harrison-32-bus-vst-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:10 source=("https://softwareupdate.solidstatelogic.com/DownloadManager/InstallersLinux/Harrison_32Bus_v${pkgver}-linux-amd64.tar.gz")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary (a VST/VST3 plugin .so) from softwareupdate.solidstatelogic.com. Solid State Logic (SSL) is a legitimate, well-known professional audio hardware and software company, and Harrison Audio is a related brand under the SSL umbrella. The domain solidstatelogic.com is the official SSL domain, and softwareupdate.solidstatelogic.com is a plausible official software update endpoint for their products. However, the package installs a prebuilt binary shared library directly into the system without any source build, which is the standard concern for binary AUR packages. The sha256sum is pinned, which mitigates substitution risk. The risk is the standard medium concern for any prebuilt binary from a vendor host: if the host were compromised or the binary were malicious, it would execute arbitrary code in any DAW loading the plugin. Given that SSL/Harrison is a legitimate vendor and the domain appears official, this is a normal 'bin' AUR package pattern rather than a suspicious unofficial host, but the prebuilt binary nature keeps it at medium rather than clean.