aliza-free

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:16 source=("aliza-${pkgver}.x86_64.rpm::https://web.archive.org/web/20210327224315/https://doc-0s-0s-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/1lgjid9ti29rdf5ebmd7o58iqhs3gfpo/1616884950000/16072287944266838401/*/1-AXa3tjy_onecW2k7ftjAQl0KGTb0B1Y?e=download")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt x86_64 RPM binary (extracted and copied directly into the package root) sourced from a Google Drive URL archived via web.archive.org. The binary is a medical imaging application that will be executed on the user's system. The concerns are: (1) the source is a prebuilt binary from a personal/unofficial Google Drive link, not from the upstream vendor's official release infrastructure; (2) it is accessed via web.archive.org as an intermediary, meaning the content is controlled by whoever originally uploaded it to Google Drive, not the upstream developer; (3) there is no way to verify the binary's provenance beyond the sha256sum, which only proves integrity of what was downloaded, not authenticity of the original upload. The sha256sum does provide some protection against future tampering of the archived copy, but the original upload could have been malicious. This is a genuine medium-severity supply-chain concern: an executed binary from an unofficial/personal host with no cryptographic signature verification from the upstream developer.