ld64

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 92%): Multiple serious issues: (1) The package() function re-downloads the .deb at install time via wget from assets.checkra.in, completely bypassing the sha256sum integrity check that was performed on the source= download — the runtime wget fetch is entirely unverified. (2) It uses 'sudo cp -r usr/ /' inside the package() function, which is a severe packaging violation that directly writes files to the live root filesystem instead of into $pkgdir, bypassing pacman's package management entirely. (3) assets.checkra.in is the checkra1n jailbreak project's asset host — while not inherently malicious, it is an unofficial third-party host for a prebuilt binary (a linker, ld64) that gets executed as a system tool. The combination of: unverified runtime binary download + direct root filesystem modification via sudo makes this a genuine code-execution/supply-chain risk regardless of intent. The sha256sum on the source= entry is irrelevant since the actual installed binary comes from the second unverified wget call.