via

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:24 source=("https://h30326.www3.hpe.com/hpn/via-${pkgver}-rpm.x86_64.rpm?merchantId=ASP_DROPBOX")

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

• PKGBUILD:48 chmod o+s "${pkgdir}/usr/bin/via-vpn-srv"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt RPM binary (a VPN client) from h30326.www3.hpe.com, which is an HPE/Aruba distribution host. HPE/Aruba is the legitimate vendor of the VIA VPN client, and the maintainer's email (@hpe.com) is consistent with this. The URL includes a merchantId parameter suggesting it's an authorized distribution channel. However, the source is a prebuilt binary RPM that gets directly installed — not compiled from source — and the host is not the canonical upstream download page (which is asp.arubanetworks.com per the url= field). The sha256sum is provided but cannot be independently cross-validated against an official manifest. The package also sets SUID on via-vpn-srv (chmod o+s), which is a privilege escalation vector if the binary is compromised. This is a legitimate vendor binary VPN client distributed via a CDN/mirror host rather than the official product page, which constitutes a real supply-chain concern: if the HPE CDN host were compromised or the URL were hijacked, a malicious binary would be installed with SUID privileges. This warrants MEDIUM severity — it's not clearly malicious but represents a genuine executed-binary-from-unofficial-host risk.