mtpdk

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:14 source=("$(curl -s 'https://www.powerdrumkit.com/API_linux_AUR.php?product=mtpdk2_free&format_and_os=VST3-64bit-Linux' | sed -n 's/.*"source_url":"\([^"]*\)".*/\1/p' | sed 's#\\/#/#g')"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source URL is constructed at PKGBUILD parse time by executing a live curl call to powerdrumkit.com's API, which returns a URL that is then used as the actual download source. While the sha256sum provides integrity verification of the final downloaded binary (a VST3 .so shared library that will be installed as executable code), there are two real concerns: (1) the actual download URL is opaque and determined at runtime by a third-party API response, meaning the source array in the PKGBUILD does not statically declare where the binary comes from — this makes reproducibility and auditing difficult; (2) the downloaded artifact is a pre-compiled binary (.so) from the vendor's own infrastructure, not built from source. However, mitigating factors are significant: the vendor is the official upstream (powerdrumkit.com), the sha256sum is hardcoded and will catch any tampering of the binary content, and this pattern (vendor API redirect to CDN) is used by legitimate commercial freeware distributors. The risk is real but not clearly malicious — it's a supply-chain concern because the binary's origin URL is dynamic and the API could theoretically redirect to a different host, but the checksum anchors the content. This fits the medium category: an executed binary from a non-fully-transparent source chain.