gfontview

maintainer bidulock · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from SourceForge and an old freetype version from a personal server to patch into the build; while the freetype host is non-standard, it is used only for building and not executed directly, limiting supply-chain risk to the build integrity of an old library, which is a low-severity concern.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from SourceForge and an old freetype version from a personal server to patch into the build; while the freetype host is non-standard, it is used only for building and not executed directly, limiting supply-chain risk to the build integrity of an old library, which is a low-severity concern.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "http://games.linux.sk/files/freetype-1.3.1.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Brian Bidulock <bidulock@openss7.org>
    
      2# Contributor: ezzetabi <ezzetabi@gawab.com>
    
      3pkgname=gfontview
    
      4pkgver=0.5.0
    
      5pkgrel=4
    
      6pkgdesc="An outline font viewer for Linux."
    
      7arch=(i686 x86_64)
    
      8url="http://gfontview.sourceforge.net/"
    
      9license=('GPL')
    
      10groups=()
    
      11depends=('giflib4' 'gtk' 't1lib')
    
      12makedepends=('cups' 'patchelf')
    
      13optdepends=()
    
      14provides=()
    
      15conflicts=()
    
      16replaces=()
    
      17backup=()
    
      18options=('!emptydirs')
    
      19install=
    
      20changelog=ChangeLog
    
      21source=("http://downloads.sourceforge.net/project/$pkgname/$pkgname/$pkgver/$pkgname-$pkgver.tar.gz"
    
      22  "http://games.linux.sk/files/freetype-1.3.1.tar.gz"
    
      23)
    
      24noextract=()
    
      25
    
      26build() {
    
      27  cd "$srcdir"/freetype-1.3.1/lib
    
      28  gcc -Os -c -Iarch/ansi -I. arch/ansi/freetype.c
    
      29  mv freetype.o "$srcdir/$pkgname-$pkgver"
    
      30  cp freetype.h "$srcdir/$pkgname-$pkgver"
    
      31  cp fterrid.h "$srcdir/$pkgname-$pkgver"
    
      32  cp ftnameid.h "$srcdir/$pkgname-$pkgver"
    
      33  cd extend
    
      34  gcc -Os -c -I../arch/ansi -I.. ftxerr18.c
    
      35  cp ftxerr18.h "$srcdir/$pkgname-$pkgver"
    
      36  gcc -Os -c -I../arch/ansi -I.. ftxkern.c
    
      37  cp ftxkern.h "$srcdir/$pkgname-$pkgver"
    
      38  gcc -Os -c -I../arch/ansi -I.. ftxpost.c
    
      39  cp ftxpost.h "$srcdir/$pkgname-$pkgver"
    
      40  mv *.o "$srcdir/$pkgname-$pkgver"
    
      41
    
      42  cd "$srcdir/$pkgname-$pkgver"
    
      43
    
      44  #ignore freetype v1 failure, we will inject it.
    
      45  sed -i configure -e '/TrueType/ d'
    
      46
    
      47  #C++ does not allow using the enum keyword that way.
    
      48  sed -i gfont.C -e '1106 s_enum__'
    
      49  sed -i dialogs.C -e '1330 s_enum__'
    
      50
    
      51  #gcc does not manage multi-line string literals since... long ago.
    
      52  sed -i ps.h -e 's_\\$__'
    
      53  sed -i ps.h -e '/const char/,/;$/ { /const char/b; /;$/b; s_^\|$_"_g }'
    
      54  sed -i ps.h -e '/^[^"]*"[^"]*$/ s_"__'
    
      55
    
      56  #Oh come on... I cannot believe it never crashed on you...
    
      57  #the sed lines sound crazy, but I just have to swap line 336 and 337.
    
      58  sed -i dialogs.C -ne '
    
      59   334!{p;d;}
    
      60   h;n;:1
    
      61   335!{N;b1}
    
      62   G;h;n;p;g;p'
    
      63  sed -i dialogs.C -ne '
    
      64   334!{p;d;}
    
      65   h;n;:1
    
      66   336!{N;b1}
    
      67   G;h;n;p;g;p'
    
      68  CPPFLAGS="-I/usr/include/giflib4" LDFLAGS="-L/usr/lib/giflib4" ./configure  --prefix=/usr --enable-gnome=no --disable-nls
    
      69
    
      70  #We inject the old freetype
    
      71  sed -i Makefile -e '/^gfontview_OBJECTS *=/ s_$_ freetype.o ftxerr18.o ftxkern.o ftxpost.o_'
    
      72
    
      73  make || return 1
    
      74}
    
      75package() {
    
      76  cd "$srcdir/$pkgname-$pkgver"
    
      77  make DESTDIR="$pkgdir/" applicationsdir='${datadir}/applications' install
    
      78  install -m755 -d "$pkgdir"/usr/share/ghostscript/fonts
    
      79  strip "$pkgdir"/usr/bin/gfontview
    
      80  patchelf --set-rpath /usr/lib/giflib4 "$pkgdir"/usr/bin/gfontview
    
      81}
    
      82
    
      83md5sums=('f06e0e9d67f7d8b3af251fa593e83eeb'
    
      84         '9a9e7ad00c1ef6dfbf8f8e19ceefb300')
    
      85
    
      86# vim:set ts=2 sw=2 et:
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2