sovet

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source_x86_64=("Soviet_${pkgver}_amd64.AppImage::https://updates.sovetchat.ru/downloads/Soviet_${pkgver}_amd64.AppImage")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and executes a prebuilt AppImage binary from updates.sovetchat.ru, which is the vendor's own update/distribution server for a Russian corporate chat platform. The AppImage is extracted during prepare() (running the binary with --appimage-extract) and then installed. The sha256sum is pinned, which mitigates casual substitution, but the host is a non-GitHub, non-standard distribution endpoint for a relatively obscure Russian SaaS product with no independent verification chain. The core concern is: this is an opaque, prebuilt executable from a single vendor-controlled server with no reproducible build, no code signing verification beyond a single sha256 in the PKGBUILD itself. If the upstream host is compromised or the maintainer updates the hash to match a malicious binary, users get arbitrary code execution. This is a textbook medium-severity supply-chain concern — not clearly malicious, but a real risk pattern for an executed binary from an unofficial/personal-project host.