This Shit is Hard: Nobody has ever been pwned by Helvetica…or have they?

The biggest pile of unverified binaries in a from-source Linux distribution is not the compiler, the kernel, the JIT, or the crypto library. It is the fonts. Debian, Fedora, Arch, Alpine, openSUSE, Gentoo, NixOS, and, until this month, Chainguard OS all ship at least some fonts the same way: download the upstream TTF or OTF files, verify a hash, and copy them into a package. Nobody decided fonts were exempt from the from-source rule. They just sit in a blind spot. They are not code, so the toolchain people do not own them; they are not documents, so the content people do not either. They never crash, half of them have not had a release since the Obama administration, and nobody looks. Chainguard OS is built from source: more than 10,000 package definitions, and in the OS tier, roughly 1% reach upstream as compiled artifacts. In September 2026, we audited that one percent: every package, every installed file, and its source. Strip out the proprietary-by-nature (drivers, partner binaries) and the deliberate (Gradle distributions kept bit-identical to upstream so Chainguard Libraries rebuilds can be verified against them), and the largest remaining class was fonts: 19 source packages, 129 APKs, 2,379 distinct…