fcitx-sogoupinyin

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

• PKGBUILD:25 curl -s $url | grep -o "https://[0-9a-z:\/\._-]*/$filename" | xargs curl -o $startdir/$filename

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it MEDIUM (confidence 72%): The PKGBUILD dynamically resolves the download URL at build time by scraping the Sogou website and extracting a URL matching a pattern, then downloads a prebuilt binary .deb from whatever URL that page returns. While a sha256sum check is performed afterward, the URL is not fixed in source=() and is resolved at runtime from a third-party page — meaning if the Sogou website is compromised or the URL pattern matches a different host, a malicious binary could be fetched and installed. The binary is a prebuilt proprietary executable (fcitx input method) that gets installed system-wide. This is a genuine supply-chain concern: the source URL is not pinned, the download happens outside of makepkg's normal source verification framework, and the binary is executed code from a vendor host whose content can change. The sha256sum mitigates but does not eliminate the risk (it only catches changes after the fact if the hardcoded hash is kept current). This pattern — dynamic URL resolution + prebuilt binary + manual checksum outside makepkg — is a real medium-severity supply-chain concern, not a false positive.