win10fonts-auto
maintainer rev_enby
· 1 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a Windows 10 ISO from archive.org, an untrusted and non-standard host for this type of content, and extracts fonts and license files; while the payload is likely benign (fonts and RTF), the source is an unverifiable prebuilt binary (ISO) from a swappable host, creating a supply-chain risk if the ISO were tampered with.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:7
source=('https://archive.org/download/windows-10-22h2-en-us/Windows%2010%2022H2%20x86%20en-us.iso')
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a Windows 10 ISO from archive.org, an untrusted and non-standard host for this type of content, and extracts fonts and license files; while the payload is likely benign (fonts and RTF), the source is an unverifiable prebuilt binary (ISO) from a swappable host, creating a supply-chain risk if the ISO were tampered with.
PKGBUILD
1 offending line(s) highlighted
1
# maintainer: revectane <revectane@proton.me> irc: Revectane (irc.libera.chat)
2
pkgname=win10fonts-auto
3
pkgver=0.1
4
pkgrel=1
5
pkgdesc="replacement for broken ttf-ms-win10/11-fonts pkgs. saw this in a comment section of said pkgs and said why not make a pkgbuild."
6
arch=(any)
7
source=('https://archive.org/download/windows-10-22h2-en-us/Windows%2010%2022H2%20x86%20en-us.iso')
8
sha256sums=('764427989289fa221fb80b0f8f1c3411ad2e05761daa683a67da1a4100dbe1d8')
9
license=(custom)
10
depends=('7zip')
11
12
package() {
13
7z e "Windows%2010%2022H2%20x86%20en-us.iso" sources/install.esd
14
7z e install.esd 1/Windows/{Fonts/"*".{ttf,ttc},System32/Licenses/neutral/"*"/"*"/license.rtf} -ofonts/
15
16
install -Dt "$pkgdir/usr/share/fonts/${pkgname%-fonts}" -m644 fonts/*.ttf fonts/*.ttc
17
install -Dm644 fonts/license.rtf -t "$pkgdir/usr/share/licenses/$pkgname"
18
}
19
Changes since previous scan
--- PKGBUILD @ 2026-07-16 00:05+++ PKGBUILD @ 2026-08-03 00:08@@ -4,16 +4,16 @@ pkgrel=1 pkgdesc="replacement for broken ttf-ms-win10/11-fonts pkgs. saw this in a comment section of said pkgs and said why not make a pkgbuild." arch=(any)-license=(GPL-2.0-only)-depends=('wget' '7zip')+source=('https://archive.org/download/windows-10-22h2-en-us/Windows%2010%2022H2%20x86%20en-us.iso')+sha256sums=('764427989289fa221fb80b0f8f1c3411ad2e05761daa683a67da1a4100dbe1d8')+license=(custom)+depends=('7zip') package() {- wget https://archive.org/download/windows-10-22h2-en-us/Windows%2010%2022H2%20x86%20en-us.iso- 7z e "Windows 10 22H2 x86 en-us.iso" sources/install.esd+ 7z e "Windows%2010%2022H2%20x86%20en-us.iso" sources/install.esd 7z e install.esd 1/Windows/{Fonts/"*".{ttf,ttc},System32/Licenses/neutral/"*"/"*"/license.rtf} -ofonts/ install -Dt "$pkgdir/usr/share/fonts/${pkgname%-fonts}" -m644 fonts/*.ttf fonts/*.ttc-- rm "Windows 10 22H2 x86 en-us.iso"+ install -Dm644 fonts/license.rtf -t "$pkgdir/usr/share/licenses/$pkgname" } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 3 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | MEDIUM | 3 |
| 2026-07-26 00:07:32 | MEDIUM | 3 |
| 2026-07-25 00:13:44 | MEDIUM | 3 |
| 2026-07-24 00:02:28 | MEDIUM | 3 |
| 2026-07-23 00:14:47 | MEDIUM | 3 |
| 2026-07-22 00:29:32 | MEDIUM | 3 |
| 2026-07-21 00:24:15 | MEDIUM | 3 |
| 2026-07-20 00:19:49 | MEDIUM | 3 |
| 2026-07-19 00:17:08 | MEDIUM | 3 |
| 2026-07-18 00:14:48 | MEDIUM | 3 |
| 2026-07-17 00:06:16 | MEDIUM | 3 |
| 2026-07-16 01:50:03 | MEDIUM | 3 |
| 2026-07-16 00:05:41 | MEDIUM | 3 |