ttf-kreativekorp-commodore-giana

LOW

maintainer fbf-prog64 1 votes scanned 2026-10-25 03:43:22.088428

View on AUR

Why flagged

Downloads a font zip from the project's own official domain (kreativekorp.com) with a checksum; installs only TTF font files and a license text — pure non-executed data, so worst case of a swapped source is cosmetic. Minor quality issues (custom DLAGENTS, pkgbase used instead of pkgname) but no real security risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a font zip from the project's own official domain (kreativekorp.com) with a checksum; installs only TTF font files and a license text — pure non-executed data, so worst case of a swapped source is cosmetic. Minor quality issues (custom DLAGENTS, pkgbase used instead of pkgname) but no real security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 'giana.zip::https://www.kreativekorp.com/swdownload/fonts/retro/giana.zip'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felipe BF <fprgw32 at gmail dot com>
    
      2
    
      3pkgname=ttf-kreativekorp-commodore-giana
    
      4pkgver=2011.02
    
      5pkgrel=1
    
      6pkgdesc="KreativeKorp's Commodore font based on Armin Gessert's game \"The Great Giana Sisters\": Giana."
    
      7arch=('any')
    
      8url='https://www.kreativekorp.com/software/fonts/c64/'
    
      9license=('custom:relay-fonts-1.2f')
    
      10depends=('xorg-fonts-encodings')
    
      11
    
      12# Patch taken from 'ttf-petme'.
    
      13makedepends=('wget')
    
      14DLAGENTS=('https::/usr/bin/wget -O %o %u')
    
      15
    
      16source=(
    
      17    'giana.zip::https://www.kreativekorp.com/swdownload/fonts/retro/giana.zip'
    
      18)
    
      19sha256sums=(
    
      20    '0c4fb657bef1fdd533688fe1f127f697170b179a72969872ca5003fcfd9a3f5b'
    
      21)
    
      22
    
      23package() {
    
      24    install -d "${pkgdir}/usr/share/fonts/${pkgbase}/"
    
      25    for f in $(find "${srcdir}" -type f -name 'Giana*.ttf'); do
    
      26        install -m644 "$f" "${pkgdir}/usr/share/fonts/${pkgbase}/"
    
      27    done
    
      28
    
      29    install -Dm644 "${srcdir}/FreeLicense.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      30}
    
      31
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 03:43:22	Low	3
2026-10-25 03:41:34	Medium	2