myoffice-standard-home-edition-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:18 source=("${_my_pkg}-${pkgver}.deb::https://preset.myoffice-app.ru/MyOfficeStandardHomeEdition.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from preset.myoffice-app.ru, which appears to be an official distribution host for MyOffice (a Russian office suite by New Cloud Technologies). The domain myoffice-app.ru is plausibly an official CDN/preset distribution endpoint for the vendor (myoffice.ru). However, it is not the primary vendor domain, and there is no way to independently verify this is an official mirror vs. a third-party host. The .deb is extracted and its binaries are installed directly onto the system. A sha256 checksum is present, which mitigates tampering risk for the specific version pinned, but does not address the risk of the host being compromised and serving a different file in the future (the URL is not versioned — it points to a static filename 'MyOfficeStandardHomeEdition.deb' without a version path component, meaning the checksum would catch substitution only for this build). The package installs executed code (a full office suite with Qt5, Mono, etc.) from a non-primary vendor host with a non-versioned URL. This is a genuine, if moderate, supply-chain concern: medium severity is appropriate.