xrt-bin

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The source URL is on xilinx.com, the official Xilinx/AMD vendor domain, so this is not an unofficial or personal host. The query-parameter style URL (openDownload?filename=...) is Xilinx's standard download redirect mechanism used across their product line — the actual filename is embedded in the parameter and is specific and versioned (xrt_202110.2.11.634_20.04-amd64-xrt.deb). An md5sum is provided, which pins the content at package-build time (though MD5 is weak, it still provides basic integrity verification). The package installs a prebuilt Debian binary from the official vendor, which is a legitimate but non-ideal packaging pattern (prebuilt binary vs. building from source). The main concerns are: (1) MD5 is cryptographically weak; (2) the dynamic URL could theoretically serve different content if Xilinx changes the backend, but the md5sum mitigates this; (3) no GPG signature verification. These are sloppy/non-standard practices but not a genuine supply-chain attack vector given the official vendor origin and checksum presence. The 'broken' flag is borderline since the package() function references data.tar.gz without extracting it from the .deb first (missing ar extraction step), but this is a packaging bug rather than a security issue. Overall: low severity, sloppy packaging.