clash-for-windows-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:28 "${pkgname}-${pkgver}-x86_64-linux.tar.gz::https://web.archive.org/web/20231020093608if_/https://objects.githubusercontent.com/github-production-release-asset-2e65be/153697551/c6e9c14e-0049-4e02-8ea5-12d8fabf9f9d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20231020%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20231020T093608Z&X-Amz-Expires=300&X-Amz-Signature=f07dabe509fbcb04ed7d0491a41bce68417ce24f04792124b300344c623114b4&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=153697551&response-content-disposition=attachment%3B%20filename%3DClash.for.Windows-0.20.39-x64-linux.tar.gz&response-content-type=application%2Foctet-stream"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt Electron binary (Clash for Windows) sourced via web.archive.org, which acts as an intermediary/mirror for what were originally GitHub release assets. The upstream project (Fndroid/clash_for_windows_pkg) was taken down/abandoned, so the maintainer is using Wayback Machine snapshots of the original GitHub release asset URLs. The sha256sums are present and pinned, which mitigates the risk of the archive serving different content — if the checksum matches, the binary is the same one that was originally distributed. However, there are genuine concerns: (1) the binary is an Electron app with embedded Node.js and a Clash proxy core, executing with broad network access; (2) the source is a prebuilt binary from a defunct/removed upstream project routed through an archival service rather than a live official host; (3) web.archive.org could theoretically serve a different snapshot if the URL parameters are manipulated, though the sha256 pinning largely addresses this. The checksums provide meaningful integrity protection, but the combination of a prebuilt binary from a defunct project mirrored through an archival service rather than a canonical release host is a genuine supply-chain concern that warrants medium severity.