ttf-lobsang-monlam

maintainer keenerd · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads Tibetan font files (non-executable data) from archive.org, a legitimate archival service; the worst case of a swapped source is incorrect glyphs, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads Tibetan font files (non-executable data) from archive.org, a legitimate archival service; the worst case of a swapped source is incorrect glyphs, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("http://monlam-dictionary.googlecode.com/files/monlambodyig.ttf")
PKGBUILD:14 source=("https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniChouk.ttf"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Kyle Keen < keenerd at gmail >
    
      2
    
      3pkgname=ttf-lobsang-monlam
    
      4pkgver=1
    
      5pkgrel=2
    
      6pkgdesc='A Tibetan font, Monlam Bod-Yig'
    
      7arch=('any')
    
      8license=('Apache')
    
      9#url='http://lobsangmonlam.org/'
    
      10url='http://digitaltibetan.org/index.php/Tibetan_Fonts'
    
      11depends=()
    
      12source=("http://monlam-dictionary.googlecode.com/files/monlambodyig.ttf")
    
      13md5sums=('e5da214e2c392d00f29af696c813b63e')
    
      14source=("https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniChouk.ttf"
    
      15        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniChoukmatik.ttf"
    
      16        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniDutsa1.ttf"
    
      17        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniDutsa2.ttf"
    
      18        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan1.ttf"
    
      19        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan2.ttf"
    
      20        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan3.ttf"
    
      21        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan4.ttf"
    
      22        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniOuchan5.ttf"
    
      23        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniPaytsik.ttf"
    
      24        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniSansSerif.ttf"
    
      25        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniTikrang.ttf"
    
      26        "https://archive.org/download/bodyig/fonts/Monlam3%20Fonts/MonlamUniTiktong.ttf")
    
      27md5sums=('8f052e98c625cb1aa8eaa5cb7603e75b'
    
      28         '6b86299aa01da659ce8ee16d85f3360a'
    
      29         '5239cc54845df6d8ce421aeeccdec1d8'
    
      30         'd5e23e97295644528163d5d04ae035af'
    
      31         '91022cb5c714e269d2a49759ea20e160'
    
      32         '8ddc5bc475b1226b059c5b49217baadd'
    
      33         '749888a3ae86359678c22dff0925a7d9'
    
      34         '2a5623ca87f9771aab112597fd1007e3'
    
      35         '4a915b15db8c534b00a74313af22aef0'
    
      36         'de2d28b4411a6e80c75b3746beb1f667'
    
      37         '53db2ba9110683aceefb908b50e7c36c'
    
      38         '330664cefe081b661850017d7647a41d'
    
      39         'c520cab43080c2fa6cd6c6c1d874f542')
    
      40
    
      41package() {
    
      42  cd "$srcdir"
    
      43  install -d "$pkgdir/usr/share/fonts/TTF/"
    
      44  install -m644 *.ttf "$pkgdir/usr/share/fonts/TTF/"
    
      45}
    
      46
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2