ifd-rutokens

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:14 source_x86_64=("https://download.rutoken.ru/Rutoken/Drivers_Unix/${pkgver}/Linux/x64/${pkgname}_${pkgver}_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from download.rutoken.ru, which is the official vendor download host for Aktiv Co (the Russian hardware token manufacturer). The sha512sum is present and pins the artifact, which mitigates opportunistic substitution. However, the binary is a closed-source prebuilt shared library/driver that will be loaded by pcsc-lite into privileged processes, and there is no way to verify it against a reproducible build or an independently signed release. The host is the official vendor domain (rutoken.ru), not a personal or third-party mirror, so this is a standard 'binary blob from vendor' pattern common in AUR driver packages. The risk is real but typical for proprietary hardware drivers: if the vendor's download server were compromised the sha512 check would catch a substitution, but the binary itself is opaque. This is a borderline medium/clean case; the medium rating is defensible because it is an executed binary (a PCSC driver loaded into pcscd) from a closed-source vendor with no source available, but it is not clearly more dangerous than other vendor binary driver packages in the AUR.