5db5-compressor-vst3-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=('https://5db5public.s3.amazonaws.com/Compressor551Linux.zip')

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package installs prebuilt binary shared libraries (.so files) downloaded from an S3 bucket (5db5public.s3.amazonaws.com) belonging to Audio Assault (audioassault.mx), a commercial audio plugin vendor. The URL pattern is consistent with a vendor-controlled S3 bucket used for distribution of their commercial products. The sha256 checksum is present and pins the specific archive. However, the concern is real: this is a prebuilt binary plugin (executed native code loaded into a DAW process) from a non-canonical host that is not the vendor's primary domain. If the S3 bucket were compromised or the object replaced, the checksum would catch it — but the checksum itself is only as trustworthy as the PKGBUILD maintainer. The plugin is proprietary/EULA-licensed commercial software distributed as a binary, which is a legitimate AUR pattern for commercial audio plugins. The risk is a genuine but low-probability supply-chain concern (S3 bucket takeover or maintainer checksum manipulation), not an active attack. This fits the medium classification: executed binary from an unofficial/personal/vendor S3 host rather than a primary vendor download page, with no evidence of malice.