libevdevc

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=('https://apt.galliumos.org/pool/main/libe/libevdevc/libevdevc_3.0_amd64.deb')

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb package from apt.galliumos.org, which is the GalliumOS project's own apt repository. GalliumOS is a legitimate Linux distribution based on Xubuntu targeting Chromebooks, and libevdevc is indeed a Chromium OS libevdev fork maintained under the hugegreenbug GitHub account. However, the concern is real: this is a prebuilt binary (not source-compiled) pulled from a third-party apt mirror rather than from the upstream GitHub releases or built from source. The md5sums check provides weak integrity verification (MD5 is cryptographically broken). If apt.galliumos.org were compromised or the package substituted, arbitrary native code would be installed. This is a genuine supply-chain concern — an executed binary from a non-primary, non-official host — which justifies MEDIUM. It is not HIGH because GalliumOS is a known legitimate project and the URL is consistent with the package's stated origin, but the pattern of installing prebuilt binaries from a third-party apt repo without source compilation or stronger integrity checks (e.g., SHA256/GPG) is a real risk.