Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.32.5 to 1.32.6. No sources, build logic, install scripts, permissions, or metadata affecting trust boundaries changed in the provided diff. On its face this is a routine package update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = gallery-dl
 	pkgdesc = Command-line program to download image-galleries and collections from several image hosting sites
-	pkgver = 1.32.5
+	pkgver = 1.32.6
 	pkgrel = 1
 	url = https://codeberg.org/mikf/gallery-dl
 	arch = any

Comment

The change is a routine upstream version bump in .SRCINFO from v1.32.5 to v1.32.6, with the corresponding sha512 checksum updated. The source remains the official Codeberg repository over HTTPS and is still pinned to a signed tag, with the same PGP key listed. No new sources, build steps, install scripts, or packaging metadata were introduced. Based on the diff provided, there are no security red flags beyond the normal trust in the new upstream release.

@@ -27,8 +27,8 @@ pkgbase = gallery-dl
 	optdepends = python-psycopg: PostgreSQL support
 	optdepends = python-truststore: Support using system certificates
 	optdepends = python-jinja: Jinja template support
-	source = git+https://codeberg.org/mikf/gallery-dl.git#tag=v1.32.5?signed
+	source = git+https://codeberg.org/mikf/gallery-dl.git#tag=v1.32.6?signed
 	validpgpkeys = 3E09F5908333DD83DBDCE7375680CA389D365A88
-	sha512sums = 750cffc9189464fd59f2d1b49a25426b6932dab5e0f44a565ffd401310d319c7375ed856082acde26cd3a9ee6fdb5d84d720bc64345b0f37c6329c087d3e6235
+	sha512sums = 59df4d48dad8c60980fc0ea57abbc2aa7004839fad2f263e85a45221999f66a318b100e6b63b38c0c861829430317ea6c950a38ce7f84e28eb590eeef9534083
 
 pkgname = gallery-dl

Comment

The change is a straightforward version bump in PKGBUILD from 1.32.5 to 1.32.6 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or packaging logic changes in the provided diff hunk, so I see no security impact from this change alone.

@@ -2,7 +2,7 @@
 # Contributor: LLL2yu <lll2yu@protonmail.com>
 
 pkgname=gallery-dl
-pkgver=1.32.5
+pkgver=1.32.6
 pkgrel=1
 pkgdesc='Command-line program to download image-galleries and collections from several image hosting sites'
 arch=(any)

Comment

Risk is low. The change only bumps pkgver from 1.32.5 to 1.32.6 and updates the corresponding sha512 checksum for the signed git tag source. The source remains an HTTPS git URL pinned to a specific tag with signature verification via the existing validpgpkeys entry, and there are no changes to build/install logic, dependencies, or packaging behavior. No new attack surface is introduced by this diff.

@@ -29,7 +29,7 @@ optdepends=(
 )
 source=(git+"${url}".git#tag=v"${pkgver}"?signed)
 validpgpkeys=(3E09F5908333DD83DBDCE7375680CA389D365A88) #Mike Fährmann
-sha512sums=('750cffc9189464fd59f2d1b49a25426b6932dab5e0f44a565ffd401310d319c7375ed856082acde26cd3a9ee6fdb5d84d720bc64345b0f37c6329c087d3e6235')
+sha512sums=('59df4d48dad8c60980fc0ea57abbc2aa7004839fad2f263e85a45221999f66a318b100e6b63b38c0c861829430317ea6c950a38ce7f84e28eb590eeef9534083')
 
 prepare() {
     # Clean out old wheels etc.