ttf-lausanne

maintainer alerque · 1 votes · base lausanne-font · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a font archive from a non-whitelisted but reputable font hosting site (dafont.com), which is a common and expected source for such fonts; the installed files are static font data, not executable code, and the license file is processed as plain text, posing minimal risk even if the host were compromised.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a font archive from a non-whitelisted but reputable font hosting site (dafont.com), which is a common and expected source for such fonts; the installed files are static font data, not executable code, and the license file is processed as plain text, posing minimal risk even if the host were compromised.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("$_font-$pkgver.zip::https://dl.dafont.com/dl/?f=${_font/-/_}"
PKGBUILD:14 "font-licenses.html::https://www.neogrey.com/font-licenses")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Caleb Maclennan <caleb@alerque.com>
    
      2
    
      3_font=lausanne
    
      4pkgbase=$_font-font
    
      5pkgname=("otf-$_font" "ttf-$_font")
    
      6pkgver=1.005
    
      7pkgrel=1
    
      8pkgdesc='A luxury serif typeface borrowing from classic Didot with a hint of Copperplate'
    
      9url="https://www.neogrey.com/portfolio/$_font-free-font"
    
      10arch=('any')
    
      11license=('custom:FFPU')
    
      12makedepends=('hq')
    
      13source=("$_font-$pkgver.zip::https://dl.dafont.com/dl/?f=${_font/-/_}"
    
      14        "font-licenses.html::https://www.neogrey.com/font-licenses")
    
      15sha256sums=('47b9da93f9f34b596cbcf832a04bb3a2285075d9588f0133946f6e38ec3a18f5'
    
      16            'SKIP')
    
      17
    
      18prepare() {
    
      19    hq article text < font-licenses.html > FFPU.txt
    
      20}
    
      21
    
      22package_otf-lausanne() {
    
      23    provides=("$pkgbase")
    
      24    install -Dm644 -t "$pkgdir/usr/share/fonts/OTF/" *.otf
    
      25    install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname/" FFPU.txt
    
      26}
    
      27
    
      28package_ttf-lausanne() {
    
      29    provides=("$pkgbase")
    
      30    install -Dm644 -t "$pkgdir/usr/share/fonts/TTF/" *.ttf
    
      31    install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname/" FFPU.txt
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2