eductool-desktop-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("Eductool-desktop_${pkgver}_amd64.deb::https://eductool.com/linux-deb?utm_campaign=aur_archlinux&utm_medium=linuxdeb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary .deb from eductool.com via a tracking/redirect URL (query parameters suggest a redirect rather than a direct file path). The binary is a Tauri-based desktop application that will be executed on the user's system. While the sha256sum is present and the domain matches the official project URL, the use of a redirect/tracking URL rather than a stable, versioned direct download path is a supply-chain concern: the server could silently serve a different binary to the same URL at any time without changing the checksum in the PKGBUILD. The maintainer email matches the project domain, and the depends are consistent with a legitimate Tauri app. The risk is real but not clearly malicious — a prebuilt binary from what appears to be the vendor's own domain, but served via a mutable redirect URL with no reproducible build process. This fits the medium category: executed binary from a non-standard/mutable URL, even if the host is the apparent vendor.