distccd-x86_64

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:14 source_armv7h=("http://repo-ck.com/PKG_source/x-tools86-armv7h-$_date.tar.zst"{,.sig})

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt cross-compiler toolchain binaries (x-tools86-*.tar.zst) from repo-ck.com, a personal/unofficial host operated by the maintainer graysky. These binaries are extracted and installed into /opt and executed as a cross-compilation toolchain. The PGP signature verification is in place (validpgpkeys with graysky's key), but the signature checksums for the .sig files are 'SKIP', meaning the signature files themselves are not integrity-checked — only the tarball b2sums are verified. The tarballs do have non-SKIP b2sums, so integrity of the downloaded binaries is checked via b2sum. The PGP key 4E22BB637E26407D5DEE550988A032865EE46C4C belongs to graysky who is also the maintainer and the operator of repo-ck.com, so this is a self-hosted binary by the package author. The real concern is that these are executed prebuilt binaries from a personal host rather than an official upstream or distro mirror. If repo-ck.com were compromised or the key were compromised, malicious binaries could be installed. This is a genuine medium supply-chain risk: unofficial host, prebuilt executed binaries, SKIP on .sig b2sums (though PGP verification should still occur at pacman level). Not clearly malicious, but not clean either.