brother-dcp-t536dw

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("https://download.brother.com/welcome/dlf106523/${_printer}pdrv-${pkgver}-1.amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from download.brother.com, which is Brother's official download server. The source is a vendor-supplied CUPS driver containing compiled binaries (a cupswrapper/filter binary 'brother_lpdwrapper_dcpt536dw' that gets symlinked into /usr/lib/cups/filter and executed by CUPS). There is no extract step for the outer .deb (no 'ar x' call), meaning the build() phase is missing and data.tar.gz must be extracted from the .deb somehow — this makes the PKGBUILD technically broken as written (no build() function to run 'ar x' on the .deb before the package() function tries to 'tar -xf data.tar.gz'). Despite the host being official Brother infrastructure, the package installs an unauditable prebuilt binary filter that runs with CUPS privileges, which is a genuine supply-chain concern. The sha256sum provides some integrity guarantee but cannot protect against a compromised upstream binary. This is a standard pattern for Brother printer drivers in the AUR and represents a real but accepted medium-level risk: executed proprietary binary from a vendor host with no source build option.