tracktion-waveform-9

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:19 source=(https://cdn.tracktion.com/file/tracktiondownload/waveform/932/Waveform-installer-64bit-linux-9.3.2.deb)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from cdn.tracktion.com, which is the official Tracktion CDN (a legitimate vendor distribution channel for Waveform DAW). The host is not unofficial or personal — Tracktion Corporation uses this CDN for their official downloads. However, the package installs an opaque binary blob (a prebuilt .deb) without source compilation, which is a standard supply-chain concern for any binary-only AUR package. The md5sums checksum is present but MD5 is cryptographically weak. The extraction and installation logic is straightforward with no obfuscation or suspicious post-install scripts. This is a common pattern for proprietary software AUR packages (similar to spotify, slack, discord, etc.) and the host appears to be the legitimate vendor CDN. The cheaper model's MEDIUM rating is arguably a false positive for a known vendor CDN, but the binary-blob nature with only MD5 verification keeps a residual supply-chain concern. Overall this is borderline clean/medium — the vendor CDN legitimacy pushes it toward clean, but the weak checksum and binary-only nature maintain a low supply-chain concern.