confirmo-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("confirmo_${pkgver}_amd64.deb::https://updates.confirmo.love/confirmo_${pkgver}_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary .deb from updates.confirmo.love, which is the vendor's own update/distribution host for the Confirmo desktop AI assistant application. While this is not a well-known major vendor, it is the official distribution channel for this specific proprietary application (consistent with the product URL confirmo.love). The binary is extracted and installed directly without any signature verification beyond a weak MD5 checksum. This is a classic AUR -bin package pattern for proprietary software distributed via the vendor's own CDN/update server. The concern is real but not elevated: the host appears to be the legitimate vendor update server, not a random personal host, but there is no GPG/SHA256 signature verification, and the MD5 checksum provides minimal integrity assurance. This is a genuine medium-severity supply-chain concern — a prebuilt executable from a non-mainstream host with only MD5 verification — but there is no evidence of active malice or substitution.