owa-epanet-ui-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:17 "${pkgname}-${pkgver}.zip::https://drive.google.com/uc?export=download&id=1Pfn92pQvc44TYwuDBdCVUyAKmH1ONZVG"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads a prebuilt binary (epanet-ui) and several shared libraries (libepanet2.so, libepanetmsx.so, libshp.so, libproj.so) from a Google Drive personal/shared link. Google Drive is not an official release host — the file ID can be silently replaced by whoever controls the Drive account, and there is no way to verify the provenance of the binary independently of the SHA256 checksum. The checksum for the zip is present (c0ca66fd...), which provides some integrity guarantee, but only against the current file; if the Drive owner swaps the file the checksum would change and the build would fail, but a compromised maintainer could update both simultaneously. The core concern is that prebuilt executables and shared libraries are being installed from a non-canonical, non-reproducible host (not GitHub Releases, not the upstream project's own server) with no source build option. The upstream project (OpenWaterAnalytics/EPANET-UI on GitHub) does not appear to publish official binary releases at this Google Drive link, making this a genuine supply-chain risk. Additionally, several other source files (desktop entry, icons) use SKIP for checksums, which is sloppy but not the primary concern. This is a real medium-severity supply-chain risk: executed binaries and libraries from an unofficial personal host.