circle

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:10 source=(https://www.circle-lang.org/linux/build_`curl 'https://www.circle-lang.org/linux/?C=M;O=D' -s | grep -Po '(?<=build_(?!latest)).+?(?=\.tgz)' | head -1`.tgz)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt closed-source binary compiler from circle-lang.org (the official upstream vendor site for the Circle C++ compiler), but does so via a dynamically constructed URL that scrapes the directory listing at build time to find the latest build number. Two real concerns exist: (1) The checksum is SKIP, so there is no integrity verification of the downloaded binary. (2) The URL is constructed by executing curl and parsing HTML at makepkg time, meaning a compromised or MITM'd circle-lang.org could serve a different binary without detection. The host itself (circle-lang.org) is the legitimate upstream for this compiler, so this is not an unofficial/personal host, but the dynamic URL construction combined with SKIP checksum and execution of a prebuilt binary creates a genuine supply-chain risk. The pkgver() function also executes the downloaded binary (./circle -version) before the package() step, meaning arbitrary code from the downloaded tarball runs during the build. This is a real medium-severity concern: not clearly malicious, but a prebuilt binary executed with no integrity check from a host that, while official, could be compromised or subject to MITM.