efisc2025-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("https://efisc.kttg.ch/update/eFisc/2025/efisc2025_1.0.4-73_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb package from efisc.kttg.ch, which is the official distribution host for eFisc, the tax declaration software for the canton of Thurgau (Switzerland). The URL domain kttg.ch corresponds to 'Kanton Thurgau' (kt = Kanton, tg = Thurgau), and the official page linked in the url= field (steuerverwaltung.tg.ch) is the cantonal tax authority. So the host is plausibly official/semi-official government infrastructure rather than a random personal host. However, the use of sha256sums=('SKIP') means there is no integrity verification of the downloaded binary, which is a genuine supply-chain concern: if the host is compromised or the binary is silently updated, users would execute arbitrary code with no checksum protection. The binary is also executed directly (installed as-is from the .deb). This combination — executed binary + no checksum — warrants medium severity even if the host appears legitimate, because SKIP provides zero protection against substitution attacks.