maple font - Moses Yebei

Abstract

Maple Mono: Open source monospace font with round corner, ligatures and Nerd-Font icons for IDE and terminal, fine-grained customization options. 带连字和控制台图标的圆角等宽字体，中英文宽度完美2:1，细粒度的自定义选项

The Problem Developers who spend many hours in terminals and IDEs need a monospace font that combines clean round‑corner glyphs, extensive ligatures, and built‑in Nerd‑Font icons while still preserving a perfect 2:1 Chinese‑to‑English width ratio. Existing fonts either lack the required ligature set, miss the icon coverage, or force a separate Chinese‑specific build.

What This Does maple-font ships the source for Maple Mono, a variable‑weight TTF that includes:

round‑corner glyphs and custom italics (source/MapleMono[wght].vfc, source/MapleMono[wght]-VF.ttf)
a full set of OpenType feature files under source/features/ (regular.fea, italic.fea, cn.fea, etc.) that drive ligatures, contextual alternates, and stylistic sets
Nerd‑Font icon patches generated by the source/py/task/nerdfont.py helper

The Python tooling in source/py/ builds the font from the feature files, merges optional subsets, and publishes the final archives. The Dockerfile (Dockerfile) provides an isolated build environment, and pyproject.toml/requirements.txt list the required Python packages (e.g., fontTools, requests).

How It Is Wired

Entry points – The CLI starts in build.py at main (line 1677). main parses command‑line arguments, loads the configuration (source/config.yaml), and invokes the build pipeline. A secondary entry point run lives in source/py/utils.py (line 13) and is used by several task scripts.

Core flow – main → check_ftcli → parse_args → parse_scale_factor → __load_config. The configuration feeds source/py/feature/__init__.py which generates the OpenType feature string (generate_fea_string). This string is handed to fontTools via source/py/task/merge_font/merger.py to produce the final TTF.

High‑blast‑radius modules – source/py/feature/ast.py is imported by 46 other modules, making it the primary hub. Changes here ripple widely. source/py/feature/__init__.py sits in a circular import with source/py/feature/calt/__init__.py; breaking this cycle will reduce coupling.

Key functions – subst_map (called from 43 places) and joinPaths (26 places) perform the bulk of glyph substitution logic. gly, cls, and ign are also heavily reused.

External effects – The build writes font files (archive_fonts in build.py) and computes a SHA‑256 hash (hashlib.sha256). source/py/utils.py runs a subprocess (subprocess.run) for Git commands and other shell tools. No network I/O beyond optional HTTP fetches for Nerd‑Font patches.

Task modules – source/py/task/merge_font/__init__.py validates the merge configuration, source/py/task/nerdfont.py patches icons, and source/py/task/publish.py uploads assets via a GitHub release workflow (.github/workflows/release.yml).

How To Use It

# Clone the repo
git clone https://github.com/moses-y/maple-font
cd maple-font

# Build the container (Dockerfile pins python:3.11-slim)
docker build -t maple-font-builder .

# Run the build inside the container
docker run --rm -v "$(pwd)":/src maple-font-builder \
    python build.py --config source/config.yaml --output dist/

The repo supplies a Dockerfile that installs the Python dependencies from requirements.txt and runs build.py. No additional environment variables are required.

If you prefer a local build, install the Python deps (pip install -r requirements.txt) and invoke the same command without Docker.

Real‑World Use A CI pipeline for a custom IDE theme can invoke the container step above to regenerate MapleMono[wght].ttf whenever a new ligature set is added. The resulting font can be dropped into VS Code or iTerm2, and the Nerd‑Font icons will appear automatically in the terminal prompt.

Code Health & Issues

High – No LICENSE – repository root lacks a licence file. Add MIT or Apache‑2.0.
High – No test suite – 91 source files, zero test files. Introduce unit tests for public functions (main, run, feature generation).
High – No lockfile – pyproject.toml is present without a lockfile; commit poetry.lock or requirements.txt generated by pip‑freeze.
High – Continue‑on‑error in CI – .github/workflows/custom.yml line 108 allows failures to pass; remove or isolate advisory steps.
Medium – Dependabot missing – No automated dependency updates; add .github/dependabot.yml.
Medium – Docker base image not pinned – python:3.11-slim is mutable; replace with a digest.
Medium – No vulnerability scan – CI lacks a dependency‑review or OSV scan; add one.
Medium – Unbounded HTTP request – source/py/utils.py makes a requests call without timeout; supply timeout=.
Medium – Checkout persists token – .github/workflows/custom.yml should set persist-credentials: false.
Medium – Container runs as root – Dockerfile lacks a non‑root USER; create an unprivileged user.

The Bottom Line maple-font provides a well‑documented, feature‑rich monospace font with a reproducible Python‑based build pipeline, but the code base suffers from missing licensing, tests, and a few architectural smells (import cycle, large hub module). Adding a licence, lockfile, and test suite will make it safe for integration into production tooling or downstream font customisation projects.

What the analyser found

Deployment readiness

4/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

137 files

Python91
Markdown9
YAML4
JSON3
TOML1

Docker

Module dependencies

The 10 most depended-upon modules of 91, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_source_py_feature_ast["ast"] n1_source_py_feature___init__["__init__"] n2_source_py_feature_cv__common["_common"] n3_source_py_feature_base_clazz["clazz"] n4_source_py_utils["utils"] n5_source_py_task__utils["_utils"] n6_feature_calt__infinite_utils["_infinite_utils"] n7_source_py_feature_base_locl["locl"] n8_source_py_in_browser["in_browser"] n9_rce_py_feature_base___init__["__init__"] n1_source_py_feature___init__ --> n9_rce_py_feature_base___init__ n1_source_py_feature___init__ --> n6_feature_calt__infinite_utils n9_rce_py_feature_base___init__ --> n0_source_py_feature_ast n9_rce_py_feature_base___init__ --> n7_source_py_feature_base_locl n3_source_py_feature_base_clazz --> n0_source_py_feature_ast n7_source_py_feature_base_locl --> n0_source_py_feature_ast n6_feature_calt__infinite_utils --> n0_source_py_feature_ast n4_source_py_utils --> n5_source_py_task__utils classDef cyc stroke:#ef4444,stroke-width:2px; class n1_source_py_feature___init__ cyc;

Findings

MediumNo test files detected - untested code paths repository-wide
MediumNo LICENSE file - unclear usage/redistribution rights root
LowDependencies declared without a lockfile - non-reproducible builds pyproject.toml

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high4

medium6

low1

Add a LICENSE; redistribution rights are undefinedhigh

no licence file at the repository root

Fix: Add MIT or Apache-2.0 at the repository root.

Add a test suite; this repository has nonehigh91 occurrences

91 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Commit a lockfile beside the manifesthigh

pyproject.toml

manifest with no lockfile in scope

An unlocked range means the artifact you tested and the artifact you ship can contain different transitive code, so a malicious patch release reaches production with no diff.

Fix: Run the package manager once and commit the generated lockfile.

Remove continue-on-error from steps that gate correctnesshigh

.github/workflows/custom.yml

line 108 on a correctness step

A failing test suite reports a green check, which is precisely the path this audit exists to close.

Fix: Delete continue-on-error, or move a genuinely advisory step into a separate non-required job.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium

Dockerfile

python:3.11-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Give the outbound request a timeoutmedium

source/py/utils.py

1 outbound call(s) with no timeout

requests has no default timeout, so a peer that accepts the connection and then says nothing holds the worker forever, and with a small worker pool a single slow dependency takes the whole service down without anything appearing to fail.

Fix: Pass timeout= on every call, or use a session with one configured.

Set persist-credentials: false on checkoutmedium

.github/workflows/custom.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/custom.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.