meshcmd-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("meshcmd::https://alt.meshcentral.com/meshagents?meshcmd=6")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 binary from alt.meshcentral.com (a subdomain of meshcentral.com, which is the official MeshCentral/MeshCommander project domain operated by Intel/AMT team). The URL uses a query-parameter dispatch (?meshcmd=6) rather than a versioned release path, which means the downloaded binary is not pinned to a specific release artifact by URL — however, the b2sum provides integrity verification. The host is a subdomain of the official project domain (meshcentral.com), not a random personal host, so the supply-chain risk is lower than a truly unofficial mirror. Nevertheless, the binary is executed directly, there is no source build, and the download URL is dynamic/non-versioned (the same URL could serve a different binary if the server changes what '6' maps to, though the checksum would catch substitution). The real concern is that this is a prebuilt binary installed to /usr/bin with no source compilation, from a non-GitHub-releases URL, which is a legitimate medium supply-chain concern even with a checksum. The checksum mitigates active interception but not a compromised upstream server that updates the binary and the PKGBUILD simultaneously. Overall: genuine medium risk (prebuilt binary from a non-standard release URL), but not high since the domain is the official project domain and a strong checksum is present.