localwp

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 source=("local-${pkgver}-linux.rpm::https://cdn.localwp.com/releases-stable/${pkgver}+${_build}/local-${pkgver}-linux.rpm")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD repacks a prebuilt proprietary binary (an Electron app) downloaded from cdn.localwp.com, which is the official CDN for the LocalWP project. The source is checksummed with sha1sums, providing basic integrity verification. The concerns are: (1) it installs a large prebuilt binary blob with no source code available for inspection; (2) it sets the SUID bit on chrome-sandbox, which is a known Electron requirement but still elevates privilege; (3) sha1 is a weak hash algorithm for integrity verification of a binary. The host cdn.localwp.com is the legitimate official distribution channel for LocalWP, so this is not an unofficial or personal host — it is the vendor's own CDN. This pattern (official vendor binary repack with weak checksum) is a genuine but low-grade supply-chain concern: if the CDN were compromised or the package updated without a checksum update, arbitrary code would execute. The SUID chrome-sandbox is standard Electron packaging practice. Overall this is a legitimate vendor binary repack with standard AUR patterns for proprietary software, but the combination of prebuilt binary + SUID + weak hash keeps it at medium rather than clean.