efisc2024-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("https://efisc.kttg.ch/update/eFisc/2024/efisc2024_1.0.10-69_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 .deb binary from efisc.kttg.ch and installs it directly. The url field points to the official Swiss canton of Thurgau tax authority page (steuerverwaltung.tg.ch), and efisc.kttg.ch appears to be the canton's own update/distribution server for their eFisc tax software (kttg = Kanton Thurgau), making this a plausible official vendor host rather than a random personal server. However, the use of sha256sums=('SKIP') means the binary is never verified, and the host is not a well-known public mirror — it is an institutional subdomain that cannot be independently confirmed as official without out-of-band verification. Installing an unverified prebuilt binary from any host, even a plausibly official one, constitutes a real supply-chain risk: if the host is compromised or the URL is substituted, arbitrary code runs on the user's system. The pkgrel=69 also suggests frequent silent updates with no checksum pinning. This is a genuine medium-severity concern: executed binary from a non-mainstream host with no integrity check.