appimage-installer-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:27 source=("${_pkgname}_${pkgver}-beta_amd64.deb::https://gitee.com/deepin-opensource/appimage-installer/attach_files/774786/download/appimage-installer_2.0-beta_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from Gitee (a Chinese code-hosting platform), which is the upstream project's own repository (deepin-opensource/appimage-installer). This is not a random personal host — it is the official upstream source for this Deepin project. However, the artifact is a prebuilt binary blob (not source-compiled), and Gitee attachment URLs are not a canonical release distribution channel with strong integrity guarantees. The sha256sum is present and pinned, which mitigates substitution risk significantly. The binary is extracted and installed directly to /opt/apps/ and symlinked into /usr/bin, meaning it will be executed on the user's system. The combination of a prebuilt binary from a non-primary distribution host (Gitee attachments rather than a signed release channel) with direct execution constitutes a genuine medium supply-chain concern, though the pinned checksum and the fact that this is the project's own upstream repository reduce the risk compared to a truly unofficial third-party host.