bluej-fri

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD pulls a prebuilt .deb from bluej.org (the official BlueJ project domain) with a proper sha256 checksum, so the main binary is verified. Two git sources (checkstyle4bluej from MetroCS on GitHub, and BlueJFRI from infjava on GitHub) use SKIP for checksums, which is normal/expected for git+https sources since git itself provides integrity via commit hashes — though no specific commit or tag is pinned, meaning the tips of those branches are fetched. The checkstyle jar installed is a well-known open-source BlueJ extension. The BlueJFRI repo only contributes templates and a checkstyle XML config (data files), not compiled code that gets executed at build time. The lack of pinned commits is sloppy and introduces a theoretical supply-chain risk if those GitHub repos were compromised, but this is a common AUR pattern and the repos are small, purpose-specific educational tools. No binaries are downloaded from unofficial hosts, no obfuscation, no exfiltration. The cheaper model's MEDIUM rating is an over-call; this is low severity at most.