xfce-bing-everyday-wallpaper-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 source=("https://gitee.com/dangerise/xfce-bing-everyday-wallpaper.git/releases/download/v$pkgver/xfce-bing-everyday-wallpaper-$pkgver-x86_64.tar.gz")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs a prebuilt binary from gitee.com (a Chinese code hosting platform), which is the maintainer's own personal repository. While gitee.com is a legitimate hosting platform (similar to GitHub), the binary is not from an official distribution channel like crates.io or a well-known mirror. The package installs an executed binary directly to /usr/bin without any source compilation, meaning users must trust that the prebuilt binary matches the source code in the repository. The sha256sum provides integrity checking against tampering in transit, but does not verify that the binary was actually compiled from the published source. This is a classic supply-chain concern: a personal host serving prebuilt binaries where the maintainer controls both the source and the binary artifact. The risk is real but not clearly malicious — it's the standard medium-risk pattern of an unofficial prebuilt binary from a personal host.