xod

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("https://www.googleapis.com/download/storage/v1/b/releases.xod.io/o/v0.38.0%2Fxod-client-electron-0.38.0.x86_64.rpm?generation=1615553616000093&alt=media")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The PKGBUILD downloads a prebuilt RPM (containing an Electron application binary) from Google Cloud Storage (googleapis.com), which is the official GCS API endpoint for a bucket named 'releases.xod.io'. While GCS is a legitimate hosting platform, this is not the upstream project's canonical release host (e.g., GitHub releases) and the bucket ownership cannot be independently verified without additional context. The binary is an Electron app that gets directly installed and executed by end users. A sha256sum is provided and pinned, which mitigates substitution risk somewhat, but the generation parameter in the URL and the unofficial hosting location mean that if the bucket were compromised or the checksum were changed in a PKGBUILD update, malicious code could be executed. The RPM is extracted and its contents (opt/, usr/) are copied directly into the package root without any integrity verification beyond the archive-level checksum. This is a real supply-chain concern: an executed binary from a non-canonical, unverifiable host. The cheaper model's MEDIUM rating is correct.