libfftranscode

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:9 source=("http://ftp.osmocom.org/binaries/${pkgname}/${pkgname}-dev_${pkgver}_amd64.deb"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt proprietary binary .deb packages (a shared library libfftranscode.so) extracted from ftp.osmocom.org. Osmocom is a legitimate open-source telecom project and the maintainer's email domain matches (@osmocom.org), so this is not a random personal host — it is the official Osmocom binary distribution server. However, the library itself is proprietary with no available source, and the binaries are distributed as pre-compiled x86_64 shared libraries that will be loaded into other processes. The sha256sums provide some integrity protection against transit tampering, but there is no GPG signature verification. The core concern is that these are executed/loaded binary blobs from a host that, while associated with a known project, is not a major distro mirror or language ecosystem registry. This is a genuine medium-severity supply-chain concern: if the ftp.osmocom.org server were compromised or the files replaced, users would load malicious code into their processes. The cheaper model's assessment is essentially correct, though the host is more reputable than a random personal server.