f4transkript

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=('https://download.audiotranskription.de/f4transkript-7.0.6-linux.tar.gz')

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball from download.audiotranskription.de, which is the official vendor's download subdomain (audiotranskription.de is the project's own domain, matching the url= field). The binary is copied directly into /usr/bin without any wrapper or script manipulation. This is a legitimate vendor-distributed closed-source application installed as a prebuilt binary — a common AUR pattern for proprietary software. The sha256sum is pinned, providing integrity verification against accidental corruption or CDN tampering. However, the binary is executed code from a closed-source vendor with no source available for audit, and there is no GPG signature verification. The risk is the standard supply-chain concern for any prebuilt proprietary binary: if the vendor's download server is compromised or the vendor acts maliciously, the binary runs with user privileges. This is a genuine medium-severity concern (prebuilt binary from a non-open-source host), not a false positive, but it is also not an active attack — it is the normal risk profile for proprietary AUR packages.