macos-sequoia-fonts

LOW

maintainer monsoon235 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Downloads Apple fonts from Apple's official CDN (devimages-cdn.apple.com) and builds from pinned GitHub commits; the SKIP checksums are a quality concern but the sources are plausibly official, and the installed payload is pure font data (never executed), so the realistic risk is low.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads Apple fonts from Apple's official CDN (devimages-cdn.apple.com) and builds from pinned GitHub commits; the SKIP checksums are a quality concern but the sources are plausibly official, and the installed payload is pure font data (never executed), so the realistic risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 'SF-Pro.dmg::https://devimages-cdn.apple.com/design/resources/download/SF-Pro.dmg'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: monsoon <29970829+monsoon235@users.noreply.github.com>
    
      2pkgname=macos-sequoia-fonts
    
      3pkgver=15.8.1
    
      4pkgrel=2
    
      5pkgdesc='Apple macOS Sequoia fonts from system directories, website-selected Font7, and official Apple Fonts'
    
      6arch=('any')
    
      7url='https://support.apple.com/en-eg/120414'
    
      8license=('custom:Apple')
    
      9makedepends=('gcc' 'zlib' '7zip' 'libarchive' 'python-fonttools' 'git')
    
      10depends=('fontconfig')
    
      11install=macos_sequoia_fonts.install
    
      12
    
      13# makepkg sets LANG=C while archiving; retain UTF-8 for non-ASCII font paths.
    
      14export LC_ALL=C.UTF-8
    
      15
    
      16_libneoaa_commit='c1bdecd059e4b57347f859fc7b3e7be94a4e405e'
    
      17_lzfse_commit='e634ca58b4821d9f3d560cdc6df5dec02ffc93fd'
    
      18_libzbitmap_commit='574abeae25b25c3319b9b6a9225cc7464e08ae88'
    
      19
    
      20source=(
    
      21  'build_fonts.py'
    
      22  'extract_font_files.c'
    
      23  'NOTICE.txt'
    
      24  'SF-Pro.dmg::https://devimages-cdn.apple.com/design/resources/download/SF-Pro.dmg'
    
      25  'SF-Compact.dmg::https://devimages-cdn.apple.com/design/resources/download/SF-Compact.dmg'
    
      26  'SF-Mono.dmg::https://devimages-cdn.apple.com/design/resources/download/SF-Mono.dmg'
    
      27  'SF-Arabic.dmg::https://devimages-cdn.apple.com/design/resources/download/SF-Arabic.dmg'
    
      28  'SF-Armenian.dmg::https://devimages-cdn.apple.com/design/resources/download/SF-Armenian.dmg'
    
      29  'SF-Georgian.dmg::https://devimages-cdn.apple.com/design/resources/download/SF-Georgian.dmg'
    
      30  'SF-Hebrew.dmg::https://devimages-cdn.apple.com/design/resources/download/SF-Hebrew.dmg'
    
      31  'NY.dmg::https://devimages-cdn.apple.com/design/resources/download/NY.dmg'
    
      32  "libneoaa::git+https://github.com/0xilis/libNeoAppleArchive.git#commit=${_libneoaa_commit}"
    
      33  "lzfse::git+https://github.com/lzfse/lzfse.git#commit=${_lzfse_commit}"
    
      34  "libzbitmap::git+https://github.com/eafer/libzbitmap.git#commit=${_libzbitmap_commit}"
    
      35)
    
      36noextract=('SF-Pro.dmg' 'SF-Compact.dmg' 'SF-Mono.dmg' 'SF-Arabic.dmg' 'SF-Armenian.dmg' 'SF-Georgian.dmg' 'SF-Hebrew.dmg' 'NY.dmg')
    
      37# Apple may replace the public font downloads at these stable URLs.
    
      38sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
    
      39
    
      40build() {
    
      41  python "$srcdir/build_fonts.py" build "$srcdir"
    
      42}
    
      43
    
      44package() {
    
      45  local install_root="$pkgdir/usr/share/fonts/macos-sequoia"
    
      46  install -d "$install_root" "$pkgdir/usr/share/doc/$pkgname" "$pkgdir/usr/share/licenses/$pkgname"
    
      47  cp -a "$srcdir/stage/." "$install_root/"
    
      48  python "$srcdir/build_fonts.py" fontconfig "$install_root" \
    
      49    "$pkgdir/etc/fonts/conf.d/90-macos-sequoia-internal.conf" "$srcdir/font7-dedup.tsv"
    
      50  cp -a "$srcdir/apple-font-licenses/." "$pkgdir/usr/share/licenses/$pkgname/"
    
      51  install -m 0644 "$srcdir/metadata/installed-downloadable-fonts.txt" "$srcdir/metadata/document-fonts.txt" \
    
      52    "$pkgdir/usr/share/doc/$pkgname/"
    
      53  install -m 0644 "$srcdir/NOTICE.txt" "$pkgdir/usr/share/licenses/$pkgname/NOTICE.txt"
    
      54  find "$install_root" -type d -exec chmod 0755 {} +
    
      55  find "$install_root" -type f -exec chmod 0644 {} +
    
      56}
    
      57

Changes since previous scan

--- PKGBUILD @ 2026-10-15 11:12
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
 # Maintainer: monsoon <29970829+monsoon235@users.noreply.github.com>
 pkgname=macos-sequoia-fonts
 pkgver=15.8.1
-pkgrel=1
+pkgrel=2
 pkgdesc='Apple macOS Sequoia fonts from system directories, website-selected Font7, and official Apple Fonts'
 arch=('any')
 url='https://support.apple.com/en-eg/120414'
@@ -9,6 +9,9 @@
 makedepends=('gcc' 'zlib' '7zip' 'libarchive' 'python-fonttools' 'git')
 depends=('fontconfig')
 install=macos_sequoia_fonts.install
+
+# makepkg sets LANG=C while archiving; retain UTF-8 for non-ASCII font paths.
+export LC_ALL=C.UTF-8
 
 _libneoaa_commit='c1bdecd059e4b57347f859fc7b3e7be94a4e405e'
 _lzfse_commit='e634ca58b4821d9f3d560cdc6df5dec02ffc93fd'

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 13:13:26	Low	3
2026-10-15 13:12:05	Medium	2
2026-10-15 11:12:35	Low	3
2026-10-15 11:11:38	Medium	2