sqlpackage

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The source is a Microsoft official distribution URL (go.microsoft.com/fwlink) pointing to the official sqlpackage release ZIP. Microsoft routinely uses fwlink redirects for all their download links; this is standard practice, not obfuscation. The binary is a legitimate Microsoft tool. The only real concern is the use of SHA1 instead of SHA256/SHA512, which is weaker but still provides integrity verification against accidental corruption. The fwlink redirect is pinned to a specific linkid that maps to a specific version, so silent swapping is not a realistic concern beyond what applies to any vendor-hosted binary. This is sloppy (weak hash, prebuilt binary) but not a genuine supply-chain threat beyond the inherent trust placed in Microsoft as the upstream vendor — the same trust required for any proprietary Microsoft tool package.