i4tools-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:33 "${_pkgname}_${pkgver}_amd64.deb::https://d-updater.i4.cn/i4tools9/download/linux/x64/${_pkgname}_${pkgver}_amd64.deb"
• PKGBUILD:34 "https://www.i4.cn/copyright.html"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt proprietary binary application (i4tools, an iOS device management tool from a Chinese vendor) downloaded from d-updater.i4.cn, which is a subdomain of the vendor's own domain (i4.cn). The host is not a random personal server — it appears to be the vendor's own update/distribution CDN. A SHA256 checksum is present. However, the core concern remains: this is a closed-source, prebuilt binary from a proprietary Chinese vendor being installed system-wide with full user privileges, and the binary is not reproducible or auditable. The supply-chain risk is real (if the CDN is compromised or the vendor pushes a malicious update, users are affected), but this is the standard risk profile for any proprietary binary package in the AUR (e.g., zoom, discord, etc.). The cheaper model's concern about the host being 'non-whitelisted' is somewhat overstated since d-updater.i4.cn is the vendor's own infrastructure. The medium rating is still appropriate given the opaque prebuilt binary nature and the fact that it installs executables that run with user privileges, but this is not elevated to high as there is no evidence of active malice or obfuscation.