deis-workflow-cli-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("https://storage.googleapis.com/workflow-cli-release/v${pkgver}/deis-v${pkgver}-linux-amd64")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary from storage.googleapis.com/workflow-cli-release, which is a Google Cloud Storage bucket. While GCS is a reputable hosting platform, this is not the project's primary GitHub release infrastructure (github.com/deis/workflow-cli/releases). The bucket 'workflow-cli-release' is controlled by whoever owns that GCS bucket, and if that bucket were misconfigured, abandoned, or the project's GCS credentials compromised, an attacker could substitute a malicious binary. The binary is installed directly as an executable (/usr/bin/deis). Checksums (sha256 + md5) are present, which mitigates substitution risk somewhat, but does not address the question of whether the originally uploaded binary was trustworthy. The Deis project is effectively abandoned (Deis Workflow was deprecated around 2017), meaning the GCS bucket may no longer be actively maintained or monitored, increasing the risk of bucket takeover or neglect. This is a genuine medium-severity supply-chain concern: a prebuilt binary from a non-primary, potentially unmaintained hosting location installed as an executable.