eshelper

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:18 source=("${pkgname}-${pkgver}.deb::https://static.frdic.com/pkg/${pkgname}.deb?v=${_date}")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt proprietary binary .deb from static.frdic.com, which is the CDN/static host used by Eudic (the developer of the Eudict/Eudic dictionary software family). This is actually the vendor's own distribution host, not a random personal server — frdic.com is the Chinese domain for the same company that operates eudic.net. The sha256sum is pinned, which mitigates substitution risk somewhat. However, the source is still a prebuilt closed-source binary from a proprietary vendor's CDN (not a GitHub release or other auditable artifact), and the binary is executed directly. The DLAGENTS override with a spoofed User-Agent is unusual but explained by the comment (server returns 404 without it). The prepare() step extracts data.tar.xz from the .deb and the package() step installs binaries from it. This is a standard pattern for repackaging proprietary .deb files in the AUR. The risk is real but typical for proprietary binary repacks: if frdic.com is compromised or serves a different binary, the sha256 check would catch it only if the sum is kept current. Overall this is a legitimate proprietary software repack with a pinned checksum from the vendor's own host — the medium rating is marginally justified due to the closed-source executed binary from a CDN, but it is a well-known pattern in AUR for proprietary software.