aptible-cli

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("https://omnibus-aptible-toolbelt.s3.amazonaws.com/aptible/omnibus-aptible-toolbelt/master/194/pkg/aptible-toolbelt_0.16.3%2B20191024181014%7Eubuntu.16.04-1_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt Debian binary package (.deb) from an S3 bucket (omnibus-aptible-toolbelt.s3.amazonaws.com) and installs it directly onto the system. While this is the official Aptible toolbelt distribution host (Aptible is a real PaaS company and this is their official omnibus package), the concerns are: (1) it's a prebuilt binary blob, not source-compiled; (2) only an MD5 checksum is used for integrity verification — MD5 is cryptographically broken and provides weak assurance; (3) no GPG/PGP signature verification is performed; (4) the binary is a Debian package being extracted and installed on Arch Linux, which is non-standard and could include bundled libraries with vulnerabilities. The S3 bucket path structure ('master/194/pkg/') suggests a CI artifact path rather than a stable release URL, meaning the artifact could theoretically be replaced. The binary executes as a full omnibus package under /opt/aptible-toolbelt. This is a legitimate vendor distribution method but represents a real supply-chain risk due to lack of cryptographic signature verification and use of a mutable CI artifact URL with only MD5 integrity checking.