bitrix24

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("bitrix24_desktop-${pkgver}.deb::https://dl.bitrix24.com/b24/bitrix24_desktop.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from dl.bitrix24.com, which is the official Bitrix24 vendor CDN (same company as bitrix24.com). The sha256sum is pinned, which mitigates substitution attacks at rest. However, the URL is a 'latest' redirect (bitrix24_desktop.deb without a version in the path), meaning the downloaded file could change between when the checksum was recorded and when a user builds — though makepkg will catch any mismatch. The real concern is that this is a closed-source Electron-style desktop application binary extracted directly from a vendor .deb and installed into /opt, with no source code review possible. The host is the official vendor domain, not a personal or unofficial mirror, so this is standard practice for proprietary AUR packages (similar to google-chrome, slack, zoom, etc.). The sha256 pin provides integrity protection. This pattern is common and accepted in the AUR for proprietary software. The cheaper model's MEDIUM rating is a marginal false positive — this is the official vendor host with a pinned checksum — but the executed binary nature of the payload keeps it from being fully 'clean'. Downgrading to medium is defensible only because of the non-versioned URL (floating latest), which means the pinned sha256 is the only guard against receiving a different binary than expected.