desktime

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("$pkgname-$pkgver.deb::https://desktime.com/updates/electron/linux?deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source URL 'https://desktime.com/updates/electron/linux?deb' is a query-parameter redirect endpoint rather than a versioned, stable artifact URL. This means the URL does not pin to a specific release — it resolves to whatever the server currently serves as 'latest'. The sha256sum provides a snapshot integrity check at packaging time, but if the upstream server silently rotates the binary (e.g. after a compromise or intentional swap), the checksum in the PKGBUILD would become stale and a future build without checksum verification could pull a different binary. More critically, the package() function runs 'bsdtar -xf data.tar.xz' without first extracting the .deb properly (missing the 'ar x' step to unpack the .deb into control.tar and data.tar.xz), suggesting the build may be broken or relies on a side-effect. The core concern is a prebuilt proprietary binary installed from a non-versioned endpoint — a real supply-chain risk for executed code, even though the domain is the official vendor domain. This is a genuine medium: not clearly malicious, but the floating URL pattern means the sha256 check is the only guard and future updates could silently change the binary.