scl011

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:16 source=("http://files.identiv.com/products/smart-card-readers/contactless/scl010-011/Linux_Driver_Ver${pkgver}.zip")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary driver bundle (*.bundle files containing shared libraries/executables) from files.identiv.com, which is the vendor's own download server for Identiv (formerly SCM Microsystems) products. The host is not a random personal server — it is the official vendor distribution point for this hardware driver. However, the source is a prebuilt proprietary binary that gets installed directly into the pcscd USB driver drop directory, meaning it will be loaded and executed by the pcscd daemon. There is no way to verify the binary's integrity beyond the sha256sum of the zip archive. The sha256sum is pinned, which mitigates silent substitution risk somewhat, but the binary itself is opaque and closed-source. This is a legitimate vendor binary driver package (common in AUR for hardware that requires proprietary drivers), similar to many other hardware driver packages. The risk is real but typical for proprietary binary driver packages — it is not clearly malicious, but it does represent a supply-chain concern since users must trust the vendor's download server and the opaque binary. This pattern is standard for AUR proprietary driver packages and the vendor domain is legitimate, so this sits at the lower end of medium rather than being a clear threat.