xterminal-deb

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:16 source_x86_64=("https://cdn-cn.xterminal.cn/downloads/XTerminal-${pkgver}-linux-amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Electron-based binary (.deb) from cdn-cn.xterminal.cn, which is the official CDN for the XTerminal application (xterminal.cn is the vendor's own domain). The host is not a random personal server — it is the vendor's own distribution CDN. However, the package still installs a prebuilt, closed-source binary blob extracted from a .deb without any integrity verification beyond a sha512 checksum. The sha512sum provides reasonable integrity protection against CDN compromise or MITM, though the checksum itself is only as trustworthy as the PKGBUILD maintainer. The binary is a full Electron app with SSH/RDP capabilities, meaning it has significant system access potential. The PKGBUILD also has a minor issue: the package() function references data.tar.xz without first extracting it from the .deb (the .deb is the source, not data.tar.xz directly), suggesting the build may rely on makepkg's automatic extraction behavior or may be broken. Overall this is a standard 'binary repackage from vendor CDN' pattern common in AUR, which carries inherent supply-chain risk (trust in the vendor) but is not unusual or clearly malicious. The medium rating is appropriate given the prebuilt binary nature and closed-source Electron app with network capabilities.