ttf-unfonts-core
LOW
maintainer muphix
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a source tarball from kldp.net, a non-whitelisted but plausibly project-owned host, and builds TTF font files using fontforge; fonts are data, not executable code, and the build process involves only standard font modifications, so the risk is low even if the host is untrusted.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from kldp.net, a non-whitelisted but plausibly project-owned host, and builds TTF font files using fontforge; fonts are data, not executable code, and the build process involves only standard font modifications, so the risk is low even if the host is untrusted.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
source=("${pkgname}-${pkgver}.tar.gz::https://kldp.net/unfonts/release/${_source_file}")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Geonho Kim <ghkim@muphix.com>
2
#
3
# PKGBUILD notes:
4
# - Based on upstream un-fonts 1.0.2 (080608).
5
# - Based on Debian's fonts-unfonts-core packaging.
6
# - Fontconfig snippet for improved rendering
7
# - fsType cleanup (SetOS2Value("FSType",0)) to ensure installable embedding
8
# for GPL fonts.
9
# - Wrong PostScript name fix (SetFontNames(""))
10
# (UnDinaru-Bold -> UnDinaru-Light)
11
#
12
_pkgver_pre=1.0.2
13
_pkgver_post=080608
14
_source_file_pre=2607
15
_source_file="${_source_file_pre}-un-fonts-core-${_pkgver_pre}-${_pkgver_post}.tar.gz"
16
17
pkgname=ttf-unfonts-core
18
pkgver=${_pkgver_pre}.${_pkgver_post}
19
pkgrel=1
20
pkgdesc='Un series Korean TrueType fonts (core set)'
21
arch=('any')
22
url='https://kldp.net/unfonts/'
23
license=('GPL-2.0-only')
24
makedepends=('fontforge')
25
source=("${pkgname}-${pkgver}.tar.gz::https://kldp.net/unfonts/release/${_source_file}")
26
sha256sums=('3b0a7274f9aab7e8f0f1938c01a70e1581766d51b494ba145683f37ac557918e')
27
28
_ttfs=()
29
_fc='90-fonts-unfonts-core.conf'
30
31
prepare() {
32
cd "$srcdir/un-fonts"
33
34
mapfile -d '' _ttfs < <(find . -type f -iname '*.ttf' -print0)
35
36
# Fix wrong PostScript name
37
fontforge -lang=ff \
38
-c 'Open($1); SetFontNames("UnDinaru-Light"); Generate($1)' \
39
'./UnDinaruLight.ttf'
40
41
# Cleanup fsType in OS/2 table
42
for i in "${_ttfs[@]}"; do
43
fontforge -lang=ff -c 'Open($1); SetOS2Value("FSType",0); Generate($1)' "$i"
44
done
45
46
# Build fontconfig for improved rendering
47
cat > "$_fc" <<'EOF'
48
<?xml version="1.0"?>
49
<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
50
<fontconfig>
51
<!-- Un fonts have no hint instructions so they rely on autohint and
52
antialias. Note that they might look horrible with some
53
autohint configuration. -->
54
<match target="font">
55
<test name="family" qual="any">
56
<string>UnBatang</string>
57
</test>
58
<edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
59
<edit name="hinting" mode="assign" binding="strong"><bool>false</bool></edit>
60
<edit name="autohint" mode="assign" binding="strong"><bool>true</bool></edit>
61
<edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
62
</match>
63
<match target="font">
64
<test name="family" qual="any">
65
<string>UnDotum</string>
66
</test>
67
<edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
68
<edit name="hinting" mode="assign" binding="strong"><bool>false</bool></edit>
69
<edit name="autohint" mode="assign" binding="strong"><bool>true</bool></edit>
70
<edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
71
</match>
72
<match target="font">
73
<test name="family" qual="any">
74
<string>UnGungseo</string>
75
</test>
76
<edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
77
<edit name="hinting" mode="assign" binding="strong"><bool>false</bool></edit>
78
<edit name="autohint" mode="assign" binding="strong"><bool>true</bool></edit>
79
<edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
80
</match>
81
<match target="font">
82
<test name="family" qual="any">
83
<string>UnPilgi</string>
84
</test>
85
<edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
86
<edit name="hinting" mode="assign" binding="strong"><bool>false</bool></edit>
87
<edit name="autohint" mode="assign" binding="strong"><bool>true</bool></edit>
88
<edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
89
</match>
90
<match target="font">
91
<test name="family" qual="any">
92
<string>UnGraphic</string>
93
</test>
94
<edit name="antialias" mode="assign" binding="strong"><bool>true</bool></edit>
95
<edit name="hinting" mode="assign" binding="strong"><bool>false</bool></edit>
96
<edit name="autohint" mode="assign" binding="strong"><bool>true</bool></edit>
97
<edit name="hintstyle" mode="assign" binding="strong"><const>hintslight</const></edit>
98
</match>
99
</fontconfig>
100
EOF
101
}
102
103
package() {
104
cd "$srcdir/un-fonts"
105
106
mapfile -d '' _ttfs < <(find . -type f -iname '*.ttf' -print0)
107
108
install -Dm644 -t "$pkgdir/usr/share/fonts/TTF/" "${_ttfs[@]}"
109
install -Dm644 -t "$pkgdir/usr/share/doc/$pkgname/" 'README'
110
install -Dm644 -t "$pkgdir/usr/share/fontconfig/conf.avail/" "$_fc"
111
install -d "$pkgdir/usr/share/fontconfig/conf.d/"
112
ln -s "../conf.avail/$_fc" "$pkgdir/usr/share/fontconfig/conf.d/$_fc"
113
}
114
# vim:set ft=sh ts=2 sw=2 et:
115
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |