pachca-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 source=("Pachca-${pkgver}-amd64.deb::https://install.pachca.com/linux/deb/x64")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 Electron/native binary .deb from install.pachca.com, which is the vendor's own distribution endpoint (pachca.com is the official Pachca corporate messenger site). The URL 'https://install.pachca.com/linux/deb/x64' is a redirect/alias that always serves the current release rather than a pinned versioned artifact — meaning the b2sum check is the only integrity guard, and it pins a specific build. The b2sum is present and non-trivial, which mitigates the floating-URL risk somewhat. However, the host is not a well-known, independently auditable mirror (e.g. GitHub releases, PyPI, npm), and the binary is executed directly on the user's system. This is a classic medium-severity supply-chain pattern: a prebuilt closed-source binary from a vendor-controlled but non-standard host, where a compromise of install.pachca.com or a silent binary swap before the checksum was recorded could deliver malicious code. The b2sum provides some protection but the floating URL means future pkgrel bumps may not update the sum correctly. No obfuscation, no exfiltration indicators, no piracy concerns — this is a legitimate commercial product distributed via its own infrastructure, but the pattern warrants medium severity.