ixxat-socketcan

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=('https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/ixxat/monitored/pc-interface-cards/socketcan-linux.gz?sfvrsn=3eb48d7_89&download=true')

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source is a prebuilt/compiled kernel module tarball fetched from hmsnetworks.blob.core.windows.net (Azure Blob Storage used by HMS Networks, the legitimate vendor of IXXAT products). HMS Networks is the actual upstream vendor for IXXAT USB-to-CAN hardware, and their official support/downloads page (hms-networks.com/support/general-downloads) is listed as the url. The blob.core.windows.net domain is a standard Azure CDN/storage endpoint commonly used by vendors for binary distribution. However, the concern is real: (1) the source URL contains a query string with a version counter (?sfvrsn=3eb48d7_89) that could theoretically be redirected server-side to different content without changing the URL, though the sha256sum provides integrity protection; (2) the tarball contains a compiled kernel module (ix_usb_can.ko) that is installed directly into the kernel module path and will be loaded with kernel privileges — this is executed binary code from a vendor blob store; (3) the prepare() step extracts a .tgz from inside the downloaded .gz, suggesting the build compiles from source (make is called), but the source of that .tgz is the vendor blob. The sha256sum mitigates silent substitution risk. Overall this is a legitimate vendor binary/source distribution via a non-standard (blob storage) URL with a checksum, which is medium risk due to the kernel-level execution surface and non-canonical URL pattern, but not clearly malicious.