xlibre-video-vmware-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=(https://x11libre.net/repo/arch_based/x86_64/xlibre-video-vmware-13.4.0.3-2-x86_64.pkg.tar.zst)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (a compiled X.Org/XLibre video driver) from x11libre.net, which is an unofficial/personal project host rather than an official distribution mirror or well-known vendor CDN. The binary is then extracted and installed directly into the package directory. While a sha256sum is provided (offering some integrity protection against transit tampering), the trust anchor is entirely the x11libre.net host operator — if that host is compromised or the maintainer is malicious, an arbitrary binary with X server privileges could be delivered to users. XLibre itself appears to be a fork/continuation project of X.Org, so the domain is at least thematically consistent, but it is not an established, widely-audited source. The pattern of wrapping a foreign binary repo's package inside an AUR PKGBUILD is a recognized supply-chain risk vector: the AUR package bypasses normal Arch repository vetting, and the inner package is a compiled binary from a third-party host. This is a genuine medium-severity concern — not clearly malicious, but a real supply-chain risk due to executed binary code from an unofficial host.