eterm8

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:14 source=(http://www.gbgmv.se/dl/linux/$pkgname\_$pkgver\_amd64.deb)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt .deb containing multiple compiled binaries (eterm8, simserver, arm-none-eabi-as, arm-none-eabi-gdb, arm-none-eabi-ld, arm-none-eabi-objcopy, arm-none-eabi-objdump) from a personal/educational website (gbgmv.se) and installs them directly without building from source. The binaries are cross-toolchain components and an IDE that will execute with user privileges. The host appears to be a Swedish university-related personal site for a course on machine programming, which is plausible context, and both md5 and sha256 checksums are provided, which mitigates (but does not eliminate) the risk of in-transit tampering. However, the fundamental supply-chain concern remains: these are closed-source prebuilt executables from a non-authoritative personal host with no reproducibility. If the host is compromised or the maintainer uploads malicious binaries, users would execute arbitrary code. This is a genuine medium-severity supply-chain risk, not a false positive.