python-sentry_crashpad

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it MEDIUM (confidence 82%): The PKGBUILD installs a Python package directly from PyPI using pip without any source verification (no checksums, no source array, no integrity check). The package 'sentry_crashpad' is pulled from PyPI at build time, meaning whatever is currently published under that name/version on PyPI gets installed. While PyPI is a legitimate ecosystem mirror, this pattern bypasses Arch's normal source integrity mechanisms (no source=() array, no sha256sums). More importantly, sentry_crashpad is a C++ crash reporting library that ships pre-compiled native binaries inside the wheel — these are executed binaries from a third-party PyPI package maintained by 'EndstoneMC', not the official Sentry organization. The package URL points to a personal/project GitHub (EndstoneMC/sentry-crashpad), not the official getsentry/sentry-native upstream. Installing pre-compiled native binaries from an unofficial PyPI package without any integrity verification is a genuine supply-chain concern: if the PyPI package is compromised or typosquatted, arbitrary native code executes on the user's system. This is a real medium-severity supply-chain risk, not a false positive.