corluma-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source_x86_64=("https://www.dropbox.com/s/ygv7kvu7bqsk943/corluma_0.30-09.deb?dl=1")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary .deb from Dropbox (dropbox.com), which is a personal/unofficial file-hosting service rather than an official vendor release host or a well-known ecosystem mirror. The package extracts and installs the binary directly. The concerns are: (1) Dropbox links can be silently replaced by the link owner at any time — the sha512sum provides integrity checking for the current file but does not prevent future substitution if the Dropbox link is swapped; (2) the binary is executed/installed directly without source build, so any compromise of the hosted file results in code execution on the user's system; (3) the sha512sum provided has an odd length (127 hex chars instead of 128), which may indicate a truncation error making integrity verification unreliable. These factors together constitute a genuine supply-chain concern: an unofficial, mutable host serving an executed binary with potentially broken checksum verification. This is a real medium-severity issue, not a false positive.