aic8800-dkms

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:16 "https://linux.brostrend.com/${_pkgbase}-dkms.deb"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .deb from linux.brostrend.com, which is the vendor's own Linux support site (BrosTrend is a real WiFi adapter manufacturer that maintains this host for Linux driver distribution). The source has a pinned sha512sum, which provides integrity verification. The .deb is extracted and its kernel driver source (C files) is patched and installed via DKMS — meaning the kernel module is compiled locally from source, not a prebuilt binary kernel module. Firmware blobs are also copied from the .deb. The main concern is that linux.brostrend.com is not a major distribution mirror or GitHub, so if the host were compromised the sha512sum would catch substitution. The patches are local files also checksummed. This is a legitimate vendor driver distribution pattern common for WiFi adapters (similar to rtl8812au etc.). The risk is real but low-to-medium: it's an unofficial vendor host with binary firmware blobs, but the DKMS source compilation and sha512 pinning mitigate the worst concerns. Rating medium is defensible due to the non-standard host and firmware blobs, but this is a borderline case leaning toward clean/low for a known vendor's official Linux support infrastructure.