spnxclient

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("https://www.sigur.com/dl/spnxclient_${pkgver}-${pkgrel}_all.deb"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt .deb binary from sigur.com (the official vendor site for the Sigur ACS product) and installs native shared libraries (libspnxreader_*.so, libguinative_*.so) and an executable binary directly. The sha256 checksum is present, which mitigates casual tampering, but there is no GPG signature verification. The host is the official vendor domain matching the package URL, so this is not a random personal/unofficial host — it is the canonical distribution point for this proprietary software. However, the package installs prebuilt native binaries and shared libraries that will be executed/loaded at runtime, with no source build. This is a standard pattern for proprietary AUR packages (like many commercial software packages in AUR), but it does carry inherent supply-chain risk since the binaries cannot be audited. The risk level is consistent with other AUR packages that repackage vendor-distributed proprietary binaries from official sources with checksums. This is a genuine medium-level concern (prebuilt binary from a vendor host, no GPG verification) but not an attack or clearly malicious pattern.