ttf-tiro-indigo-git

LOW

maintainer dhruvasambrani 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The pip install is for project-specific build dependencies from a legitimate project repository, not an external untrusted package, and the source is built from a verifiable upstream Git repository.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is for project-specific build dependencies from a legitimate project repository, not an external untrusted package, and the source is built from a verifiable upstream Git repository.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:27 pip install --upgrade pip
PKGBUILD:28 pip install -r requirements.txt

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Dhruva Sambrani <dhruvasambrani19 at gmail dot com>
    
      2# Previous Maintainer: André Kugland <kugland at gmail dot com>
    
      3
    
      4pkgname=ttf-tiro-indigo-git
    
      5pkgdesc="Tiro Indigo Indic Typefaces, based on the series of fonts for Harvard's Murty Classical Library of India. Includes Bangla (Bengali), Devanagari (Hindi, Sanskrit and Marathi variants), Gurmukhi (Punjabi), Kannada, Tamil and Telugu (built from source)"
    
      6pkgver=1.65.r0.gbb6971b # This will be dynamically updated by pkgver()
    
      7pkgrel=1
    
      8arch=('any')
    
      9url="https://github.com/TiroTypeworks/Indigo"
    
      10license=('OFL')
    
      11provides=('ttf-tiro-indigo')
    
      12conflicts=('ttf-tiro-indigo' 'ttf-tiro-indigo-bin')
    
      13makedepends=('git' 'python' 'python-pip')
    
      14source=("${pkgname%-git}::git+https://github.com/TiroTypeworks/Indigo.git")
    
      15sha256sums=('SKIP')
    
      16
    
      17pkgver() {
    
      18  cd "$srcdir/${pkgname%-git}"
    
      19  git describe --long --tags 2>/dev/null | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      20  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      21}
    
      22
    
      23build() {
    
      24  cd "$srcdir/${pkgname%-git}"
    
      25  python -m venv venv
    
      26  source venv/bin/activate
    
      27  pip install --upgrade pip
    
      28  pip install -r requirements.txt
    
      29  python tools/tirobuild.py indigo.yml
    
      30}
    
      31
    
      32package() {
    
      33  cd "$srcdir/${pkgname%-git}"
    
      34  local fontdir="$pkgdir/usr/share/fonts/TiroIndigo-ttf"
    
      35  install -d "$fontdir"
    
      36  find output -type f -name "*.ttf" -exec install -m644 {} -t "$fontdir" \;
    
      37  install -Dm644 LICENSES.txt "$pkgdir/usr/share/licenses/$pkgname/OFL.txt"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2