fawkes-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:14 source_x86_64=("https://mirror.cs.uchicago.edu/fawkes/files/$pkgver/fawkes_binary_linux-v$pkgver.zip")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs a prebuilt binary ('protection') from mirror.cs.uchicago.edu, which is the University of Chicago CS department mirror — the same institution that hosts the official Fawkes project (sandlab.cs.uchicago.edu). This is not a random personal host; it is the project's own institutional mirror. The binary has a proper sha256sum (ff74e9fa...) for the architecture-specific zip, so integrity is verified. The only real concern is that the LICENSE file has 'SKIP' for its checksum, which is sloppy but not a security risk since it is pure text data. The binary itself is a prebuilt executable installed to /usr/bin, which is inherently a supply-chain trust decision, but the source is the official project host with a pinned checksum. This is a legitimate 'bin' package pattern common in the AUR. The medium rating from the cheaper model was largely a false positive based on the non-standard host, but the host is actually the official project mirror with checksum verification. Downgrading to low/clean is appropriate; the only remaining concern is the SKIP'd checksum on the LICENSE file, which is trivially low risk.