com.jisupdfeditor.deepin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:27 source=("https://com-store-packages.uniontech.com/appstore/pool/appstore/c/com.jisupdfeditor.deepin/com.jisupdfeditor.deepin_${pkgver}deepin4_i386.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt i386 .deb binary from com-store-packages.uniontech.com (the Deepin/UOS app store CDN, operated by Uniontech, the company behind Deepin Linux). This is a vendor-operated host rather than a personal/unofficial one, which reduces but does not eliminate risk. The package is a proprietary PDF editor wrapped in deepin-wine, so the binary is executed code. A sha256sum is provided, which pins the specific artifact. The main concerns are: (1) the source is a prebuilt binary from a Chinese commercial vendor's CDN with no GPG signature verification; (2) it is an i386 binary installed on x86_64 via deepin-wine-plugin-virtual, meaning the full wine+binary stack runs; (3) the package() function extracts the deb's data.tar directly without inspecting contents, and copies entries/ into /usr/share/. While uniontech.com is a real vendor host (not a random personal server), it is not a widely-audited upstream, and the lack of GPG/signature verification beyond sha256 means a CDN compromise or hash collision would go undetected. This fits the medium supply-chain risk profile: executed proprietary binary from a semi-official but unaudited vendor host with only a checksum for integrity.