zerx-lab-dida365-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:41 source_x86_64=("dida-${pkgver}-amd64.deb::https://dida365.com/static/getApp/download?type=linux_deb_x64")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt Electron binary (.deb) directly from dida365.com, which is the official vendor domain for the TickTick Chinese version (滴答清单). The URL pattern 'https://dida365.com/static/getApp/download?type=linux_deb_x64' is consistent with an official vendor download endpoint. However, this is still a prebuilt binary from a proprietary vendor being installed with SUID (chrome-sandbox at 4755), and the source URL uses a query-parameter redirect rather than a versioned, stable artifact URL — meaning the sha256sum is the primary integrity guarantee. The sha256sum is present and appears to be a valid 64-character hex string, which provides meaningful integrity protection. The main concern is that the URL is not pinned to a specific version (it's a 'latest' redirect), so a future pkgver bump without a corresponding sha256 update could silently install a different binary. Overall this is a legitimate proprietary vendor binary with standard Electron packaging patterns, but the non-versioned download URL combined with SUID binary installation from a proprietary host warrants medium classification rather than clean.