timecamp-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:17 "timecamp-${pkgver}.tar.gz::https://timecamp.s3.amazonaws.com/downloadsoft/${pkgver}/TimeCampSetup_LinAmd64.tar.gz"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary from timecamp.s3.amazonaws.com, which is an S3 bucket controlled by the TimeCamp vendor (not a personal or unofficial host). The URL pattern matches the official TimeCamp desktop app distribution. However, there are legitimate concerns: (1) S3 buckets can be misconfigured or taken over; (2) the LICENSE.html file is sourced locally with no URL, meaning it's a local file that must exist at build time — this is unusual and slightly suspicious but not malicious; (3) there is no GPG signature verification, only sha256sums. The sha256sum does provide integrity checking against the specific binary version. The binary is executed on the user's system. This is a standard 'binary package from vendor' pattern common in AUR (like -bin packages for many commercial apps), and the host appears to be the official vendor S3 bucket. The risk is real but typical for binary AUR packages — if the S3 bucket were compromised or the URL content changed, the sha256sum would catch it for this specific version. Overall this is a medium-risk pattern (prebuilt binary, no GPG verification) but consistent with legitimate vendor binary packaging rather than a supply-chain attack.