terraspace-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("https://apt.boltops.com/packages/terraspace/terraspace-latest.deb" "terraspace.install")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .deb from apt.boltops.com, which is the official BoltOps package repository (the vendor behind Terraspace). This is not a random personal host — it is the project's own distribution channel, analogous to how other vendors host their own apt/yum repos. However, the source URL uses a 'latest' alias (terraspace-latest.deb) rather than a versioned filename, meaning the downloaded artifact can change over time independently of the pkgver field. The sha256sum provides a point-in-time integrity check, but if the maintainer updates the checksum to track 'latest', the version pinning is effectively broken. The package installs a prebuilt binary bundle (Ruby embedded runtime + application code) from a non-GitHub, vendor-controlled host into /opt/terraspace. This is a real supply-chain concern: if apt.boltops.com is compromised or the 'latest' deb is silently replaced, users get arbitrary code execution. The risk is not theoretical malice but the structural weakness of a mutable 'latest' URL with a fixed checksum that will eventually drift. This warrants a medium rating — it is a legitimate vendor host but the mutable URL pattern and binary installation from a non-standard host constitute a genuine supply-chain concern.