hotdog

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

• PKGBUILD:19 md5sums=($(curl "https://8bitoperahouse.com/download/HOTDOGbuntu_${pkgver}_amd64.deb.md5" | cut -f1 -d' '))

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:18 source=("https://8bitoperahouse.com/download/HOTDOGbuntu_${pkgver}_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary .deb from 8bitoperahouse.com, which is a personal/unofficial host rather than an official distribution channel. The package installs compiled binaries directly into the system. Two checksum concerns exist: (1) the md5sums line uses command substitution with curl at parse time to fetch the checksum from the same untrusted host — meaning if that host is compromised, both the binary and its checksum are served by the attacker, completely defeating integrity verification; (2) the sha256sum is a static value which provides some protection but only if it was captured correctly at PKGBUILD creation time. The dynamic md5sums fetch is the key supply-chain risk: it's not a source= URL that makepkg verifies, it's a shell substitution that runs curl during PKGBUILD sourcing, fetching a checksum from the same host as the binary. A compromised host could serve a malicious binary alongside a matching md5 checksum, bypassing the md5 check entirely. The sha256sum provides a partial mitigation but the overall pattern is a genuine medium-severity supply-chain concern: executed binary from an unofficial personal host with a self-referential integrity check.