com.xuexiqiangguo.webclient.deepin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:25 source=("https://com-store-packages.uniontech.com/appstore/pool/appstore/x/xuexiqiangguo/com.xuexiqiangguo.webclient.deepin_1.0.1_amd64.deb"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from com-store-packages.uniontech.com, which is the Deepin/UOS app store CDN operated by Uniontech (the company behind Deepin Linux). This is not a random personal host — it is the official Deepin app store package repository — so the supply-chain risk is lower than a truly unofficial host. However, the package still installs an opaque prebuilt binary blob (extracted from a .deb) without any source build, and the host is not the upstream application developer's own distribution channel. The sha256sum provides integrity but not authenticity. The PKGBUILD also has a minor bug: it calls `tar -xvpf data.tar.*` without first extracting the .deb to get data.tar.*, meaning the build will likely fail as written (the .deb is not automatically unpacked). Despite the Deepin CDN being semi-official, distributing an executed prebuilt binary from a third-party app store CDN rather than the upstream developer's own release host remains a genuine medium-severity supply-chain concern.