shift

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:9 source=("shift-linux-v$pkgver-stable.zip::https://update.tryshift.com/download/version/$pkgver-stable/linux_32")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt x86_64 Electron/Chromium-based binary application from update.tryshift.com, which is the official vendor update infrastructure for the Shift desktop app (tryshift.com). The binary is installed to /opt/shift and symlinked into /usr/bin, so it executes with user privileges. The sha256sum is pinned, which mitigates tampering risk somewhat. The concern is that this is a closed-source prebuilt binary from a vendor update endpoint (not a GitHub release or official distro mirror), meaning the binary's contents cannot be audited and the update domain could serve different content in future versions. This is a standard AUR pattern for proprietary apps (similar to google-chrome, slack-desktop, etc.) but still carries inherent supply-chain risk from executing an unauditable vendor binary. The cheaper model's 'non-standard host' concern is partially valid — update.tryshift.com is the vendor's own CDN/update server, not a personal or unofficial host, but it is less transparent than a GitHub releases page. Overall this is a legitimate medium: a real supply-chain concern (opaque prebuilt binary from a vendor update endpoint) but not clearly malicious.