focusatwill-appimage

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 https://faw-desktop.s3.amazonaws.com/${_filename}

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt AppImage binary from an S3 bucket (faw-desktop.s3.amazonaws.com) that is the vendor's own distribution channel for the Focus@Will desktop app. The AppImage is extracted and executed during the prepare() phase (--appimage-extract) and then installed as a setuid-755 executable. While S3 is not an 'official' distro mirror, this appears to be the upstream vendor's own S3 bucket used for distribution, which is a common pattern for Electron/AppImage apps. A sha512sum is provided, which mitigates substitution attacks. However, the source is still a prebuilt binary from a non-auditable third-party host (not a VCS tag or official package repository), and the binary is executed during build. This is a genuine medium-severity supply-chain concern: if the S3 bucket were compromised or the object replaced (the checksum would catch this, but only if the PKGBUILD is kept up to date), malicious code could be delivered. The sha512 checksum provides meaningful but not complete protection. This is a legitimate medium — not a false positive — but also not a high-severity active attack.