ttf-crewniverse

maintainer tyzoid · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a font file from a maintainer-hosted URL; while the host is non-standard, fonts are static data and cannot execute code, limiting worst-case impact to non-malicious data substitution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package installs a font file from a maintainer-hosted URL; while the host is non-standard, fonts are static data and cannot execute code, limiting worst-case impact to non-malicious data substitution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://dl.tyzoid.com/arch/package-dl/$pkgname-v$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tyler Dence <tyzoid@archlinux32.org>
    
      2
    
      3pkgname=ttf-crewniverse
    
      4pkgver=0.5
    
      5pkgrel=1
    
      6pkgdesc="Crewniverse is a font that replicates the one used for the title cards of the TV show Steven Universe(tm), as well as the logo of the Steven Crewniverse's Tumblr (hence the name, originally)."
    
      7arch=('any')
    
      8url="https://www.deviantart.com/art/Crewniverse-Font-V-5-MORE-ACCENTS-AND-SYMBOLS-540122768"
    
      9license=('Unknown proprietary')
    
      10depends=('fontconfig' 'xorg-fonts-encodings' 'xorg-font-utils')
    
      11source=("https://dl.tyzoid.com/arch/package-dl/$pkgname-v$pkgver.tar.gz")
    
      12sha512sums=('9adfe3224b89ee5f0b70a0b0048b1b8c7845cdbcf412bce17ee9c3049df0e3bedfeb81f41bc217ae657a578b3f4bc2e01d9676332ee062884b56d78a0b67b170')
    
      13
    
      14package() {
    
      15	install -d $pkgdir/usr/share/fonts/TTF/ 
    
      16	install -Dm644 "$srcdir/$pkgname-v$pkgver/crewniverse_font.ttf" "$pkgdir/usr/share/fonts/TTF/Crewniverse.ttf"
    
      17}
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2