Review Results

Comment

The only change in this diff is a pkgrel bump from 11 to 12 in .SRCINFO. No sources, build steps, install scripts, dependencies, or shipped artifacts changed, so there is no new security-relevant behavior to assess in this hunk.

@@ -1,7 +1,7 @@
 pkgbase = ttf-vista-fonts
 	pkgdesc = Microsoft Vista and Office 2007 True Type Fonts
 	pkgver = 1
-	pkgrel = 11
+	pkgrel = 12
 	url = https://docs.microsoft.com/en-us/typography/fonts/font-faq
 	install = ttf-vista-fonts.install
 	arch = any

Comment

The only change is swapping the source URL in .SRCINFO from a web.archive.org snapshot of Microsoft’s PowerPointViewer.exe to an archive.org mirror of the same file. This does not introduce new build steps, scripts, or privilege/persistence mechanisms, and the source remains HTTPS with a pinned sha256 checksum. The main risk is supply-chain trust in a third-party mirror for a binary blob, but that risk already existed and is not materially increased by this metadata-only change.

@@ -10,7 +10,7 @@ pkgbase = ttf-vista-fonts
 	makedepends = fontconfig
 	makedepends = cabextract
 	replaces = vista-fonts
-	source = ttf-vista-fonts.cab::https://web.archive.org/web/20171225132744/http://download.microsoft.com/download/E/6/7/E675FFFC-2A6D-4AB0-B3EB-27C9F8C8F696/PowerPointViewer.exe
+	source = ttf-vista-fonts.cab::https://archive.org/download/PowerPointViewer_201801/PowerPointViewer.exe
 	sha256sums = 249473568eba7a1e4f95498acba594e0f42e6581add4dead70c1dfb908a09423
 
 pkgname = ttf-vista-fonts

Comment

The change is low risk. It only updates package metadata and switches the source URL from a web-archive mirror of Microsoft’s PowerPointViewer.exe to an Archive.org mirror of the same upstream installer, while keeping the same pinned SHA-256 checksum. There are no new build steps, no added scripts, and no changes to package() or the .install file. The only notable concern is supply-chain hygiene: the source is still a third-party mirror of a proprietary binary rather than the original Microsoft URL, but the content remains checksum-pinned and unchanged in this diff. No evidence of malicious behavior in the reviewed hunk.

@@ -1,9 +1,10 @@
 # Maintainer: mrxx <mrxx at cyberhome dot at>
-# Contributor: mutlu_inek <mutlu_inek@yahoo.de>
+# Contributor: diomekes <goodmans at protonmail dot com>
+# Contributor: mutlu_inek <mutlu_inek at <yahoo dot de>
 # Contributor: jnbek
 pkgname=ttf-vista-fonts
 pkgver=1
-pkgrel=11
+pkgrel=12
 pkgdesc="Microsoft Vista and Office 2007 True Type Fonts"
 url="https://docs.microsoft.com/en-us/typography/fonts/font-faq"
 license=('custom:microsoft')

Comment

The change only swaps the source download from a web.archive.org snapshot of the Microsoft PowerPoint Viewer EXE to an archive.org mirror of the same file. It remains HTTPS, there is no new build-time execution, and the checksum is unchanged, so integrity and behavior are effectively the same. The only notable concern is supply-chain trust in a third-party mirror versus the previous archive snapshot, but the file is still pinned by SHA-256 and no additional attack surface is introduced in this PKGBUILD change.

@@ -12,7 +13,7 @@ depends=()
 makedepends=('fontforge' 'fontconfig' 'cabextract')
 replaces=('vista-fonts')
 install=$pkgname.install
-source=("${pkgname}.cab::https://web.archive.org/web/20171225132744/http://download.microsoft.com/download/E/6/7/E675FFFC-2A6D-4AB0-B3EB-27C9F8C8F696/PowerPointViewer.exe")
+source=("${pkgname}.cab::https://archive.org/download/PowerPointViewer_201801/PowerPointViewer.exe")
 sha256sums=('249473568eba7a1e4f95498acba594e0f42e6581add4dead70c1dfb908a09423')
 
 package() {