vk-messenger

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("https://upload.object2.vk-apps.com/vk-me-desktop-dev-5837a06d-5f28-484a-ac22-045903cb1b1a/latest/vk-messenger.rpm")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt RPM binary from upload.object2.vk-apps.com, which is a VK (VKontakte) object storage subdomain — plausibly an official VK CDN/storage host for their desktop app, but it is not a well-known, auditable release channel. The binary is an Electron-based messenger app that gets extracted and installed directly. Key concerns: (1) the host is a non-standard object storage URL with a UUID path component that looks like a CI/CD artifact bucket, not a versioned release endpoint, meaning the content at that URL could be silently replaced without changing the URL; (2) there is a sha256sum check, which provides some integrity guarantee, but only for the specific downloaded artifact — if the upstream object is replaced, the build would fail rather than silently install malware, which mitigates the risk somewhat; (3) the RPM is extracted and its contents moved wholesale into pkgdir without any inspection or filtering, so whatever the RPM contains gets installed; (4) vk-apps.com is associated with VK's developer platform, making this plausibly official VK infrastructure, but it remains unverifiable as an official release channel. The combination of an opaque object-storage URL, a full prebuilt binary installation, and no upstream signature verification keeps this at MEDIUM rather than clean.