easel-driver

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:10 source=(https://s3.amazonaws.com/easel-prod/paperclip/sender_version_linux_installers/46/original/EaselDriver-$pkgver-x64.deb)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from an S3 bucket (easel-prod on amazonaws.com) belonging to Inventables, the legitimate vendor of the Easel/X-Carve product. The URL structure (paperclip/sender_version_linux_installers) is consistent with a Rails/Paperclip file attachment host used by Inventables. However, the source is a prebuilt binary blob extracted and installed directly without any signature verification beyond a weak MD5 checksum. MD5 is cryptographically broken and provides no meaningful integrity guarantee against a determined attacker. The binary is executed/installed as a system driver. While the S3 bucket appears to be the official vendor host and there is no evidence of malice, the combination of: (1) a prebuilt binary from a cloud storage bucket rather than a proper release page with GPG signatures, (2) only MD5 integrity checking, and (3) direct installation of extracted binary content constitutes a genuine supply-chain concern. If the S3 bucket were compromised or the object replaced, the MD5 would not protect users. This is a real medium-severity concern, not a false positive.