Review Results

Comment

The only change in this diff is a version bump in .SRCINFO from 2.1.1 to 2.1.2. There are no changes to sources, checksums, build steps, install scripts, dependencies, or packaging behavior in the provided hunk. On its face this does not introduce any new security risk.

@@ -1,6 +1,6 @@
 pkgbase = syncthingtray
 	pkgdesc = Tray application for Syncthing
-	pkgver = 2.1.1
+	pkgver = 2.1.2
 	pkgrel = 1
 	url = https://github.com/Martchus/syncthingtray
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from syncthingtray 2.1.1 to 2.1.2, with the source URL still using HTTPS on the official GitHub upstream and the checksum updated accordingly. No new sources, scripts, build steps, permissions, or packaging metadata were introduced in this diff hunk. Based on the provided change alone, I see no security red flags.

@@ -26,8 +26,8 @@ pkgbase = syncthingtray
 	depends = qt5-base
 	depends = qt5-declarative
 	optdepends = gnome-shell-extension-appindicator: tray icon support for GNOME Shell
-	source = syncthingtray-2.1.1.tar.gz::https://github.com/Martchus/syncthingtray/archive/v2.1.1.tar.gz
-	sha256sums = 7a19c32e1a48b77ec1f7263049fcc9d52e3fff2a32e61d4e923c4943496f7880
+	source = syncthingtray-2.1.2.tar.gz::https://github.com/Martchus/syncthingtray/archive/v2.1.2.tar.gz
+	sha256sums = 6bfb7e8ace533dad697244cde1b075a16ea469c7c1bed141ae02c2832001da84
 
 pkgname = syncthingtray
 	depends = qtutilities

Comment

The only change in the reviewed hunk is a pkgver bump from 2.1.1 to 2.1.2. There are no changes to source URLs, checksums, build steps, install scripts, permissions, or dependencies in this diff. Based on the provided hunk alone, there is no security-relevant behavior change to flag.

@@ -24,7 +24,7 @@ _enable_plasmoid=${SYNCTHING_TRAY_ENABLE_PLASMOID:-0}
 
 _reponame=syncthingtray
 pkgname=syncthingtray
-pkgver=2.1.1
+pkgver=2.1.2
 pkgrel=1
 arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
 pkgdesc='Tray application for Syncthing'

Comment

The change only updates the SHA-256 checksum for the upstream GitHub tarball source. The source URL remains HTTPS and points to the official upstream repository, with no new build steps, scripts, binaries, or packaging logic introduced. I do not see any security-relevant behavior change in this diff hunk; it is a routine checksum refresh consistent with an upstream release tarball update.

@@ -44,7 +44,7 @@ checkdepends=('cppunit' 'syncthing' 'iproute2')
 [[ $_enable_plasmoid ]] && makedepends+=('plasma-framework5' 'extra-cmake-modules')
 url="https://github.com/Martchus/${_reponame}"
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Martchus/${_reponame}/archive/v${pkgver}.tar.gz")
-sha256sums=('7a19c32e1a48b77ec1f7263049fcc9d52e3fff2a32e61d4e923c4943496f7880')
+sha256sums=('6bfb7e8ace533dad697244cde1b075a16ea469c7c1bed141ae02c2832001da84')
 
 ephemeral_port() {
   comm -23 <(seq 49152 65535) <(ss -tan | awk '{print $4}' | cut -d':' -f2 | grep "[0-9]\{1,5\}" | sort | uniq) | shuf | head -n 1