smartscope

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 source=("$_pkgname-$_pkgver.deb::https://www.lab-nation.com/package/smartscope/linux/latest/get"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source URL points to a 'latest' endpoint (https://www.lab-nation.com/package/smartscope/linux/latest/get) rather than a versioned, immutable artifact. While lab-nation.com appears to be the official vendor domain, the 'latest' redirect means the downloaded .deb could change at any time without the PKGBUILD reflecting it. The md5sum provides some protection against silent substitution, but md5 is cryptographically weak and the checksum would need to be updated manually if the endpoint content changes. More critically, the package extracts and installs a prebuilt binary .deb (data.tar.xz) directly onto the system — this is an executed binary from a vendor host with no source build, which is the definition of a medium supply-chain concern. The 'latest' endpoint pattern means the pinned version in pkgver may not match what is actually downloaded if the endpoint is updated. The license is listed as 'unknown', and the package installs a Mono application binary without source verification. This is a legitimate medium risk: not clearly malicious, but a prebuilt binary from a mutable endpoint with weak integrity checking.