electrum-nmc-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:29 source=("electrum-nmc.AppImage::https://www.namecoin.org/files/electrum-nmc/electrum-nmc-${pkgver}/electrum-nmc-nc${pkgver}-x86_64.AppImage"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt AppImage binary (an executable that bundles its own runtime and runs directly) downloaded from namecoin.org, which is the official project website. The SHA256 checksum is verified, which mitigates casual tampering. However, the binary is an AppImage — a self-contained executable that runs with user privileges and contains its own bundled libraries — downloaded from a third-party host (even if official). There is no GPG/PGP signature verification, only a SHA256 checksum hardcoded in the PKGBUILD itself. If namecoin.org were compromised or the file replaced, the checksum in the PKGBUILD would need to be updated to detect it, but the PKGBUILD maintainer controls that checksum. The maintainer email is obfuscated via base64 in a comment, which is cosmetic and not a security concern. The GitHub sources are pinned to a specific commit hash, which is good practice. Overall this is a legitimate medium-risk pattern: an executed binary from an official but non-Arch-controlled host, with checksum-only (no cryptographic signature) verification. This matches the standard AUR -bin package pattern and is not clearly malicious, but represents a real supply-chain concern inherent to distributing prebuilt binaries.