firefox-extension-connective-signing

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("connective_signing_extension-${pkgver}.xpi::https://plugin.connective.eu/software/firefox/connective_signing_extension-${pkgver}.xpi")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary (.xpi Firefox extension) from plugin.connective.eu, which is the official vendor website for Connective (a Belgian e-signing company), not a personal or unofficial host. The sha512sum is pinned, which mitigates casual tampering. However, the source is a prebuilt binary from a corporate vendor host rather than Mozilla AMO or a major public forge — if the vendor host were compromised or the binary swapped, the pinned hash would catch it, but the hash itself cannot be independently verified against a transparency log. The extension is installed system-wide into Firefox's extensions directory and will execute as browser-privileged JavaScript. This is a legitimate vendor product with a real corporate identity, but the supply-chain concern of a prebuilt binary from a non-Mozilla-AMO host is real enough to warrant medium rather than clean, consistent with AUR policy on prebuilt binaries from unofficial sources.