edrawproject-cn

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:26 source_x86_64=("${pkgname}_${pkgver}.deb::https://cc-download.wondershare.cc/prd/edrawproj_full5376.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt x86_64 .deb binary from wondershare.cc (cc-download.wondershare.cc), which is Wondershare's CDN/download host for their Chinese market products. While this is a plausible official vendor host for Wondershare/EdrawSoft software, it is not a well-known canonical distribution channel and the URL contains an opaque filename (edrawproj_full5376.deb) rather than a versioned path. The package installs a prebuilt proprietary binary directly into /opt and creates a symlink in /usr/bin, meaning the downloaded binary is executed on the user's system. A sha256sum is provided, which mitigates substitution risk somewhat, but the source host is not a standard distribution mirror. The prepare() function also has a suspicious pattern: it calls `tar -xf data.tar.xz` without first extracting the .deb (the `ar -x` step is commented out), which means it relies on a data.tar.xz already being present in $srcdir — this is actually how makepkg handles .deb sources in some configurations, but it's non-obvious. Overall: prebuilt proprietary binary from a non-canonical CDN host with an opaque URL constitutes a genuine medium supply-chain concern, consistent with the original rating.