ttf-ricty-nerd

maintainer h-a · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a font generation script and a font archive from project-related hosts to build fonts locally; the sources are checksummed and the script is patched and reviewed, posing minimal risk as no unverified binaries are executed and the worst case from source swap is limited to font tampering.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a font generation script and a font archive from project-related hosts to build fonts locally; the sources are checksummed and the script is patched and reviewed, posing minimal risk as no unverified binaries are executed and the worst case from source swap is limited to font tampering.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "https://rictyfonts.github.io/files/ricty_generator.sh"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: h-a <ha1029.dev at aol dot com>
    
      2pkgname=ttf-ricty-nerd
    
      3pkgver=3.4.0
    
      4pkgrel=1
    
      5pkgdesc="Japanese TrueType font for developers by mixing Inconsolata Nerd Font and Migu 1M."
    
      6arch=("any")
    
      7url="https://rictyfonts.github.io/"
    
      8license=("OFL-1.1 AND IPA")
    
      9depends=("fontconfig")
    
      10makedepends=("ttf-inconsolata-nerd>=3.3.0-1" "fontforge")
    
      11install=ttf-ricty-nerd.install
    
      12source=(
    
      13	"https://rictyfonts.github.io/files/ricty_generator.sh"
    
      14	"ricty_generator.patch"
    
      15	"OFL-1.1.txt"
    
      16	"IPA_Font_License_Agreement_v1.0.txt"
    
      17	"https://github.com/itouhiro/mixfont-mplus-ipa/releases/download/v2020.0307/migu-1m-20200307.zip"
    
      18)
    
      19sha256sums=(
    
      20	"86bf0fed84ef806690b213798419405d7ca2a1a4bed4f6a28b87c2e2d07ad60d"
    
      21	"0eb3b33e453932b0c0e434ef62e365da5fe2f86f514e255ccb75a9cf23154d95"
    
      22	"29bd0cfd0fb2a45f9b057c834a057724bae1f63b525a8ac83d3e7525706d9f80"
    
      23	"4c84dd528ec3044638ec346fc1ee27cd1eb95dfc04cbc6a881b3ca7a7f517e54"
    
      24	"e4806d297e59a7f9c235b0079b2819f44b8620d4365a8955cb612c9ff5809321"
    
      25)
    
      26
    
      27prepare() {
    
      28	cd "${srcdir}"
    
      29	ln -sfv /usr/share/fonts/TTF/InconsolataNerdFont-Regular.ttf Inconsolata-Regular.ttf
    
      30	ln -sfv /usr/share/fonts/TTF/InconsolataNerdFont-Bold.ttf Inconsolata-Bold.ttf
    
      31	patch -u --follow-symlinks -o ricty_nerd_generator.sh < ricty_generator.patch
    
      32	chmod +x ricty_nerd_generator.sh
    
      33}
    
      34
    
      35build() {
    
      36	cd "${srcdir}"
    
      37	./ricty_nerd_generator.sh -a auto
    
      38}
    
      39
    
      40package() {
    
      41	install -d "${pkgdir}"/usr/share/fonts/TTF
    
      42	install -m644 "${srcdir}"/RictyNerdFont-Regular.ttf            "${pkgdir}"/usr/share/fonts/TTF
    
      43	install -m644 "${srcdir}"/RictyNerdFont-Bold.ttf               "${pkgdir}"/usr/share/fonts/TTF
    
      44	install -m644 "${srcdir}"/RictyNerdFont-BoldOblique.ttf        "${pkgdir}"/usr/share/fonts/TTF
    
      45	install -m644 "${srcdir}"/RictyNerdFont-Oblique.ttf            "${pkgdir}"/usr/share/fonts/TTF
    
      46	install -m644 "${srcdir}"/RictyDiscordNerdFont-Regular.ttf     "${pkgdir}"/usr/share/fonts/TTF
    
      47	install -m644 "${srcdir}"/RictyDiscordNerdFont-Bold.ttf        "${pkgdir}"/usr/share/fonts/TTF
    
      48	install -m644 "${srcdir}"/RictyDiscordNerdFont-BoldOblique.ttf "${pkgdir}"/usr/share/fonts/TTF
    
      49	install -m644 "${srcdir}"/RictyDiscordNerdFont-Oblique.ttf     "${pkgdir}"/usr/share/fonts/TTF
    
      50	install -d "${pkgdir}"/usr/share/licenses/"${pkgname}"
    
      51	install -m644 OFL-1.1.txt "${pkgdir}"/usr/share/licenses/"${pkgname}"/OFL-1.1.txt
    
      52	install -m644 IPA_Font_License_Agreement_v1.0.txt "${pkgdir}"/usr/share/licenses/"${pkgname}"/IPA_Font_License_Agreement_v1.0.txt
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2