daisyduck-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("${pkgname}-${pkgver}.deb::https://daisy.geexbox.org/releases/daisyduck_${pkgver}-1_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from daisy.geexbox.org, which is the project's own official website (the url= field matches the source host), so this is not a random personal host. However, it is still a prebuilt binary from a small, unofficial project host rather than a major forge or distribution mirror, and the package installs executed binaries without source compilation. The sha256sum is pinned, which mitigates substitution risk somewhat, but the host could be compromised or the binary could contain undisclosed code. This is a classic 'binary from unofficial host' medium-risk pattern — not clearly malicious, but a genuine supply-chain concern since users are trusting an opaque binary from a small project's own server. The PKGBUILD itself is also slightly broken in that it calls 'tar xvf data.tar.xz' without first extracting data.tar.xz from the .deb archive (the .deb is downloaded but never unpacked with ar/dpkg-deb before tar is called), making the build likely non-functional, but the security classification remains medium due to the prebuilt binary concern.