rutoken-pkcs11

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("http://download.rutoken.ru/Rutoken/PKCS11Lib/${pkgver}/Linux/x64/librtpkcs11ecp_${pkgver}-1_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .deb binary (a shared library librtpkcs11ecp.so) from download.rutoken.ru, which is the official vendor download server for Rutoken (a Russian hardware security token manufacturer). The library is installed directly into /usr/lib and will be loaded by applications at runtime, making it executed/trusted code. While the host appears to be the legitimate vendor's own distribution server and a sha256sum is provided, the binary is not signed by a distro-trusted key, comes from a vendor-controlled HTTP (not HTTPS) URL, and is a prebuilt native shared library — meaning any compromise of that server or URL would result in arbitrary code execution in any process loading PKCS#11 modules. The HTTP (non-TLS) URL is a notable concern as it allows MITM substitution despite the checksum (the checksum only protects against accidental corruption if the PKGBUILD itself isn't updated). This is a genuine medium-severity supply-chain concern: prebuilt binary from a vendor host over plain HTTP, not a false positive.