valentina-studio-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source_x86_64=("${pkgname}-${pkgver}-${CARCH}.deb::https://www.valentina-db.com/en/all-downloads/vstudio/current/vstudio_x64_lin_deb?format=raw")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from valentina-db.com, which is the official vendor website for Valentina Studio. This is a legitimate commercial database tool with a real vendor behind it. However, the concern is real: a prebuilt binary blob is extracted and installed directly into /opt without any integrity verification beyond a single sha256sum. The source URL uses a redirect/format parameter rather than a direct file URL, which is slightly unusual but common for vendor download portals. The sha256sum provides some protection against tampering in transit. The host is the official vendor domain, not a personal or unofficial mirror, which reduces supply-chain risk compared to a random personal host. The binary is executed at runtime by users, not during the build process itself. This is a standard 'bin' package pattern in the AUR for proprietary software distributed as .deb files. The medium rating is marginally justified because it is a closed-source binary from a vendor-controlled download endpoint with a redirect URL, but this is essentially the same risk profile as any other -bin AUR package pulling from an official vendor site. The risk is low-to-medium: if valentina-db.com were compromised, users would get a malicious binary, but this is true of any vendor binary package.