proidcm

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

• PKGBUILD:14 _sourceurl=$(curl https://appcenter.proid.cz/download?solutionId=1aba3679-25ec-4ca2-b854-c787550a6753 | grep sasurl | sed -n 's/.*sasurl:"\([^"]*\)".*/\1/p' || exit 1)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD fetches a prebuilt binary .deb from a dynamically resolved Azure SAS URL obtained via an API call to appcenter.proid.cz at build time, bypassing the standard source=() array and Arch's integrity checking infrastructure. However, there are mitigating factors: (1) the package does perform a sha256sum check against a .sha256 file bundled in the zip, so the binary integrity is verified against a checksum provided by the same server; (2) the host appcenter.proid.cz appears to be the official vendor's app distribution endpoint for ProID (a Czech government smart card solution), not a random personal host; (3) the SAS URL pattern is consistent with Azure Blob Storage, a common vendor distribution mechanism. The real concern is that both the binary and its checksum come from the same server in the same request chain, so a compromised or MITM'd server could serve a malicious binary with a matching checksum — the sha256 check provides no independent trust anchor. The dynamic URL resolution also means the package is not reproducible and could silently deliver different binaries over time. This is a genuine supply-chain concern (executed binary from a non-Arch-mirrored host with no independent checksum verification), justifying MEDIUM, but there is no evidence of malicious intent.