binance-app

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:14 source=("binance-${pkgver}.deb::https://ftp.binance.com/electron-desktop/linux/production/binance-amd64-linux.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Electron binary .deb from ftp.binance.com, which is Binance's own official distribution host (the official Binance download page links to this same endpoint). However, there are two genuine concerns: (1) The URL is not versioned — it always resolves to 'latest' regardless of pkgver, meaning the sha256sum is the only integrity guard and will silently break on any upstream update, making the version field misleading and the package fragile. (2) A prebuilt, closed-source Electron binary from any host — even the vendor's own — constitutes an executed binary payload that cannot be audited, which is the canonical definition of a medium supply-chain risk in AUR context. The sha256sum does provide a pinned integrity check, which mitigates active substitution risk somewhat, but the non-versioned URL means future pkgrel bumps could ship a different binary than advertised. This is a real medium concern (unauditable executed binary from a vendor host with a mutable URL), not a false positive, but there is no evidence of malice.