morgen-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:16 source=("${pkgname}_${pkgver}-${pkgrel}.xz::https://dl.todesktop.com/210203cqcj00tw1/versions/${pkgver}/linux/deb/x64" morgen)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary from dl.todesktop.com, which is the official distribution CDN used by ToDesktop (the platform Morgen uses to build and distribute its Electron app). This is the legitimate upstream host for Morgen releases, not a personal or unofficial mirror. However, the concern is real: (1) the source URL is not a GitHub release or a well-known package registry but a commercial build-platform CDN, meaning users must trust ToDesktop's infrastructure; (2) the package() function extracts a nested data.tar.xz from the downloaded .xz without verifying it separately — the b2sum covers the outer archive but the inner tar is extracted directly into pkgdir, which is standard for .deb repackaging but worth noting; (3) a prebuilt Electron binary with no source build is inherently a supply-chain trust decision. The b2sums are present and pin the download, which mitigates substitution attacks significantly. Overall this is a legitimate but non-standard distribution pattern (prebuilt binary from a commercial CDN), which fits the medium category — not a clear attack, but a real supply-chain trust concern that users should be aware of.