ttf-google-sans-hinted

MEDIUM
maintainer gaougalos 0 votes scanned 2026-10-29 13:52:19.945196
View on AUR
Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:18 'fonts.tar.gz::https://flutter.googlesource.com/gallery-assets/+archive/refs/heads/master/lib/fonts.tar.gz'

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: gaou-piou <i.am.piou@gmail.com>
2# Contributor: GCMarvin <GCMarvin@users.noreply.github.com>
3
4pkgname=ttf-google-sans-hinted
5_nfver=3.4.0
6pkgver=1
7pkgrel=2
8pkgdesc="Google Sans fonts (GoogleSans, GoogleSansDisplay), optionally Nerd Fonts patched and/or ttfautohint hinted"
9url='https://flutter.googlesource.com/gallery-assets'
10arch=('any')
11license=('custom')
12makedepends=('python' 'python-fonttools' 'parallel' 'fontforge' 'ttfautohint')
13options=(!strip !zipman)
14conflicts=('ttf-google-sans')
15provides=('ttf-google-sans' 'ttf-font-nerd')
16
17source=(
18 'fonts.tar.gz::https://flutter.googlesource.com/gallery-assets/+archive/refs/heads/master/lib/fonts.tar.gz'
19 "font-patcher-${_nfver}::https://github.com/ryanoasis/nerd-fonts/releases/download/v${_nfver}/FontPatcher.zip"
20 'make_features.py'
21)
22sha256sums=('SKIP' 'SKIP'
23 '0723caa5f49782372701905a5acbc577cb7437a87fd30d9b30524a499a505632')
24
25# ── Build-time options (all settable via env vars) ──────────────────────────
26#
27# NERD_PATCH true/false Patch fonts with Nerd Fonts glyphs (default: false)
28#
29# HINTING true/false Apply ttfautohint (default: false)
30#
31# HINT_MODE nnn|qqq|qsq|sss 3-char stem-width mode string for ttfautohint:
32# pos1=grayscale pos2=GDI ClearType pos3=DW ClearType
33# n=natural q=quantized s=strong
34# nnn=HiDPI qqq=balanced sss=aggressive low-DPI
35#
36# Font family selection:
37# WANT_GOOGLE_SANS true/false (default: true)
38# WANT_GOOGLE_SANS_DISPLAY true/false (default: true)
39#
40# FEATURE_DEFAULTS "tag,tag,..." (default: empty = leave the fonts alone)
41# Bake these GSUB features into the font's 'calt' feature, so
42# that EVERY renderer applies them, not only pango (see the
43# note below). Environment only: there is no prompt, because
44# this font has almost nothing worth baking. Audit of
45# GoogleSans-Regular.ttf, shaping every codepoint with each
46# feature on and off:
47# case 52 subs, but it is NOT mild: it raises ( ) [ ] { }
48# to capital height AND turns every digit into a
49# .cap (cap-height) digit: "100%" -> one.cap
50# zero.cap zero.cap percent.cap. Not a default.
51# ss01 one sub: * -> asterisk.num (numeral height)
52# ss02 one sub: : -> colon.time
53# tnum tabular figures plus .tf spaced punctuation; the
54# font's default figures are proportional
55# smcp, c2sc real small caps - never as a default
56# aalt, dlig, frac, lnum, pnum change nothing in this build
57# So: nothing to bake for a better desktop font. The option
58# is here so that FEATURE_DEFAULTS/tag sets behave the same in
59# every package of this family, and for the occasional
60# "ss01 everywhere" experiment.
61#
62# FEATURE_FAMILY "Name" (default: empty = edit the fonts in place)
63# Install the result as this family instead, so the stock
64# Google Sans stays available.
65#
66# Why calt: fontconfig's fontfeatures is read by pango/GTK only. Chromium,
67# Electron, Qt, LibreOffice, kitty and Firefox ignore it, and a browser can
68# only ask from page CSS. A shaper applies a fixed list of features whatever
69# the font declares (ccmp locl mark mkmk kern calt liga clig rlig), so
70# moving a feature's lookups into calt is the only way to make it the
71# default in every program. CSS can still say "calt" 0.
72#
73# Non-interactive examples:
74# NERD_PATCH=true HINTING=true HINT_MODE=qqq makepkg -si
75# NERD_PATCH=false HINTING=false WANT_GOOGLE_SANS_DISPLAY=false makepkg -si
76# FEATURE_DEFAULTS=ss01 makepkg -si
77# ────────────────────────────────────────────────────────────────────────────
78
79_validate_hint_mode() {
80 if [[ ! "$HINT_MODE" =~ ^[nqs]{3}$ ]]; then
81 echo "Error: HINT_MODE='$HINT_MODE' is invalid."
82 echo " Must be 3 chars from: n (natural) q (quantized) s (strong)"
83 echo " Examples: nnn qqq qsq sss"
84 exit 1
85 fi
86}
87
88_show() { printf " [%s] %s\n" "$1" "$2"; }
89# "|| _yn=''": at EOF (makepkg </dev/null, chroot, CI) read returns 1, and
90# makepkg runs build() with set -e, so the whole build used to abort here.
91_ask_yn() { local _default="${2:-n}"; read -p " $1? (default: $_default) " _yn || _yn=""; _yn="${_yn:-$_default}"; }
92
93build() {
94 # ══════════════════════════════════════════════════════════════════════════
95 # Prompt section — all questions, only when env vars are not pre-set
96 # ══════════════════════════════════════════════════════════════════════════
97 echo ""
98 echo "╔══════════════════════════════════════════════════════╗"
99 echo "║ ttf-google-sans-hinted — build options ║"
100 echo "╚══════════════════════════════════════════════════════╝"
101
102 # ── Nerd Fonts patching ──────────────────────────────────────────────────
103 if [[ -z "${NERD_PATCH:-}" ]]; then
104 _ask_yn "Patch fonts with Nerd Fonts glyphs" n
105 [[ "$_yn" =~ ^[yY]$ ]] && NERD_PATCH=true || NERD_PATCH=false
106 fi
107 NERD_PATCH="${NERD_PATCH:-false}"
108
109 # ── Hinting ──────────────────────────────────────────────────────────────
110 if [[ -z "${HINTING:-}" ]]; then
111 echo ""
112 _ask_yn "Apply ttfautohint hinting" n
113 [[ "$_yn" =~ ^[yY]$ ]] && HINTING=true || HINTING=false
114 fi
115 HINTING="${HINTING:-false}"
116
117 if [[ "$HINTING" == true && -z "${HINT_MODE:-}" ]]; then
118 echo ""
119 echo " Hinting stem-width mode:"
120 select _choice in "Balanced (qqq)" "HiDPI (nnn)" "Aggressive (sss)" "Custom"; do
121 case "$_choice" in
122 "Balanced (qqq)") HINT_MODE=qqq; break ;;
123 "HiDPI (nnn)") HINT_MODE=nnn; break ;;
124 "Aggressive (sss)") HINT_MODE=sss; break ;;
125 "Custom") read -p " Enter 3-char mode (e.g. qsq): " HINT_MODE || HINT_MODE=qqq; break ;;
126 esac
127 done
128 fi
129 HINT_MODE="${HINT_MODE:-qqq}"
130 [[ "$HINTING" == true ]] && _validate_hint_mode
131
132 # ── Font family selection ────────────────────────────────────────────────
133 if [[ -z "${WANT_GOOGLE_SANS:-}${WANT_GOOGLE_SANS_DISPLAY:-}" ]]; then
134 echo ""
135 echo " ── Font families ────────────────────────────────────────"
136 _ask_yn "Include Google Sans (Regular, Medium, Bold + Italics)" y
137 [[ "$_yn" =~ ^[yY]$ ]] && WANT_GOOGLE_SANS=true || WANT_GOOGLE_SANS=false
138
139 _ask_yn "Include Google Sans Display (Regular, Medium, Bold + Italics)" y
140 [[ "$_yn" =~ ^[yY]$ ]] && WANT_GOOGLE_SANS_DISPLAY=true || WANT_GOOGLE_SANS_DISPLAY=false
141 fi
142
143 WANT_GOOGLE_SANS="${WANT_GOOGLE_SANS:-true}"
144 WANT_GOOGLE_SANS_DISPLAY="${WANT_GOOGLE_SANS_DISPLAY:-true}"
145 FEATURE_DEFAULTS="${FEATURE_DEFAULTS:-}"
146 FEATURE_FAMILY="${FEATURE_FAMILY:-}"
147 local _v
148 for _v in ${FEATURE_DEFAULTS//,/ }; do
149 if [[ ! "$_v" =~ ^[A-Za-z0-9]{4}$ ]]; then
150 echo "Error: FEATURE_DEFAULTS: '$_v' is not a feature tag (e.g. ss01)."; exit 1
151 fi
152 done
153
154 if [[ "$WANT_GOOGLE_SANS$WANT_GOOGLE_SANS_DISPLAY" != *true* ]]; then
155 echo "Error: no font families selected. Aborting."; exit 1
156 fi
157
158 # ── Build summary ─────────────────────────────────────────────────────────
159 echo ""
160 echo " ── Build summary ───────────────────────────────────────"
161 printf " NERD_PATCH: %s\n" "$NERD_PATCH"
162 printf " HINTING: %s%s\n" "$HINTING" "$( [[ "$HINTING" == true ]] && echo " (mode=$HINT_MODE)" )"
163 echo ""
164 _show "$( [[ "$WANT_GOOGLE_SANS" == true ]] && echo "x" || echo " " )" "Google Sans"
165 _show "$( [[ "$WANT_GOOGLE_SANS_DISPLAY" == true ]] && echo "x" || echo " " )" "Google Sans Display"
166 echo " ────────────────────────────────────────────────────────"
167 echo ""
168
169 # ══════════════════════════════════════════════════════════════════════════
170 # Step 1 — Select font files from the downloaded archive
171 # ══════════════════════════════════════════════════════════════════════════
172 rm -rf "$srcdir/selected" "$srcdir/patched"
173 mkdir -p "$srcdir/selected" "$srcdir/patched"
174
175 if [[ "$WANT_GOOGLE_SANS" == true ]]; then
176 find "$srcdir" -maxdepth 1 -name 'GoogleSans-*.ttf' ! -path '*/._*' \
177 -exec cp -n {} "$srcdir/selected/" \;
178 fi
179
180 if [[ "$WANT_GOOGLE_SANS_DISPLAY" == true ]]; then
181 find "$srcdir" -maxdepth 1 -name 'GoogleSansDisplay-*.ttf' ! -path '*/._*' \
182 -exec cp -n {} "$srcdir/selected/" \;
183 fi
184
185 local _sel_count; _sel_count=$(ls "$srcdir/selected/" | wc -l)
186 echo "==> Selected $_sel_count font files for processing."
187 if (( _sel_count == 0 )); then
188 echo "Error: no fonts matched the selection."; exit 1
189 fi
190
191 # ══════════════════════════════════════════════════════════════════════════
192 # Step 2 — Nerd Fonts patching (skipped when NERD_PATCH=false)
193 # ══════════════════════════════════════════════════════════════════════════
194 if [[ "$NERD_PATCH" == true ]]; then
195 printf "%b" "\e[1;33m==> WARNING:\e[0m Patching with Nerd Fonts glyphs — this takes a while...\n"
196 find "$srcdir/selected" -name '*.ttf' ! -path '*/._*' | sort | \
197 parallel -j4 python "$srcdir/font-patcher-${_nfver}" \
198 --variable-width-glyphs -q -c {} \
199 -out "$srcdir/patched" &>/dev/null || true
200 local _hintsrc="$srcdir/patched"
201 else
202 local _hintsrc="$srcdir/selected"
203 fi
204
205 # ══════════════════════════════════════════════════════════════════════════
206 # Step 3 — ttfautohint hinting
207 # ══════════════════════════════════════════════════════════════════════════
208 if [[ "$HINTING" == true ]]; then
209 local _xheight
210 case "$HINT_MODE" in
211 nnn) _xheight=12 ;;
212 *) _xheight=14 ;;
213 esac
214 printf "%b" "\e[1;32m==> INFO:\e[0m Applying ttfautohint (mode=$HINT_MODE, x-height=${_xheight}px)...\n"
215 mkdir -p "$srcdir/patched/hinted"
216 for _f in "$_hintsrc"/*.ttf; do
217 [[ -f "$_f" ]] || continue
218 ttfautohint \
219 --hinting-range-min=8 \
220 --hinting-range-max=50 \
221 --hinting-limit=200 \
222 --increase-x-height="$_xheight" \
223 --x-height-snapping-exceptions="" \
224 --fallback-script=none \
225 --fallback-scaling \
226 --stem-width-mode="$HINT_MODE" \
227 --no-info \
228 --ignore-restrictions \
229 "$_f" "$srcdir/patched/hinted/$(basename "$_f")"
230 done
231 fi
232
233 # ══════════════════════════════════════════════════════════════════════════
234 # Step 4 — Bake features into calt (FEATURE_DEFAULTS; empty = skip)
235 # Last, on the finished files, so ttfautohint never sees the extra lookups.
236 # ══════════════════════════════════════════════════════════════════════════
237 local _fsrc="$_hintsrc" _fam=()
238 [[ "$HINTING" == true ]] && _fsrc="$srcdir/patched/hinted"
239 if [[ -n "$FEATURE_DEFAULTS" ]]; then
240 [[ -n "$FEATURE_FAMILY" ]] && _fam=(--family "$FEATURE_FAMILY")
241 echo "==> Baking $FEATURE_DEFAULTS into calt${FEATURE_FAMILY:+ (as '$FEATURE_FAMILY')}..."
242 python "$srcdir/make_features.py" --features "$FEATURE_DEFAULTS" \
243 "${_fam[@]+"${_fam[@]}"}" -o "$srcdir/featured" "$_fsrc"/*.ttf
244 fi
245
246 # Persist state for package()
247 printf "%s\n%s\n%s\n" "$HINTING" "$NERD_PATCH" "$FEATURE_DEFAULTS" > "$srcdir/.build_state"
248}
249
250package() {
251 local HINTING NERD_PATCH FEATURE_DEFAULTS
252 { read -r HINTING; read -r NERD_PATCH; read -r FEATURE_DEFAULTS; } \
253 < "$srcdir/.build_state" 2>/dev/null || { HINTING=false; NERD_PATCH=false; FEATURE_DEFAULTS=""; }
254
255 install -d "$pkgdir/usr/share/fonts/TTF"
256
257 if [[ -n "$FEATURE_DEFAULTS" ]]; then
258 install -m644 "$srcdir/featured/"*.ttf "$pkgdir/usr/share/fonts/TTF"
259 elif [[ "$HINTING" == true ]]; then
260 install -m644 "$srcdir/patched/hinted/"*.ttf "$pkgdir/usr/share/fonts/TTF"
261 elif [[ "$NERD_PATCH" == true ]]; then
262 install -m644 "$srcdir/patched/"*.ttf "$pkgdir/usr/share/fonts/TTF"
263 else
264 install -m644 "$srcdir/selected/"*.ttf "$pkgdir/usr/share/fonts/TTF"
265 fi
266
267 install -d "$pkgdir/usr/share/licenses/$pkgname"
268 cat > "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<'EOF'
269Google Sans fonts are proprietary fonts owned by Google LLC.
270They are distributed as part of Google's Flutter gallery assets.
271See https://flutter.googlesource.com/gallery-assets for details.
272
273Nerd Fonts glyphs are licensed under their respective open-source licenses.
274See https://github.com/ryanoasis/nerd-fonts for details.
275EOF
276}
277

Changes since previous scan

--- PKGBUILD @ 2026-06-19 23:51
+++ PKGBUILD @ 2026-10-29 13:52
@@ -4,7 +4,7 @@
pkgname=ttf-google-sans-hinted
_nfver=3.4.0
pkgver=1
-pkgrel=1
+pkgrel=2
pkgdesc="Google Sans fonts (GoogleSans, GoogleSansDisplay), optionally Nerd Fonts patched and/or ttfautohint hinted"
url='https://flutter.googlesource.com/gallery-assets'
arch=('any')
@@ -17,8 +17,10 @@
source=(
'fonts.tar.gz::https://flutter.googlesource.com/gallery-assets/+archive/refs/heads/master/lib/fonts.tar.gz'
"font-patcher-${_nfver}::https://github.com/ryanoasis/nerd-fonts/releases/download/v${_nfver}/FontPatcher.zip"
+ 'make_features.py'
)
-sha256sums=('SKIP' 'SKIP')
+sha256sums=('SKIP' 'SKIP'
+ '0723caa5f49782372701905a5acbc577cb7437a87fd30d9b30524a499a505632')
# ── Build-time options (all settable via env vars) ──────────────────────────
#
@@ -35,9 +37,43 @@
# WANT_GOOGLE_SANS true/false (default: true)
# WANT_GOOGLE_SANS_DISPLAY true/false (default: true)
#
+# FEATURE_DEFAULTS "tag,tag,..." (default: empty = leave the fonts alone)
+# Bake these GSUB features into the font's 'calt' feature, so
+# that EVERY renderer applies them, not only pango (see the
+# note below). Environment only: there is no prompt, because
+# this font has almost nothing worth baking. Audit of
+# GoogleSans-Regular.ttf, shaping every codepoint with each
+# feature on and off:
+# case 52 subs, but it is NOT mild: it raises ( ) [ ] { }
+# to capital height AND turns every digit into a
+# .cap (cap-height) digit: "100%" -> one.cap
+# zero.cap zero.cap percent.cap. Not a default.
+# ss01 one sub: * -> asterisk.num (numeral height)
+# ss02 one sub: : -> colon.time
+# tnum tabular figures plus .tf spaced punctuation; the
+# font's default figures are proportional
+# smcp, c2sc real small caps - never as a default
+# aalt, dlig, frac, lnum, pnum change nothing in this build
+# So: nothing to bake for a better desktop font. The option
+# is here so that FEATURE_DEFAULTS/tag sets behave the same in
+# every package of this family, and for the occasional
+# "ss01 everywhere" experiment.
+#
+# FEATURE_FAMILY "Name" (default: empty = edit the fonts in place)
+# Install the result as this family instead, so the stock
+# Google Sans stays available.
+#
+# Why calt: fontconfig's fontfeatures is read by pango/GTK only. Chromium,
+# Electron, Qt, LibreOffice, kitty and Firefox ignore it, and a browser can
+# only ask from page CSS. A shaper applies a fixed list of features whatever
+# the font declares (ccmp locl mark mkmk kern calt liga clig rlig), so
+# moving a feature's lookups into calt is the only way to make it the
+# default in every program. CSS can still say "calt" 0.
+#
# Non-interactive examples:
# NERD_PATCH=true HINTING=true HINT_MODE=qqq makepkg -si
# NERD_PATCH=false HINTING=false WANT_GOOGLE_SANS_DISPLAY=false makepkg -si
+# FEATURE_DEFAULTS=ss01 makepkg -si
# ────────────────────────────────────────────────────────────────────────────
_validate_hint_mode() {
@@ -50,7 +86,9 @@
}
_show() { printf " [%s] %s\n" "$1" "$2"; }
-_ask_yn() { local _default="${2:-n}"; read -p " $1? (default: $_default) " _yn; _yn="${_yn:-$_default}"; }
+# "|| _yn=''": at EOF (makepkg </dev/null, chroot, CI) read returns 1, and
+# makepkg runs build() with set -e, so the whole build used to abort here.
+_ask_yn() { local _default="${2:-n}"; read -p " $1? (default: $_default) " _yn || _yn=""; _yn="${_yn:-$_default}"; }
build() {
# ══════════════════════════════════════════════════════════════════════════
@@ -84,7 +122,7 @@
"Balanced (qqq)") HINT_MODE=qqq; break ;;
"HiDPI (nnn)") HINT_MODE=nnn; break ;;
"Aggressive (sss)") HINT_MODE=sss; break ;;
- "Custom") read -p " Enter 3-char mode (e.g. qsq): " HINT_MODE; break ;;
+ "Custom") read -p " Enter 3-char mode (e.g. qsq): " HINT_MODE || HINT_MODE=qqq; break ;;
esac
done
fi
@@ -104,6 +142,14 @@
WANT_GOOGLE_SANS="${WANT_GOOGLE_SANS:-true}"
WANT_GOOGLE_SANS_DISPLAY="${WANT_GOOGLE_SANS_DISPLAY:-true}"
+ FEATURE_DEFAULTS="${FEATURE_DEFAULTS:-}"
+ FEATURE_FAMILY="${FEATURE_FAMILY:-}"
+ local _v
+ for _v in ${FEATURE_DEFAULTS//,/ }; do
+ if [[ ! "$_v" =~ ^[A-Za-z0-9]{4}$ ]]; then
+ echo "Error: FEATURE_DEFAULTS: '$_v' is not a feature tag (e.g. ss01)."; exit 1
+ fi
+ done
if [[ "$WANT_GOOGLE_SANS$WANT_GOOGLE_SANS_DISPLAY" != *true* ]]; then
echo "Error: no font families selected. Aborting."; exit 1
@@ -184,18 +230,33 @@
done
fi
+ # ══════════════════════════════════════════════════════════════════════════
+ # Step 4 — Bake features into calt (FEATURE_DEFAULTS; empty = skip)
+ # Last, on the finished files, so ttfautohint never sees the extra lookups.
+ # ══════════════════════════════════════════════════════════════════════════
+ local _fsrc="$_hintsrc" _fam=()
+ [[ "$HINTING" == true ]] && _fsrc="$srcdir/patched/hinted"
+ if [[ -n "$FEATURE_DEFAULTS" ]]; then
+ [[ -n "$FEATURE_FAMILY" ]] && _fam=(--family "$FEATURE_FAMILY")
+ echo "==> Baking $FEATURE_DEFAULTS into calt${FEATURE_FAMILY:+ (as '$FEATURE_FAMILY')}..."
+ python "$srcdir/make_features.py" --features "$FEATURE_DEFAULTS" \
+ "${_fam[@]+"${_fam[@]}"}" -o "$srcdir/featured" "$_fsrc"/*.ttf
+ fi
+
# Persist state for package()
- printf "%s\n%s\n" "$HINTING" "$NERD_PATCH" > "$srcdir/.build_state"
+ printf "%s\n%s\n%s\n" "$HINTING" "$NERD_PATCH" "$FEATURE_DEFAULTS" > "$srcdir/.build_state"
}
package() {
- local HINTING NERD_PATCH
- { read -r HINTING; read -r NERD_PATCH; } \
- < "$srcdir/.build_state" 2>/dev/null || { HINTING=false; NERD_PATCH=false; }
+ local HINTING NERD_PATCH FEATURE_DEFAULTS
+ { read -r HINTING; read -r NERD_PATCH; read -r FEATURE_DEFAULTS; } \
+ < "$srcdir/.build_state" 2>/dev/null || { HINTING=false; NERD_PATCH=false; FEATURE_DEFAULTS=""; }
install -d "$pkgdir/usr/share/fonts/TTF"
- if [[ "$HINTING" == true ]]; then
+ if [[ -n "$FEATURE_DEFAULTS" ]]; then
+ install -m644 "$srcdir/featured/"*.ttf "$pkgdir/usr/share/fonts/TTF"
+ elif [[ "$HINTING" == true ]]; then
install -m644 "$srcdir/patched/hinted/"*.ttf "$pkgdir/usr/share/fonts/TTF"
elif [[ "$NERD_PATCH" == true ]]; then
install -m644 "$srcdir/patched/"*.ttf "$pkgdir/usr/share/fonts/TTF"

Scan history

Scanned at (UTC)SeverityRules
2026-10-29 13:52:19 Medium 1
2026-06-19 23:51:18 Clean 2
2026-06-19 19:07:35 Low 2
2026-06-18 18:55:24 Low 2
2026-06-18 16:11:54 Medium 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion