mockplus-dt-font-agent-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("${_pkgname}.zip::https://dt.mockplus.cn/plugin-downloads/MockplusDTFontAgentInstall_linux_v${pkgver}.zip")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): A prebuilt binary (DTFontAgent) is downloaded from dt.mockplus.cn, which is the CDN/download subdomain of the Mockplus product (mockplus.cn is the legitimate vendor site for Mockplus DT). The domain is not a random personal host — it is the official vendor's download infrastructure. However, the package installs a closed-source, prebuilt executable directly into /usr/bin and registers it as a systemd user service, with no source code to audit. This is a genuine supply-chain concern: if the vendor's download host were compromised, or if the binary contains undisclosed functionality, users would be running arbitrary vendor code with no transparency. The sha512sum provides integrity checking against the specific release, but does not mitigate trust in the vendor binary itself. This pattern (official vendor binary from vendor CDN, no source) is standard for -bin AUR packages and is not unusual or malicious, but the executed prebuilt binary from a non-auditable host warrants a medium rating rather than clean.