otf-tiro-indigo-git

maintainer dhruvasambrani · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is used to install build dependencies from a requirements.txt file in a project-owned repository; this is a normal part of building the font project from source and does not involve untrusted or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to install build dependencies from a requirements.txt file in a project-owned repository; this is a normal part of building the font project from source and does not involve untrusted or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:32 pip install --upgrade pip
PKGBUILD:33 pip install -r requirements.txt

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Your Name <youremail@domain.com>
    
      2pkgname=otf-tiro-indigo-git
    
      3pkgdesc="Tiro Indigo Indic Typefaces, based on the series of fonts for Harvard's Murty Classical Library of India. Includes Bangla (Bengali), Devanagari (Hindi, Sanskrit and Marathi variants), Gurmukhi (Punjabi), Kannada, Tamil and Telugu (built from source)"
    
      4pkgver=1.65.r0.gbb6971b # This will be dynamically updated by pkgver()
    
      5pkgrel=1
    
      6arch=('any')
    
      7url="https://github.com/TiroTypeworks/Indigo"
    
      8license=('OFL')
    
      9provides=('otf-tiro-indigo')
    
      10conflicts=('otf-tiro-indigo' 'otf-tiro-indigo-bin')
    
      11makedepends=('git' 'python' 'python-pip')
    
      12source=("${pkgname%-git}::git+https://github.com/TiroTypeworks/Indigo.git")
    
      13sha256sums=('SKIP')
    
      14
    
      15pkgver() {
    
      16  cd "$srcdir/${pkgname%-git}"
    
      17  # Dynamically generate the version based on git tags (e.g., 1.65.r0.gbb6971b)
    
      18  git describe --long --tags 2>/dev/null | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      19  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      20}
    
      21
    
      22build() {
    
      23  cd "$srcdir/${pkgname%-git}"
    
      24  
    
      25  # Create a virtual environment inside the source directory.
    
      26  # This perfectly matches the README's build instructions and safely installs 
    
      27  # complex font-building modules without dirtying your system Python environment.
    
      28  python -m venv venv
    
      29  source venv/bin/activate
    
      30  
    
      31  # Install the specific build libraries required by the developer
    
      32  pip install --upgrade pip
    
      33  pip install -r requirements.txt
    
      34  
    
      35  # Run the official python script to compile the fonts
    
      36  python tools/tirobuild.py indigo.yml
    
      37}
    
      38
    
      39package() {
    
      40  cd "$srcdir/${pkgname%-git}"
    
      41
    
      42  # Create the target directory for otf files
    
      43  local fontdir="$pkgdir/usr/share/fonts/TiroIndigo-otf"
    
      44  install -d "$fontdir"
    
      45  
    
      46  # The build script outputs fonts in multiple formats into the /output directory.
    
      47  # We use `find` to grab only the .otf files and install them to the system fonts path.
    
      48  find output -type f -name "*.otf" -exec install -m644 {} -t "$fontdir" \;
    
      49
    
      50  # Install the license. 
    
      51  # Note: Unlike the release .zip, the Git source repo uses 'LICENSES.txt'
    
      52  install -Dm644 LICENSES.txt "$pkgdir/usr/share/licenses/$pkgname/OFL.txt"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2