cajviewer-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:35 source=("https://download.cnki.net/net.cnki.cajviewer_${pkgver}_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Debian binary package (.deb) from download.cnki.net, which is the official download server for CNKI (China National Knowledge Infrastructure), the vendor of CAJViewer. The host is not a random personal server — it is the legitimate vendor's distribution infrastructure. A sha256sum is provided, which pins the specific binary. However, the package installs a closed-source, prebuilt binary executable (cajviewer) and several bundled shared libraries (including libreaderex_x64.so, a proprietary reader library) that cannot be audited. The binary originates from a Chinese state-affiliated academic publisher, and there is no GPG signature verification beyond the sha256 checksum. The risk is a standard 'binary blob from a closed-source vendor' scenario: if the upstream host is compromised or the vendor ships malicious code, it executes on the user's system. This is a genuine medium-severity supply-chain concern (unauditable prebuilt binary from a non-Western vendor with no cryptographic signing beyond a hash), but there is no evidence of active malice, obfuscation, or payload injection. The cheaper model's rating of MEDIUM is appropriate.