aurora-timetable

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 source=("${pkgname}-${pkgver}.deb::https://timetable-software.com/download/aurora-orarend_${pkgver}-1.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .deb binary package from timetable-software.com (the project's own domain) and installs a Java application from it. There is no prepare() step to unpack the .deb before package(), which means data.tar.gz must be extracted elsewhere (likely in a prepare() that's missing, or the build relies on the .deb being auto-unpacked — this is actually a functional issue). The core concern is that a prebuilt binary JAR/application is pulled from a third-party host with only a sha256 checksum for integrity. The host appears to be the legitimate upstream vendor site matching the url= field, which reduces but does not eliminate supply-chain risk. The sha256sum pins the specific artifact, providing some protection against substitution. This is a standard pattern for AUR packages wrapping proprietary or upstream-distributed binaries, and the domain matches the upstream project URL. The risk is real but typical for this class of AUR package — not clearly malicious, but an executed binary from a non-Arch-official host. Rating remains medium. Note: the PKGBUILD also appears broken since data.tar.gz is never extracted from the .deb in the shown code (no ar/unpack step), but that is a separate functional issue.