easyroam-desktop-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=('http://packages.easyroam.de/repos/easyroam-desktop/pool/main/e/easyroam-desktop/easyroam_connect_desktop-1.4.3%2B1.4.3-linux.deb')

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from packages.easyroam.de, which is the official distribution host for the easyroam-desktop application (easyroam is a legitimate eduroam-based Wi-Fi profile management service used by German universities). The sha256sum is pinned, which mitigates substitution attacks at the time of packaging. However, the source is a prebuilt binary from a vendor-controlled host over plain HTTP (not HTTPS), meaning the download is not transport-encrypted and could be intercepted/substituted in transit. The binary is then extracted and installed directly without any signature verification beyond the sha256. This is a real supply-chain concern: the HTTP transport allows MITM substitution of the binary, and the sha256 only protects against post-download tampering if the checksum itself hasn't been compromised. The package also uses an .install hook which could execute arbitrary code at install time. These factors together justify a medium rating — it's a legitimate vendor package but delivered insecurely (HTTP) with no GPG signature verification, and the installed artifact is executed code from a third-party host.