xlibre-video-fbdev-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=(https://x11libre.net/repo/arch_based/x86_64/xlibre-video-fbdev-0.5.1.2-1.2-x86_64.pkg.tar.zst)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from x11libre.net, which is a third-party host not affiliated with the official Arch Linux infrastructure or a well-known upstream vendor. The binary is a compiled X.Org video driver that gets extracted and installed directly into the system. While XLibre is a real fork of X.Org (started by Marc Balmer), x11libre.net is not an established, widely-trusted distribution channel — it's a personal/project host. The package bypasses normal source compilation entirely, installing a prebuilt binary that will be loaded as an X server driver module (executed code with elevated trust). There is a sha256sum present, which provides integrity checking against the specific file, but does not protect against the host serving a malicious binary in the first place or the host being compromised. The supply-chain risk is real: a compromised or malicious x11libre.net could serve a backdoored X driver. This is a genuine medium-severity concern — an executed binary from an unofficial/personal host — not a false positive.