concordium-desktop-wallet-testnet-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("https://distribution.testnet.concordium.com/tools/linux/concordium-desktop-wallet-testnet-$pkgver.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from distribution.testnet.concordium.com, which is a subdomain of concordium.com — the official Concordium blockchain project's distribution infrastructure. This is not a random personal host; it follows the pattern of official vendor distribution endpoints (compare distribution.concordium.com for mainnet). The sha512sum is present and pins the specific binary. However, the concern is real: a prebuilt, closed-source Electron/desktop wallet binary is being executed directly on the user's system with no source build, and the host, while appearing official, is not a well-known package mirror. If the host were compromised or the binary substituted, the sha512 check would catch it only if the attacker also updated the PKGBUILD. The binary handles cryptocurrency wallet operations, making it a high-value target. This is a legitimate medium-severity supply-chain concern: executed binary from a vendor-controlled but non-standard host, with no source build option. Not clearly malicious, but the risk profile (crypto wallet, prebuilt binary, testnet subdomain) warrants the medium rating.