fonts-komorebi-gothic

LOW

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs font files from a non-whitelisted but project-plausible host; fonts are non-executable data, so the worst case of a swapped source is limited to data tampering, not code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs font files from a non-whitelisted but project-plausible host; fonts are non-executable data, so the worst case of a swapped source is limited to data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=(http://modi.jpn.org/download/MODI_komorebi-gothic_${_zipver}.zip)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Piano Nekomiya <kotone.olin1010@gmail.com>
    
      2# Contributor: Piano Nekomiya <kotone.olin1010@gmail.com>
    
      3
    
      4pkgname=fonts-komorebi-gothic
    
      5pkgver=20180501
    
      6_zipver=2018_0501
    
      7pkgrel=2
    
      8pkgdesc="Komorebi Gothic Japanese outline fonts"
    
      9arch=('any')
    
      10url="http://modi.jpn.org/font_komorebi-gothic.php"
    
      11license=('custom')
    
      12depends=('fontconfig')
    
      13source=(http://modi.jpn.org/download/MODI_komorebi-gothic_${_zipver}.zip)
    
      14sha256sums=('SKIP')
    
      15
    
      16package() {
    
      17  cd ${srcdir}/MODI_komorebi-gothic_${_zipver}
    
      18  install -d ${pkgdir}/usr/share/fonts/KomorebiGothic
    
      19  install -vm644 *.ttf ${pkgdir}/usr/share/fonts/KomorebiGothic/
    
      20  install -Dvm644 /dev/stdin  ${pkgdir}/usr/share/licenses/${pkgname}/COPYING << END
    
      21これらのフォントはフリー（自由な）ソフトウエアです。あらゆる改変の有無に関わらず、また商業的な利用であっても、自由にご利用、複製、再配布することができますが、全て無保証とさせていただきます。
    
      22These fonts are free software. Unlimited permission is granted to use, copy, and distribute it, with or without modification, either commercially and noncommercially. THESE FONTS ARE PROVIDED "AS IS" WITHOUT WARRANTY.
    
      23END
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2