fonts-cjk-sc-yrdzst

maintainer taotieren · 1 votes · base fonts-cjk · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads and installs font files from a plausibly project-owned Gitee repository; fonts are non-executable data files, so even with an unverifiable checksum and non-whitelisted host, the worst-case impact of a swapped source is limited to cosmetic or data-level tampering.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads and installs font files from a plausibly project-owned Gitee repository; fonts are non-executable data files, so even with an unverifiable checksum and non-whitelisted host, the worst-case impact of a swapped source is limited to cosmetic or data-level tampering.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:15 source=("${pkgbase}"'::git+https://gitee.com/atzlinux/fonts-zh-cn-business-free-atzlinux.git')

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: taotieren <admin@taotieren.com>
2
3pkgbase=fonts-cjk
4pkgname=($pkgbase{,-jp-seto,-sc-{zcool,pangmenzhengdao,huxiaobo,yrdzst,opposans,baotuxiaobaiti,shoushuti,youshe,zhenyangb},-tc-qingsongshouxieti})
5pkgver=r17.6c32da2
6pkgrel=15
7arch=(any)
8url='https://gitee.com/atzlinux/fonts-zh-cn-business-free-atzlinux'
9license=(LicenseRef-custom)
10#provides=()
11#conflicts=()
12depends=()
13makedepends=('git')
14
15source=("${pkgbase}"'::git+https://gitee.com/atzlinux/fonts-zh-cn-business-free-atzlinux.git')
16
17sha256sums=('SKIP')
18
19pkgver() {
20 cd "${srcdir}/${pkgbase}/"
21 # git describe --long --tags | sed 's/v//g;s/\([^-]*-g\)/r\1/;s/-/./g'
22 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
23}
24
25package_fonts-cjk() {
26 export LC_CTYPE="zh_CN.UTF-8"
27 pkgdesc="Linux 下的免费商用字体包"
28 install -dm755 "${pkgdir}/usr/share" \
29 "${pkgdir}/usr/share"
30 cp -r "${srcdir}/${pkgbase}/usr/share/fonts" "${pkgdir}/usr/share"
31 cp -r "${srcdir}/${pkgbase}/usr/share/doc" "${pkgdir}/usr/share"
32}
33
34package_fonts-cjk-jp-seto() {
35 export LC_CTYPE="zh_CN.UTF-8"
36 pkgdesc="濑户字型由日本的一位业余字体设计师 瀬戸のぞみ小姐 制作。"
37 install -dm755 "${pkgdir}/usr/share/fonts/truetype/" \
38 "${pkgdir}/usr/share/doc/"
39 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/setofont-free" "${pkgdir}/usr/share/fonts/truetype"
40 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-setofont-free" "${pkgdir}/usr/share/doc"
41}
42
43package_fonts-cjk-sc-zcool() {
44 export LC_CTYPE="zh_CN.UTF-8"
45 pkgdesc="zcool 酷站 7 款字体"
46 install -dm755 "${pkgdir}/usr/share/fonts/opentype/" \
47 "${pkgdir}/usr/share/fonts/truetype/" \
48 "${pkgdir}/usr/share/doc/"
49 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/opentype/zcool-free" "${pkgdir}/usr/share/fonts/opentype"
50 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/zcool-free" "${pkgdir}/usr/share/fonts/truetype"
51 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-zcool-free-all" "${pkgdir}/usr/share/doc"
52}
53
54package_fonts-cjk-sc-pangmenzhengdao() {
55 export LC_CTYPE="zh_CN.UTF-8"
56 pkgdesc="这款字体由《庞门正道》设计公众号以及 13 位字体设计师耗资超过 10 万元联合研发。"
57 install -dm755 "${pkgdir}/usr/share/fonts/opentype/" \
58 "${pkgdir}/usr/share/fonts/truetype/" \
59 "${pkgdir}/usr/share/doc/"
60 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/opentype/pangmenzhengdao-free" "${pkgdir}/usr/share/fonts/opentype"
61 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/pangmenzhengdao-free" "${pkgdir}/usr/share/fonts/truetype"
62 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-pangmenzhengdao-free" "${pkgdir}/usr/share/doc"
63}
64
65package_fonts-cjk-sc-huxiaobo() {
66 export LC_CTYPE="zh_CN.UTF-8"
67 pkgdesc="设计师胡晓波的 3 款字体"
68 install -dm755 "${pkgdir}/usr/share/fonts/opentype/" \
69 "${pkgdir}/usr/share/doc/"
70 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/opentype/huxiaobo" "${pkgdir}/usr/share/fonts/opentype"
71 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-huxiaobo" "${pkgdir}/usr/share/doc"
72}
73
74package_fonts-cjk-sc-yrdzst() {
75 export LC_CTYPE="zh_CN.UTF-8"
76 pkgdesc="杨润东竹石体:本套字体授权全社会免费商用,意味着您可以将其无限制地捆入您的商业产品中,如海报、包装、logo、网页、APP 等"
77 install -dm755 "${pkgdir}/usr/share/fonts/truetype/" \
78 "${pkgdir}/usr/share/doc"
79 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/yrdzst-free" "${pkgdir}/usr/share/fonts/truetype"
80 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-rydzst-free" "${pkgdir}/usr/share/doc"
81}
82
83package_fonts-cjk-sc-opposans() {
84 export LC_CTYPE="zh_CN.UTF-8"
85 pkgdesc="OPPO Sans(含中文及西文,6 款字重)允许个人或企业免费使用,含商业用途,版权归 OPPO 广东移动通信有限公司所有。"
86 install -dm755 "${pkgdir}/usr/share/fonts/truetype/" \
87 "${pkgdir}/usr/share/doc"
88 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/oppo" "${pkgdir}/usr/share/fonts/truetype"
89 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-opposans" "${pkgdir}/usr/share/doc"
90}
91
92package_fonts-cjk-sc-baotuxiaobaiti() {
93 export LC_CTYPE="zh_CN.UTF-8"
94 pkgdesc="包图小白体:定义为一款简单可爱的创意字体。"
95 install -dm755 "${pkgdir}/usr/share/fonts/truetype/" \
96 "${pkgdir}/usr/share/doc"
97 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/baotuxiaobaiti-free" "${pkgdir}/usr/share/fonts/truetype"
98 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-baotuxiaobaiti-free" "${pkgdir}/usr/share/doc"
99}
100
101package_fonts-cjk-sc-shoushuti() {
102 export LC_CTYPE="zh_CN.UTF-8"
103 pkgdesc="智勇手书体:该免费字体授予全社会所有人可应用于:所有商用范围"
104 install -dm755 "${pkgdir}/usr/share/fonts/truetype/" \
105 "${pkgdir}/usr/share/doc"
106 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/shoushuti-free" "${pkgdir}/usr/share/fonts/truetype"
107 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-shoushuti-free" "${pkgdir}/usr/share/doc"
108}
109
110package_fonts-cjk-sc-youshe() {
111 export LC_CTYPE="zh_CN.UTF-8"
112 pkgdesc="优设标题黑:是一款适用性广,速度感、力量感极强的专业美术标题字体。"
113 install -dm755 "${pkgdir}/usr/share/fonts/truetype/business-free-zh/" \
114 "${pkgdir}/usr/share/doc"
115 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/business-free-zh/YouSheBiaoTiHei.ttf" "${pkgdir}/usr/share/fonts/truetype/business-free-zh"
116 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-youshe" "${pkgdir}/usr/share/doc"
117}
118
119package_fonts-cjk-sc-zhenyangb() {
120 export LC_CTYPE="zh_CN.UTF-8"
121 pkgdesc="锐字真言体:该免费字体授予全社会所有人可应用于: 所有商业使用范围"
122 install -dm755 "${pkgdir}/usr/share/fonts/truetype/" \
123 "${pkgdir}/usr/share/doc"
124 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/zhenyangb-free" "${pkgdir}/usr/share/fonts/truetype"
125 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-zhenyangb-free" "${pkgdir}/usr/share/doc"
126}
127
128package_fonts-cjk-tc-qingsongshouxieti() {
129 export LC_CTYPE="zh_CN.UTF-8"
130 pkgdesc="清松手写体的版权归开发者游清松所有,但开放给所有人免费使用(包含商业使用)。"
131 install -dm755 "${pkgdir}/usr/share/fonts/truetype/business-free-zh/" \
132 "${pkgdir}/usr/share/doc"
133 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/business-free-zh/QingSongShouXieTi1-2.ttf" "${pkgdir}/usr/share/fonts/truetype/business-free-zh"
134 cp -r "${srcdir}/${pkgbase}/usr/share/fonts/truetype/business-free-zh/QingSongShouXieTi2-2.ttf" "${pkgdir}/usr/share/fonts/truetype/business-free-zh"
135 cp -r "${srcdir}/${pkgbase}/usr/share/doc/fonts-qingsongshouxieti-free" "${pkgdir}/usr/share/doc"
136}
137
138# vim: ts=4 sw=4 et
139

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion