mybsmart

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source_i686=(https://s3-eu-west-1.amazonaws.com/res.bsmart.it/mybsmart_desktop/releases/production_v2/linux/MybSmart-$pkgver-ia32.deb)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt .deb binaries from an AWS S3 bucket (s3-eu-west-1.amazonaws.com/res.bsmart.it/...) which is the vendor's own S3 bucket (res.bsmart.it subdomain path), not a random personal host. The checksums are provided and pinned. However, S3 buckets are not the same as a vendor's official signed release infrastructure — there is no GPG signature verification, and S3 bucket contents can be replaced without changing the URL. The package extracts and installs a prebuilt binary (Electron app) with SUID chrome-sandbox, which is executed code from a non-standard distribution channel. This is a genuine medium-severity supply-chain concern: if the S3 bucket were compromised or the object replaced (and checksums updated in the PKGBUILD), arbitrary code would execute with elevated privileges. The checksums mitigate but do not eliminate the risk since they are only as trustworthy as the PKGBUILD itself. This is a real but non-malicious supply-chain concern consistent with MEDIUM.