Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 2.6.0 to 2.6.1, with the source URL and checksum updated accordingly. The source remains an HTTPS GitLab release tarball from the upstream project, with no new build steps, scripts, dependencies, or packaging behavior introduced in this diff. No security red flags are evident from the provided change alone.

@@ -1,13 +1,13 @@
 pkgbase = garden-tools
 	pkgdesc = Garden grows and cultivates collections of Git trees
-	pkgver = 2.6.0
+	pkgver = 2.6.1
 	pkgrel = 1
 	url = https://gitlab.com/garden-rs/garden
 	arch = x86_64
 	license = MIT
 	makedepends = cargo
 	depends = libgcc
-	source = https://gitlab.com/garden-rs/garden/-/archive/v2.6.0/garden-v2.6.0.tar.gz
-	sha256sums = a53ea16f53552d86c3295adfd4ced3bc0ee9523d2483873e6724b41b1c27d80b
+	source = https://gitlab.com/garden-rs/garden/-/archive/v2.6.1/garden-v2.6.1.tar.gz
+	sha256sums = 7581743e2a622cebd1a554cec21980573fe357c5cc60ef2bf6b0fa1993314dec
 
 pkgname = garden-tools

Comment

The change is a simple version bump in PKGBUILD from 2.6.0 to 2.6.1 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or dependency changes in the provided diff, so I see no security-relevant risk introduced by this hunk alone.

@@ -1,6 +1,6 @@
 # Maintainer: Mark Wagie <mark dot wagie at proton dot me>
 pkgname=garden-tools
-pkgver=2.6.0
+pkgver=2.6.1
 pkgrel=1
 pkgdesc="Garden grows and cultivates collections of Git trees"
 arch=('x86_64')

Comment

Low risk. The change is a routine version bump from 2.6.0 to 2.6.1 with an updated source checksum. The only behavioral change is in `prepare()`, where `cargo fetch --target "$(rustc --print host-tuple)"` was replaced with `cargo fetch --target host-tuple`. That looks like a likely bug/regression because `host-tuple` is not a normal Rust target triple, but it is not a security issue by itself: it does not introduce new network sources, privilege escalation, persistence, or packaging outside the declared source. No suspicious extra files or install scripts are involved in the provided diff.

@@ -9,12 +9,12 @@ license=('MIT')
 depends=('libgcc')
 makedepends=('cargo')
 source=("https://gitlab.com/garden-rs/garden/-/archive/v${pkgver}/garden-v${pkgver}.tar.gz")
-sha256sums=('a53ea16f53552d86c3295adfd4ced3bc0ee9523d2483873e6724b41b1c27d80b')
+sha256sums=('7581743e2a622cebd1a554cec21980573fe357c5cc60ef2bf6b0fa1993314dec')
 
 prepare() {
   cd "garden-v${pkgver}"
   export RUSTUP_TOOLCHAIN=stable
-  cargo fetch --target "$(rustc --print host-tuple)"
+  cargo fetch --target host-tuple
 }
 
 build() {