juicefs-cloud

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("juicefs-$pkgver-$pkgrel::https://juicefs.com/static/juicefs")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary directly from juicefs.com/static/juicefs — a URL that has no version component, meaning it always fetches whatever the current binary is at that path, regardless of pkgver. While juicefs.com is the official vendor domain, the URL is a static/unversioned endpoint that could silently serve a different binary at any time. The sha512sum is present and non-SKIP, which provides some integrity guarantee for the specific binary captured at packaging time, but since the URL is unversioned, any future build or re-download could fetch a different binary with a different hash (causing a build failure or, if the hash were SKIP, silently installing a different binary). The binary is installed as an executable in /usr/bin. The core concern is: executed binary from an unversioned URL on the vendor's own domain, with a pinned checksum that only protects the initial fetch. This is a real but moderate supply-chain concern — not clearly malicious, but the unversioned URL pattern means the checksum provides weaker-than-usual protection. Rated medium.