sipgate-softphone

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 "https://sipgate-desktop-app.s3.eu-central-1.amazonaws.com/${appimage}"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt AppImage binary from an S3 bucket (sipgate-desktop-app.s3.eu-central-1.amazonaws.com) and executes it during the build phase to extract its contents. While S3 is not inherently untrustworthy, this is an official vendor-controlled bucket for Sipgate's desktop application, not a random personal host. The sha256sum is pinned, which mitigates substitution attacks. However, the PKGBUILD executes the AppImage binary directly during packaging (./$appimage --appimage-extract), meaning a compromised or tampered binary would execute arbitrary code on the build machine. The S3 bucket name is plausibly official (matches the vendor), but S3 buckets can be misconfigured or taken over. The core concern is a prebuilt closed-source binary being executed during build — this is a genuine medium-severity supply-chain concern, not a false positive, even though the sha256 is pinned and the host appears to be vendor-controlled.