mobirise

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:10 source=("https://download.mobirise.com/MobiriseSetup.deb"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from download.mobirise.com (the official Mobirise vendor download subdomain) and installs it directly into /opt. While this is the vendor's own distribution host, there is no versioned URL — the URL 'MobiriseSetup.deb' is a floating/latest pointer, meaning the sha256sum pinning is the only integrity check. If the vendor updates the file at that URL without changing the checksum (or if the checksum in the PKGBUILD drifts from the actual file), users could receive a different binary. The sha256sum is hardcoded, which provides some protection, but the lack of a versioned URL means the PKGBUILD will silently break or serve stale content when the vendor updates. More importantly, this is a closed-source Electron application binary extracted from a .deb and installed without any signature verification beyond the sha256. The host is the official vendor domain (not a personal/unofficial host), which reduces but does not eliminate supply-chain risk. This pattern — unversioned floating binary URL from a vendor host with only a hash check — is a genuine medium-severity supply-chain concern: if the vendor's download infrastructure is compromised or the hash is not kept current, users execute arbitrary binaries. The desktop file has 'SKIP' for its checksum, which is a minor additional concern but the desktop file itself is not executed code.