ttf-timetable-latest

LOW

maintainer dreieck 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a font file and license from the project's official domain;虽 flagged for non-standard host, the sources are from the author's legitimate infrastructure and contain non-executable data, posing minimal risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a font file and license from the project's official domain;虽 flagged for non-standard host, the sources are from the author's legitimate infrastructure and contain non-executable data, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:67 "${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}"
PKGBUILD:68 "IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2
    
      3# PKGBUILD last time manually edited: At least on 2024-05-19.
    
      4
    
      5url="https://chaps.cz/eng/download/idos/zip#kotvaprg"
    
      6_zipfile="TTFONT.ZIP"
    
      7_fontfile="TT.ttf"
    
      8_pkgver() {
    
      9  # Reason for a $_pkgver(): Have something to run before source download so that we can have version aware source downloads.
    
      10
    
      11  # _ver="$(fc-query -f "%{fontversion}" "${_fontfile}")"
    
      12  # _ver="$(wget -q -O- "${url}" | html2text -b 0 | grep 'Font Timetable, version' | sed 's|^.*version[[:space:]]\([0-9\.]*\)[^0-9].*$|\1|g')"
    
      13  _ver="$(wget -nv -O- "${url}" | sed -n 's|^.*Font Timetable, version[[:space:]]*\([0-9\.]*\)[^0-9].*$|\1|p')"
    
      14  _date="$(wget -nv -O- "${url}" | sed -n 's|^.*/updates/ttfont_d#\([0-9]*\)[^0-9].*$|\1|p')"
    
      15
    
      16  _exitcode=0
    
      17  if [ -z "${_ver}" ]; then
    
      18    echo "$0: Error: Could not determine version." > /dev/stderr
    
      19    false
    
      20    _exitcode=1
    
      21  fi
    
      22
    
      23  if [ -z "${_date}" ]; then
    
      24    echo "$0: Error: Could not determine release date." > /dev/stderr
    
      25    false
    
      26    _exitcode=2
    
      27  fi
    
      28
    
      29  echo "${_ver}.${_date}"
    
      30  return ${_exitcode}
    
      31}
    
      32
    
      33_pkgname=ttf-timetable
    
      34pkgname="${_pkgname}-latest"
    
      35epoch=0
    
      36_pkgver="$(_pkgver)" # This should be set _before_ sources get downloaded.
    
      37pkgver="${_pkgver}"
    
      38pkgrel=7
    
      39pkgdesc="Font with train timetable symbols, used by the offline timetable by CHAPS (IDOS, Timetable-Browser) or INPROP (CP, ELIS) (also retailed by České Dráhy or ŽSR)."
    
      40arch=('any')
    
      41license=('custom')
    
      42
    
      43depends=(
    
      44  "fontconfig"
    
      45  "xorg-mkfontscale"
    
      46  "xorg-mkfontdir"
    
      47  "xorg-xset"
    
      48)
    
      49
    
      50makedepends=(
    
      51  "fontconfig"
    
      52  "unzip"
    
      53  "xorg-mkfontscale"
    
      54  "xorg-mkfontdir"
    
      55  "xorg-xset"
    
      56)
    
      57
    
      58provides=("${_pkgname}=${pkgver}")
    
      59conflicts=("${_pkgname}")
    
      60replaces=("${_pkgname}<=${pkgver}")
    
      61
    
      62install='tt.install'
    
      63
    
      64_target="ttfont-${_pkgver}.zip"
    
      65
    
      66source=(
    
      67  "${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}"
    
      68  "IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"
    
      69  "license-dummy.txt"
    
      70  "info.url"
    
      71  "${install}"
    
      72)
    
      73
    
      74sha256sums=(
    
      75  "c14d08d6f58ab1c06f10786de03352599c940840166b515a47a5b0fa75907404"  # TTFONT.ZIP
    
      76  "SKIP"                                                              # IDOS-Licence.pdf
    
      77  "c6bb216055d3670d3100b7a74e04ce0644030f365f4349a09e630ef60fbcb9a4"  # license-dummy.txt
    
      78  "4c021678394399056573ae7f85779a7fde86f0c70fec6e64f6e1a379195ef4da"  # info.url
    
      79  "6a00ba2e7e0e7610dd4a4a064716bcf368b4269f75046aee585208dd3d6a998f"  # ${install}
    
      80)
    
      81
    
      82pkgver() {
    
      83  printf '%s' "${_pkgver}"
    
      84}
    
      85
    
      86package() {
    
      87  _unpackeddir="${srcdir}"
    
      88  cd "${_unpackeddir}"
    
      89
    
      90  install -D -m644 "${_unpackeddir}/${_fontfile}" "${pkgdir}/usr/share/fonts/timetable/TT.ttf"
    
      91  ln -s TT.ttf "${pkgdir}/usr/share/fonts/timetable/tt.ttf"
    
      92  ln -s TT.ttf "${pkgdir}/usr/share/fonts/timetable/timetable.ttf"
    
      93
    
      94  install -D -m644 info.url "${pkgdir}/usr/share/doc/${pkgname}/info.url"
    
      95
    
      96  install -D -m644 license-dummy.txt "${pkgdir}/usr/share/licenses/${pkgname}/copying.txt"
    
      97  install -D -m644 "${srcdir}/IDOS-Licence.pdf" "${pkgdir}/usr/share/licenses/${pkgname}/IDOS-Licence.pdf"
    
      98}
    
      99

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2