jmars

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("http://jmars.mars.asu.edu/downloads/jmars_5/jmars_public/jmars_5_public.sh" "jmars.desktop")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and executes a prebuilt shell installer script (jmars_5_public.sh) from jmars.mars.asu.edu, which is Arizona State University's official JMARS project host. This is the legitimate upstream vendor host for this NASA/ASU Mars GIS tool, not a personal or unofficial mirror. However, the pattern of executing a downloaded shell installer script during package() is a genuine supply-chain concern: the script runs with package() privileges, its contents are opaque (it's a self-extracting installer), and any compromise of the ASU host or the file would result in arbitrary code execution on the builder's system. The sha256sum provides integrity checking against a known-good hash, which mitigates substitution attacks somewhat. The host is institutional/official rather than personal, reducing (but not eliminating) the risk. This is a borderline medium: the execution of an opaque installer binary/script from an external host during build is a real supply-chain concern even if the host is legitimate, but it is not clearly malicious and the checksum is present.