ttf-unfonts-core

maintainer muphix · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from kldp.net, a non-whitelisted but plausibly project-owned host, and builds TTF font files using fontforge; fonts are data, not executable code, and the build process involves only standard font modifications, so the risk is low even if the host is untrusted.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from kldp.net, a non-whitelisted but plausibly project-owned host, and builds TTF font files using fontforge; fonts are data, not executable code, and the build process involves only standard font modifications, so the risk is low even if the host is untrusted.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("${pkgname}-${pkgver}.tar.gz::https://kldp.net/unfonts/release/${_source_file}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Geonho Kim <ghkim@muphix.com>
    
      2#
    
      3# PKGBUILD notes:
    
      4# - Based on upstream un-fonts 1.0.2 (080608).
    
      5# - Based on Debian's fonts-unfonts-core packaging.
    
      6#   - Fontconfig snippet for improved rendering
    
      7#   - fsType cleanup (SetOS2Value("FSType",0)) to ensure installable embedding
    
      8#     for GPL fonts.
    
      9#   - Wrong PostScript name fix (SetFontNames(""))
    
      10#     (UnDinaru-Bold -> UnDinaru-Light)
    
      11#
    
      12_pkgver_pre=1.0.2
    
      13_pkgver_post=080608
    
      14_source_file_pre=2607
    
      15_source_file="${_source_file_pre}-un-fonts-core-${_pkgver_pre}-${_pkgver_post}.tar.gz"
    
      16
    
      17pkgname=ttf-unfonts-core
    
      18pkgver=${_pkgver_pre}.${_pkgver_post}
    
      19pkgrel=1
    
      20pkgdesc='Un series Korean TrueType fonts (core set)'
    
      21arch=('any')
    
      22url='https://kldp.net/unfonts/'
    
      23license=('GPL-2.0-only')
    
      24makedepends=('fontforge')
    
      25source=("${pkgname}-${pkgver}.tar.gz::https://kldp.net/unfonts/release/${_source_file}")
    
      26sha256sums=('3b0a7274f9aab7e8f0f1938c01a70e1581766d51b494ba145683f37ac557918e')
    
      27
    
      28_ttfs=()
    
      29_fc='90-fonts-unfonts-core.conf'
    
      30
    
      31prepare() {
    
      32  cd "$srcdir/un-fonts"
    
      33
    
      34  mapfile -d '' _ttfs < <(find . -type f -iname '*.ttf' -print0)
    
      35
    
      36  # Fix wrong PostScript name
    
      37  fontforge -lang=ff \
    
      38      -c 'Open($1); SetFontNames("UnDinaru-Light"); Generate($1)' \
    
      39          './UnDinaruLight.ttf'
    
      40
    
      41  # Cleanup fsType in OS/2 table
    
      42  for i in "${_ttfs[@]}"; do
    
      43    fontforge -lang=ff -c 'Open($1); SetOS2Value("FSType",0); Generate($1)' "$i"
    
      44  done
    
      45
    
      46  # Build fontconfig for improved rendering
    
      47  cat > "$_fc" <<'EOF'
    
      48<?xml version="1.0"?>
    
      49<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
    
      50<fontconfig>
    
      51  <!-- Un fonts have no hint instructions so they rely on autohint and
    
      52       antialias. Note that they might look horrible with some
    
      53       autohint configuration. -->
    
      54  <match target="font">
    
      55    <test name="family" qual="any">
    
      56      <string>UnBatang</string>
    
      57    </test>
    
      58    <edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
    
      59    <edit name="hinting"   mode="assign" binding="strong"><bool>false</bool></edit>
    
      60    <edit name="autohint"  mode="assign" binding="strong"><bool>true</bool></edit>
    
      61    <edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
    
      62  </match>
    
      63  <match target="font">
    
      64    <test name="family" qual="any">
    
      65      <string>UnDotum</string>
    
      66    </test>
    
      67    <edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
    
      68    <edit name="hinting"   mode="assign" binding="strong"><bool>false</bool></edit>
    
      69    <edit name="autohint"  mode="assign" binding="strong"><bool>true</bool></edit>
    
      70    <edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
    
      71  </match>
    
      72  <match target="font">
    
      73    <test name="family" qual="any">
    
      74      <string>UnGungseo</string>
    
      75    </test>
    
      76    <edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
    
      77    <edit name="hinting"   mode="assign" binding="strong"><bool>false</bool></edit>
    
      78    <edit name="autohint"  mode="assign" binding="strong"><bool>true</bool></edit>
    
      79    <edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
    
      80  </match>
    
      81  <match target="font">
    
      82    <test name="family" qual="any">
    
      83      <string>UnPilgi</string>
    
      84    </test>
    
      85    <edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
    
      86    <edit name="hinting"   mode="assign" binding="strong"><bool>false</bool></edit>
    
      87    <edit name="autohint"  mode="assign" binding="strong"><bool>true</bool></edit>
    
      88    <edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
    
      89  </match>
    
      90  <match target="font">
    
      91    <test name="family" qual="any">
    
      92      <string>UnGraphic</string>
    
      93    </test>
    
      94    <edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
    
      95    <edit name="hinting"   mode="assign" binding="strong"><bool>false</bool></edit>
    
      96    <edit name="autohint"  mode="assign" binding="strong"><bool>true</bool></edit>
    
      97    <edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
    
      98  </match>
    
      99</fontconfig>
    
      100EOF
    
      101}
    
      102
    
      103package() {
    
      104  cd "$srcdir/un-fonts"
    
      105
    
      106  mapfile -d '' _ttfs < <(find . -type f -iname '*.ttf' -print0)
    
      107
    
      108  install -Dm644 -t "$pkgdir/usr/share/fonts/TTF/" "${_ttfs[@]}"
    
      109  install -Dm644 -t "$pkgdir/usr/share/doc/$pkgname/" 'README'
    
      110  install -Dm644 -t "$pkgdir/usr/share/fontconfig/conf.avail/" "$_fc"
    
      111  install -d "$pkgdir/usr/share/fontconfig/conf.d/"
    
      112  ln -s "../conf.avail/$_fc" "$pkgdir/usr/share/fontconfig/conf.d/$_fc"
    
      113}
    
      114# vim:set ft=sh ts=2 sw=2 et:
    
      115

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2