com.tencent.docs.deepin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 source=(https://com-store-packages.uniontech.com/appstore/pool/appstore/c/com.tencent.docs.deepin/com.tencent.docs.deepin_${pkgver}deepin1_i386.deb)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt i386 .deb binary from com-store-packages.uniontech.com, which is the Deepin/UOS app store package repository operated by Uniontech (the company behind Deepin Linux). This is not an arbitrary personal host — it is the official Deepin app store CDN used by deepin-store packages, and many AUR deepin-wine packages use this same host. However, it is still a third-party binary (a Wine-wrapped Tencent Docs app) from a non-upstream host that is not the official Tencent distribution channel, and the package installs executed binaries (run.sh, the wrapped Wine application) directly from this .deb. There is a single sha256sum provided which gives some integrity protection, but no GPG signature verification. The supply-chain concern is real but moderate: the host is a known Deepin ecosystem CDN rather than a random personal server, but it is still an unofficial redistribution of a proprietary binary. This fits the medium category: executed code from an unofficial/third-party host with no signature verification beyond a bare checksum.