ttf-x2

LOW

maintainer HurricanePootis 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads font files from a non-whitelisted but project-related host; the worst case of a swapped source is limited to font tampering, not code execution, and the files are verified with provided checksums.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads font files from a non-whitelisted but project-related host; the worst case of a swapped source is limited to font tampering, not code execution, and the files are verified with provided checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("zar.zip::http://dl.irmug.com/dl.php?id=21"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mohammadreza Abdollahzadeh <morealaz@gmail.com>
    
      2
    
      3pkgname=ttf-x2
    
      4pkgver=1.0
    
      5pkgrel=2
    
      6pkgdesc="Free fonts with support for Persian, Arabic, Urdu, Pashto, Dari, Uzbek, Kurdish, Uighur, old Turkish (Ottoman) and modern Turkish (Roman)."
    
      7arch=('any')
    
      8url="http://wiki.irmug.com/index.php?title=X_Series_2"
    
      9license=('custom:OFL')
    
      10groups=(persian-fonts)
    
      11depends=('fontconfig' 'xorg-font-utils' 'unzip')
    
      12source=("zar.zip::http://dl.irmug.com/dl.php?id=21"
    
      13        "niloofar.zip::http://dl.irmug.com/dl.php?id=3" 
    
      14        "khoramshahr.zip::http://dl.irmug.com/dl.php?id=2" 
    
      15        "kayhan.zip::http://dl.irmug.com/dl.php?id=1" 
    
      16        "yaghut.zip::http://dl.irmug.com/dl.php?id=17" 
    
      17        "riyaz.zip::http://dl.irmug.com/dl.php?id=5" 
    
      18        "roya.zip::http://dl.irmug.com/dl.php?id=6" 
    
      19        "shafigh.zip::http://dl.irmug.com/dl.php?id=7" 
    
      20        "shafigh-kurd.zip::http://dl.irmug.com/dl.php?id=9" 
    
      21        "shafigh-uzbek.zip::http://dl.irmug.com/dl.php?id=8" 
    
      22        "shiraz.zip::http://dl.irmug.com/dl.php?id=10" 
    
      23        "sols.zip::http://dl.irmug.com/dl.php?id=11" 
    
      24        "tabriz.zip::http://dl.irmug.com/dl.php?id=12" 
    
      25        "titre.zip::http://dl.irmug.com/dl.php?id=13" 
    
      26        "traffic.zip::http://dl.irmug.com/dl.php?id=14" 
    
      27        "paatch.zip::http://dl.irmug.com/dl.php?id=4" 
    
      28        "vahid.zip::http://dl.irmug.com/dl.php?id=15" 
    
      29        "vosta.zip::http://dl.irmug.com/dl.php?id=16" 
    
      30        "yekan.zip::http://dl.irmug.com/dl.php?id=19" 
    
      31        "yermook.zip::http://dl.irmug.com/dl.php?id=20" 
    
      32        "yas.zip::http://dl.irmug.com/dl.php?id=18" 
    
      33        "ziba.zip::http://dl.irmug.com/dl.php?id=22")
    
      34noextract=("${source[@]%%::*}")
    
      35install=$pkgname.install
    
      36md5sums=('8e08f1d30a07e687d0a858558a852ce1'
    
      37         '443e92a9b431497a28b6d9e7d1384c40'
    
      38         '4a91b8b194a156fd4023b4debd567c63'
    
      39         'c432b18c9fe7f69c5d07a19c2022cce8'
    
      40         '7d5524e06e12553cc11e840bb13cc0c6'
    
      41         '6e5bb6523f718c4b714d3c21b2f28d6e'
    
      42         '7cfc3b472fe2bd493791f332ccabd387'
    
      43         '75d4c47f48ff3e35c8c602e2d8700e08'
    
      44         '221061d0eb93bc05ca18f45f5f7667c2'
    
      45         '90cbb8e150a83eab7fd74f784e8d203e'
    
      46         '255383be1f0a0fafe171c7f60fc2ca48'
    
      47         '1e74c51fabf865444c38bfa9976c9390'
    
      48         '8dac005c7e360f5f086d20c67bd35c35'
    
      49         '5a044355abe553785f5d215cec157eb4'
    
      50         '474d4ded68d37332a4c97ae9d929af53'
    
      51         '9ec31680d5e9a44a2b4237d78b4722ad'
    
      52         '1455e778dd31ce54c4c040b839faed37'
    
      53         '49841f03bbdeed85be15499e258147a9'
    
      54         '83a4d9e86174a28f7e27b16523eb38fc'
    
      55         '078da267d9c01d3651e235f0be966c8f'
    
      56         'b4ba9c744edec0245d911fdd1a4e20e9'
    
      57         'e5642b4ec4b144b2debeaebee4eff6ae')
    
      58
    
      59prepare() {
    
      60  unzip -o -qq -LL -j '*.zip' -d $srcdir/$pkgname/ 
    
      61}
    
      62
    
      63package() {  
    
      64  install -m 644 -Dt $pkgdir/usr/share/fonts/$pkgname $srcdir/$pkgname/*.ttf
    
      65  install -Dm 644 $srcdir/$pkgname/ofl.txt $pkgdir/usr/share/licenses/$pkgname/LICENSE
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2