69b678e7ebf369e7f8198a790b9c'
    
      69        'cc661ecd970724a77af1278ab20d7d3eafc22119fb94ff7e310ee3eeb68af67d8c88d9e1e38c49117b8a45fbaedef4a506798cbc63214370a76105877b24763d'
    
      70        'ba6c3b3b03b860665f4db26609ca70ddf678acd79b85a62285d1b512431e7aca312118721fb808721fdadeced146443020808548adce825fb22a4f7e954a1816')
    
      71
    
      72if [ "${_vendored_portaudio:-}" = true ] && ! [ "${GENINTEG:-}" = 1 ]; then
    
      73    depends+=('libasound.so' 'libsndio.so' 'libjack.so' 'libpulse.so')
    
      74    source+=("git+https://github.com/PortAudio/portaudio.git")
    
      75    : && sha256sums+=('SKIP')
    
      76    : && b2sums+=('SKIP')
    
      77else
    
      78    depends+=('libportaudio.so')
    
      79fi
    
      80
    
      81if check_option 'lto' 'y'; then
    
      82    export CARGO_PROFILE_RELEASE_LTO=true CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
    
      83fi
    
      84if check_option 'debug' 'y'; then
    
      85    export CARGO_PROFILE_RELEASE_DEBUG=2
    
      86fi
    
      87
    
      88pkgver() {
    
      89    git -C VRCT log -1 --tags --pretty="format:%(describe:tags)" | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      90}
    
      91
    
      92with_pyenv() (
    
      93    export PYENV_VERSION=3.12
    
      94    . "$srcdir/$_name/.venv/bin/activate"
    
      95    exec "$@"
    
      96)
    
      97
    
      98prepare() {
    
      99    if [ "${_vendored_portaudio:-}" = true ]; then
    
      100        cd "$srcdir/portaudio"
    
      101
    
      102        (
    
      103            cd bindings/cpp
    
      104            autoreconf -fiv
    
      105        )
    
      106        autoreconf -fiv
    
      107    fi
    
      108
    
      109    cd "$srcdir/$_name"
    
      110
    
      111    for patch in ../*.patch; do
    
      112        msg2 "$(gettext "Applying patch file %s")" "${patch#../}"
    
      113        patch -Np1 -i "$patch"
    
      114    done
    
      115
    
      116    patch -Np1 <<'EOF'
    
      117diff --git a/spec/backend.spec b/spec/backend.spec
    
      118index e53f29ce..81e82b7d 100644
    
      119--- a/spec/backend.spec
    
      120+++ b/spec/backend.spec
    
      121@@ -24,6 +24,7 @@ a = Analysis(
    
      122     noarchive=False,
    
      123     optimize=0,
    
      124 )
    
      125+a.exclude_system_libraries()
    
      126 pyz = PYZ(a.pure)
    
      127 
    
      128 try:
    
      129EOF
    
      130
    
      131    npm install --omit=dev
    
      132    npm audit fix --omit=dev --force
    
      133    npm install vite
    
      134
    
      135    pyenv install --skip-existing 3.12
    
      136    PYENV_VERSION=3.12 pyenv exec python3 -m venv .venv
    
      137    with_pyenv python3 -m pip install --upgrade pip
    
      138    with_pyenv python3 -m pip install --prefer-binary --extra-index-url "https://download.pytorch.org/whl/${_torch_platform:-cpu}" -r requirements.txt
    
      139
    
      140    export RUSTUP_TOOLCHAIN=stable
    
      141    cargo install tauri-cli
    
      142    cd src-tauri
    
      143    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      144    cd ..
    
      145}
    
      146
    
      147build() {
    
      148    if [ "${_vendored_portaudio:-}" = true ]; then
    
      149        cd "$srcdir/portaudio"
    
      150
    
      151        local configure_options=(
    
      152            --prefix="/opt/$_pkgname/_internal"
    
      153            --libdir="/opt/$_pkgname/_internal"
    
      154            --includedir="/portaudio_include"
    
      155            --enable-cxx
    
      156        )
    
      157
    
      158        ./configure "${configure_options[@]}"
    
      159        make -j1
    
      160    fi
    
      161
    
      162    cd "$srcdir/$_name"
    
      163
    
      164    npm run vite build
    
      165
    
      166    mkdir .venv/Lib
    
      167    ln -s ../lib/python3.12/site-packages -t .venv/Lib
    
      168    with_pyenv python3 -m PyInstaller spec/backend.spec --distpath src-tauri/bin --clean --noconfirm --log-level ERROR
    
      169
    
      170    export CFLAGS+=' -ffat-lto-objects'
    
      171    export RUSTUP_TOOLCHAIN=stable
    
      172    cd src-tauri
    
      173    cargo tauri build --no-bundle
    
      174    cd ..
    
      175
    
      176    find src-tauri/target/release/_internal -type f -name '*.so' -exec chrpath --replace "\$ORIGIN:/opt/$_pkgname/_internal" \{\} \;
    
      177    find src-tauri/target/release/_internal -type f -name '*.so.*' -exec chrpath --replace "\$ORIGIN:/opt/$_pkgname/_internal" \{\} \;
    
      178}
    
      179
    
      180package() {
    
      181    install -d -Dm755 "$pkgdir/opt"
    
      182    install -d -Dm755 "$pkgdir/opt/$_pkgname"
    
      183    if [ "${_vendored_portaudio:-}" = true ]; then
    
      184        make -C "$srcdir/portaudio" DESTDIR="$pkgdir" install
    
      185        rm -r "$pkgdir/opt/vrct/_internal/pkgconfig"
    
      186        rm -r "$pkgdir/portaudio_include"
    
      187    fi
    
      188    install -Dm755 "$srcdir/$_name/src-tauri/target/release/VRCT" -t "$pkgdir/opt/$_pkgname"
    
      189    install -Dm755 "$srcdir/$_name/src-tauri/target/release/VRCT-sidecar" -t "$pkgdir/opt/$_pkgname"
    
      190    cp -a "$srcdir/$_name/src-tauri/target/release/_internal" -t "$pkgdir/opt/$_pkgname"
    
      191    install -d -Dm755 "$pkgdir/usr"
    
      192    install -d -Dm755 "$pkgdir/usr/bin"
    
      193    install -Dm755 "$srcdir/$_pkgname.sh" "$pkgdir/usr/bin/$_pkgname"
    
      194    install -d -Dm755 "$pkgdir/usr/share"
    
      195    install -d -Dm755 "$pkgdir/usr/share/applications"
    
      196    install -Dm644 VRCT.desktop -t "$pkgdir/usr/share/applications"
    
      197    install -d -Dm755 "$pkgdir/usr/share/icons"
    
      198    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor"
    
      199    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor/32x32"
    
      200    install -Dm644 "$srcdir/$_name/src-tauri/icons/32x32.png" "$pkgdir/usr/share/icons/hicolor/32x32/apps/$_pkgname.png"
    
      201    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor/128x128"
    
      202    install -Dm644 "$srcdir/$_name/src-tauri/icons/128x128.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/$_pkgname.png"
    
      203    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor/256x256"
    
      204    install -Dm644 "$srcdir/$_name/src-tauri/icons/128x128@2x.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/$_pkgname.png"
    
      205    install -Dm644 "$srcdir/$_name/src-tauri/icons/icon.ico" "$pkgdir/usr/share/icons/hicolor/256x256/apps/$_pkgname.ico"
    
      206    install -d -Dm755 "$pkgdir/usr/share/icons/hicolor/512x512"
    
      207    install -Dm644 "$srcdir/$_name/src-tauri/icons/icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_pkgname.png"
    
      208    install -d -Dm755 "$pkgdir/usr/share/licenses"
    
      209    install -d -Dm755 "$pkgdir/usr/share/licenses/$pkgname"
    
      210    install -Dm644 "$srcdir/$_name/LICENSE" -t "$pkgdir/usr/share/licenses/$pkgname"
    
      211}
    
      212

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	5
2026-08-02 00:16:08	LOW	5
2026-08-01 00:11:18	LOW	5
2026-07-31 00:14:10	LOW	5
2026-07-30 00:17:23	LOW	5
2026-07-29 00:25:53	LOW	5
2026-07-28 00:07:28	LOW	5
2026-07-27 00:24:32	LOW	5
2026-07-26 00:07:32	LOW	5
2026-07-25 00:13:44	LOW	5
2026-07-24 00:02:28	LOW	5
2026-07-23 00:14:47	LOW	5
2026-07-22 00:29:32	LOW	5
2026-07-21 00:24:15	LOW	5
2026-07-20 00:19:49	LOW	5
2026-07-19 00:17:08	LOW	5
2026-07-18 00:14:48	LOW	5
2026-07-17 00:06:16	LOW	5
2026-07-16 00:05:41	LOW	5
2026-07-15 00:09:25	LOW	5