beersmith2

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source_x86_64=("https://s3.amazonaws.com/beersmith$_major-$_minor/BeerSmith-${pkgver}_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from an Amazon S3 bucket (s3.amazonaws.com/beersmith2-3/...) which is the vendor's own distribution channel for BeerSmith — this is a common pattern for small ISVs who host releases on S3 rather than a traditional download server. The sha256sum is pinned, so integrity is verified against a known hash. However, the S3 bucket is not the canonical beersmith.com domain, and there is no way to verify the bucket is controlled by the vendor vs. a third party. The package installs a prebuilt proprietary binary directly, which is the core supply-chain concern: if the S3 bucket were compromised or the bucket name were squatted, a malicious binary could be distributed. This is a genuine medium-severity supply-chain risk (executed binary from a non-canonical host), not a false positive, though it is also a common and widely-accepted AUR pattern for proprietary software distributed via S3.