ttf-gallaudet

LOW

maintainer SamWhited 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Downloads a TTF font file from lifeprint.com (a well-known ASL resource site matching the package URL), which is pure non-executed data; worst case of a swapped source is a bad font, not code execution. Checksums are provided and non-SKIP.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a TTF font file from lifeprint.com (a well-known ASL resource site matching the package URL), which is pure non-executed data; worst case of a swapped source is a bad font, not code execution. Checksums are provided and non-SKIP.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://www.lifeprint.com/asl101/fingerspelling/gallaudet/GALLAUDET.ttf"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sam Whited <sam@samwhited.com>
    
      2
    
      3pkgname=ttf-gallaudet
    
      4pkgver=v0.0.1
    
      5pkgrel=1
    
      6pkgdesc="An American Sign Language and fingerspelling font."
    
      7arch=('any')
    
      8url="https://www.lifeprint.com/asl101/pages-layout/gallaudettruetypefont.htm"
    
      9license=('custom:proprietary')
    
      10source=("https://www.lifeprint.com/asl101/fingerspelling/gallaudet/GALLAUDET.ttf"
    
      11        "LICENSE")
    
      12sha256sums=('70c7e805faaec0c71e9bf057d3ec850777079671116701cff36e03fba6ff7d31'
    
      13            '9bcd26d71fe1a2c47eeb92049384abed87e781e1d6ab314e4e901b1f2af4cb60')
    
      14
    
      15package() {
    
      16  install -d ${pkgdir}/usr/share/fonts/TTF
    
      17  install -Dm644 ${srcdir}/GALLAUDET.ttf ${pkgdir}/usr/share/fonts/TTF/
    
      18
    
      19  install -Dm644 ${srcdir}/LICENSE ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      20}
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 00:23:45	Low	3
2026-10-12 13:15:42	Low	3
2026-10-12 13:13:52	Medium	2