eusoft-eudic-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:30 "${pkgname%-bin}-${pkgver}.AppImage::https://static-main.frdic.com/pkg/eudic.AppImage?v=${pkgver//./-}"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt AppImage binary from static-main.frdic.com (the official CDN of Eudic/Eusoft, the legitimate vendor of this Chinese dictionary software). The domain frdic.com is the known official domain for Eudic (French Dictionary/Eudic brand in China). The AppImage is extracted and its contents installed system-wide. While this is an unofficial AUR package wrapping a proprietary binary, the source host appears to be the legitimate vendor CDN rather than a personal/random host. However, there is no integrity verification beyond a sha256sum of the AppImage itself (which could be silently replaced at the URL since the version is embedded in a query parameter). The sha256sum provides some protection against substitution at download time. The LICENSE.html and wrapper script are listed in sources without URLs, meaning they must be pre-existing files in the AUR git repo — this is a minor concern but normal for AUR packages. Overall this is a standard proprietary binary packaging pattern for AUR: a prebuilt binary from what appears to be the official vendor CDN, with checksums. The medium rating is marginally justified due to the proprietary binary execution and the query-parameter versioning scheme, but this is a common and accepted AUR pattern for commercial software. Confidence is moderate because frdic.com is the legitimate Eudic vendor domain.