win10fonts-auto

maintainer rev_enby · 1 votes · scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged The package downloads a Windows 10 ISO from archive.org, an untrusted and non-standard host for this type of content, and extracts fonts and license files; while the payload is likely benign (fonts and RTF), the source is an unverifiable prebuilt binary (ISO) from a swappable host, creating a supply-chain risk if the ISO were tampered with.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:7 source=('https://archive.org/download/windows-10-22h2-en-us/Windows%2010%2022H2%20x86%20en-us.iso')
MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a Windows 10 ISO from archive.org, an untrusted and non-standard host for this type of content, and extracts fonts and license files; while the payload is likely benign (fonts and RTF), the source is an unverifiable prebuilt binary (ISO) from a swappable host, creating a supply-chain risk if the ISO were tampered with.

PKGBUILD

1 offending line(s) highlighted
1# maintainer: revectane <revectane@proton.me> irc: Revectane (irc.libera.chat)
2pkgname=win10fonts-auto
3pkgver=0.1
4pkgrel=1
5pkgdesc="replacement for broken ttf-ms-win10/11-fonts pkgs. saw this in a comment section of said pkgs and said why not make a pkgbuild."
6arch=(any)
7source=('https://archive.org/download/windows-10-22h2-en-us/Windows%2010%2022H2%20x86%20en-us.iso')
8sha256sums=('764427989289fa221fb80b0f8f1c3411ad2e05761daa683a67da1a4100dbe1d8')
9license=(custom)
10depends=('7zip')
11
12package() {
13 7z e "Windows%2010%2022H2%20x86%20en-us.iso" sources/install.esd
14 7z e install.esd 1/Windows/{Fonts/"*".{ttf,ttc},System32/Licenses/neutral/"*"/"*"/license.rtf} -ofonts/
15
16 install -Dt "$pkgdir/usr/share/fonts/${pkgname%-fonts}" -m644 fonts/*.ttf fonts/*.ttc
17 install -Dm644 fonts/license.rtf -t "$pkgdir/usr/share/licenses/$pkgname"
18}
19

Changes since previous scan

--- PKGBUILD @ 2026-07-16 00:05
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,16 +4,16 @@
pkgrel=1
pkgdesc="replacement for broken ttf-ms-win10/11-fonts pkgs. saw this in a comment section of said pkgs and said why not make a pkgbuild."
arch=(any)
-license=(GPL-2.0-only)
-depends=('wget' '7zip')
+source=('https://archive.org/download/windows-10-22h2-en-us/Windows%2010%2022H2%20x86%20en-us.iso')
+sha256sums=('764427989289fa221fb80b0f8f1c3411ad2e05761daa683a67da1a4100dbe1d8')
+license=(custom)
+depends=('7zip')
package() {
- wget https://archive.org/download/windows-10-22h2-en-us/Windows%2010%2022H2%20x86%20en-us.iso
- 7z e "Windows 10 22H2 x86 en-us.iso" sources/install.esd
+ 7z e "Windows%2010%2022H2%20x86%20en-us.iso" sources/install.esd
7z e install.esd 1/Windows/{Fonts/"*".{ttf,ttc},System32/Licenses/neutral/"*"/"*"/license.rtf} -ofonts/
install -Dt "$pkgdir/usr/share/fonts/${pkgname%-fonts}" -m644 fonts/*.ttf fonts/*.ttc
-
- rm "Windows 10 22H2 x86 en-us.iso"
+ install -Dm644 fonts/license.rtf -t "$pkgdir/usr/share/licenses/$pkgname"
}

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 MEDIUM 2
2026-08-02 00:16:08 MEDIUM 2
2026-08-01 00:11:18 MEDIUM 2
2026-07-31 00:14:10 MEDIUM 2
2026-07-30 00:17:23 MEDIUM 2
2026-07-29 00:25:53 MEDIUM 3
2026-07-28 00:07:28 MEDIUM 3
2026-07-27 00:24:32 MEDIUM 3
2026-07-26 00:07:32 MEDIUM 3
2026-07-25 00:13:44 MEDIUM 3
2026-07-24 00:02:28 MEDIUM 3
2026-07-23 00:14:47 MEDIUM 3
2026-07-22 00:29:32 MEDIUM 3
2026-07-21 00:24:15 MEDIUM 3
2026-07-20 00:19:49 MEDIUM 3
2026-07-19 00:17:08 MEDIUM 3
2026-07-18 00:14:48 MEDIUM 3
2026-07-17 00:06:16 MEDIUM 3
2026-07-16 01:50:03 MEDIUM 3
2026-07-16 00:05:41 MEDIUM 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion