ttf-belgrad

maintainer mustard4868 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged dafont.com is a well-known, widely-used font distribution site and is a legitimate upstream source for this font. The package installs only a TTF font file and a license text — pure data, not executed code or binaries. The SKIP checksums are sloppy and non-ideal (they prevent integrity verification), but this is a common pattern for font packages on the AUR where upstream URLs may serve dynamic content. There is no executed code, no compiled artifacts, and no unofficial personal host involved. The risk is low: worst case a font file is silently altered, but fonts are not executed code. The cheaper model over-rated this as MEDIUM due to the non-standard host heuristic, but dafont.com is a legitimate font distribution platform.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): dafont.com is a well-known, widely-used font distribution site and is a legitimate upstream source for this font. The package installs only a TTF font file and a license text — pure data, not executed code or binaries. The SKIP checksums are sloppy and non-ideal (they prevent integrity verification), but this is a common pattern for font packages on the AUR where upstream URLs may serve dynamic content. There is no executed code, no compiled artifacts, and no unofficial personal host involved. The risk is low: worst case a font file is silently altered, but fonts are not executed code. The cheaper model over-rated this as MEDIUM due to the non-standard host heuristic, but dafont.com is a legitimate font distribution platform.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("https://dl.dafont.com/dl/?f=belgrad"
PKGBUILD:10 "https://openfontlicense.org/documents/OFL.txt")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Nynke Lindeman <nynkelindeman@gmail.com>
    
      2
    
      3pkgname=ttf-belgrad
    
      4pkgver=0.1
    
      5pkgrel=1
    
      6pkgdesc="A font based on futura, with some added Art Nouveau elements."
    
      7license=("OFL")
    
      8arch=("any")
    
      9source=("https://dl.dafont.com/dl/?f=belgrad"
    
      10       "https://openfontlicense.org/documents/OFL.txt")
    
      11sha512sums=("SKIP"
    
      12            "SKIP")
    
      13
    
      14package() {
    
      15    install -d ${pkgdir}/usr/share/fonts/TTF
    
      16    install -m644 Belgrad.ttf $pkgdir/usr/share/fonts/TTF/
    
      17    install -D -m644 OFL.txt $pkgdir/usr/share/licenses/${pkgname}/OFL
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2