ttf-lobsang-monlam

LOW

maintainer keenerd 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads Tibetan font files (non-executable data) from archive.org, a legitimate archival service; the worst case of a swapped source is incorrect glyphs, not code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads Tibetan font files (non-executable data) from archive.org, a legitimate archival service; the worst case of a swapped source is incorrect glyphs, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("http://monlam-dictionary.googlecode.com/files/monlambodyig.ttf")
PKGBUILD:14 source=("https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniChouk.ttf"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Kyle Keen < keenerd at gmail >
    
      2
    
      3pkgname=ttf-lobsang-monlam
    
      4pkgver=1
    
      5pkgrel=2
    
      6pkgdesc='A Tibetan font, Monlam Bod-Yig'
    
      7arch=('any')
    
      8license=('Apache')
    
      9#url='http://lobsangmonlam.org/'
    
      10url='http://digitaltibetan.org/index.php/Tibetan_Fonts'
    
      11depends=()
    
      12source=("http://monlam-dictionary.googlecode.com/files/monlambodyig.ttf")
    
      13md5sums=('e5da214e2c392d00f29af696c813b63e')
    
      14source=("https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniChouk.ttf"
    
      15        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniChoukmatik.ttf"
    
      16        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniDutsa1.ttf"
    
      17        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniDutsa2.ttf"
    
      18        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan1.ttf"
    
      19        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan2.ttf"
    
      20        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan3.ttf"
    
      21        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan4.ttf"
    
      22        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan5.ttf"
    
      23        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniPaytsik.ttf"
    
      24        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniSansSerif.ttf"
    
      25        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniTikrang.ttf"
    
      26        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniTiktong.ttf")
    
      27md5sums=('8f052e98c625cb1aa8eaa5cb7603e75b'
    
      28         '6b86299aa01da659ce8ee16d85f3360a'
    
      29         '5239cc54845df6d8ce421aeeccdec1d8'
    
      30         'd5e23e97295644528163d5d04ae035af'
    
      31         '91022cb5c714e269d2a49759ea20e160'
    
      32         '8ddc5bc475b1226b059c5b49217baadd'
    
      33         '749888a3ae86359678c22dff0925a7d9'
    
      34         '2a5623ca87f9771aab112597fd1007e3'
    
      35         '4a915b15db8c534b00a74313af22aef0'
    
      36         'de2d28b4411a6e80c75b3746beb1f667'
    
      37         '53db2ba9110683aceefb908b50e7c36c'
    
      38         '330664cefe081b661850017d7647a41d'
    
      39         'c520cab43080c2fa6cd6c6c1d874f542')
    
      40
    
      41package() {
    
      42  cd "$srcdir"
    
      43  install -d "$pkgdir/usr/share/fonts/TTF/"
    
      44  install -m644 *.ttf "$pkgdir/usr/share/fonts/TTF/"
    
      45}
    
      46
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2