otf-matter

maintainer tallero · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a font archive from a non-whitelisted host, but the content is non-executable font data, and the checksum is verified; the worst case of a swapped source is limited to font tampering, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a font archive from a non-whitelisted host, but the content is non-executable font data, and the checksum is verified; the worst case of a swapped source is limited to font tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${_font}.zip::https://font.gooova.com/d/14487/${_font}-font.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Pellegrino Prevete <pellegrinoprevete@gmail.com>
    
      2
    
      3_font="matter"
    
      4pkgname="otf-${_font}"
    
      5pkgver=1.021
    
      6pkgrel=1
    
      7pkgdesc="Font for designers, developers and everyone else!"
    
      8arch=(any)
    
      9url="https://displaay.net/typeface/${_font}-collection/${_font}"
    
      10license=(custom)
    
      11depends=(fontconfig)
    
      12_dl_prefix="https://font.gooova.com/storage/unpacked_archives/14487"
    
      13source=("${_font}.zip::https://font.gooova.com/d/14487/${_font}-font.zip")
    
      14sha256sums=("af915024e9a8796e4e4431985b791831462d94357aafce5d7be79b52d0031df7")
    
      15# source=(
    
      16#   "${_font}-light.zip::${_dl_prefix}/Matter-Light.otf"
    
      17#   "${_font}-light-italic.zip::${_dl_prefix}/Matter-LightItalic.otf"
    
      18#   "${_font}-regular.zip::${_dl_prefix}/Matter-Regular.otf"
    
      19#   "${_font}-regular-italic.zip::${_dl_prefix}/Matter-RegularItalic.otf"
    
      20#   "${_font}-semibold.zip::${_dl_prefix}/Matter-SemiBold.otf"
    
      21#   "${_font}-semibold-italic.zip::${_dl_prefix}/Matter-SemiBoldItalic.otf"
    
      22#   "${_font}-bold.zip::${_dl_prefix}/Matter-Bold.otf"
    
      23#   "${_font}-bold-italic.zip::${_dl_prefix}/Matter-BoldItalic.otf"
    
      24#   "${_font}-medium.zip::${_dl_prefix}/Matter-Medium.otf"
    
      25#   "${_font}-medium-italic.zip::${_dl_prefix}/Matter-MediumItalic.otf"
    
      26#   "${_font}-heavy.zip::${_dl_prefix}/Matter-Heavy.otf"
    
      27#   "${_font}-heavy-italic.zip::${_dl_prefix}/Matter-HeavyItalic.otf"
    
      28# )
    
      29# sha256sums=(
    
      30#   "05689f9aff7a8fad894e80c84c0cd23742e4320f6ba94d181396d3d7110fe8c1"
    
      31#   "01220bdc4084c2958f99320273b5a2bf45e074d196c9fc1436076ec1e476395b"
    
      32#   "dfcaeafa66e84f148ff0e6f910f0a34b4d25d0c184d05326cfbf0849abc1818c"
    
      33#   "93c872b0b2be91d022b5e925ce1f504197afd73ce4f5d2d9c7fee74224b5c299"
    
      34#   "ed8fe902e2f780b810f8162b2decafd7b998fa451198aa3d3d04bb682b42bd38"
    
      35#   "d02e445963db37b941ce1e384ab29434f2d686ea7b4c4a10e80394b33424159c"
    
      36#   "a7c6353d89c8881dfc00652c433f04a66d97297e1bc6e0ef443b2ff2ea01a6b2"
    
      37#   "0cd32a89eba560167c791ee83b1ae0df102c6bf2560a64b88cf51d9637183307"
    
      38#   "056826caaac1ba904ca1a41242b83ebad37a031d8c85acfde30b0813c65ef63d"
    
      39#   "657a4ea8bf655cb0099e96021013f00051a0c8b63724f67c975738eb549a6a9e"
    
      40#   "3fa6ac89f190a9b8a243eed4a15913833ae8cc7eab3b2b0b179c13535301c86a"
    
      41#   "c12fdc6e1f6d0e8301db083207c35e4f95d6d982be10f2dfadc78bc1f91ee894"
    
      42# )
    
      43
    
      44package() {
    
      45  local _font _fonts
    
      46  mkdir -p "$pkgdir/usr/share/fonts/matter"
    
      47  _fonts=$(find "${srcdir}" | grep "\.otf")
    
      48  for _font in "${_fonts[@]}"; do
    
      49    echo "${_font}"
    
      50    install -m644 ${_font} "$pkgdir/usr/share/fonts/matter"
    
      51  done
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2