ttf-win10

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:18 source=("https://software-download.microsoft.com/download/pr/${_file}")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a large Windows 10 Enterprise Evaluation ISO (~5GB) directly from software-download.microsoft.com, which is a legitimate Microsoft CDN host used for evaluation ISOs. The sha256sum is provided and pinned, which mitigates silent substitution risk. However, the core concern is that this is a prebuilt binary artifact (a full OS ISO) from which fonts are extracted — the ISO itself is not reproducible or verifiable beyond the single hash. The host is plausible/official for Microsoft evaluation downloads, but the package extracts and installs binary font files (TTF/TTC) from a Windows OS image. The fonts themselves are proprietary Microsoft assets, and distributing or packaging them this way may violate Microsoft's font licensing terms (fonts are licensed for use with Windows, not for redistribution). There is no active malware or obfuscation, but the supply-chain risk of a multi-gigabyte opaque binary blob from which executed/installed code (fonts loaded by the font renderer) is extracted warrants a medium rating. The licensing concern is notable but fonts extracted from a legitimately downloaded evaluation ISO occupy a legal grey area rather than clear piracy.