Review Results

Comment

The change only updates .SRCINFO metadata to track newer upstream release tarballs and checksums. The sources remain HTTPS GitHub release archives, pinned to specific tags, with no new build-time commands, scripts, or packaging behavior introduced in this diff. I don’t see any integrity or persistence red flags in the metadata update itself. Risk is low, though the actual PKGBUILD/source contents are not changed here.

@@ -1,6 +1,6 @@
 pkgbase = fvs2
 	pkgdesc = Standalone CLI for FVS v2
-	pkgver = 0.2.0
+	pkgver = 0.8.0
 	pkgrel = 1
 	url = https://github.com/fvs-lab/fvs2
 	arch = x86_64

Comment

The change only updates the pinned upstream release tarballs and their checksums in .SRCINFO from v0.2.0/core v0.0.1 to v0.8.0/core v0.1.0. The sources remain HTTPS GitHub release archives, there are no new build-time fetches, no added scripts, and no suspicious metadata changes. Based on the diff alone this is a routine version bump with integrity hashes updated accordingly.

@@ -8,9 +8,9 @@ pkgbase = fvs2
 	license = MIT
 	makedepends = go
 	depends = glibc
-	source = fvs2-0.2.0.tar.gz::https://github.com/fvs-lab/fvs2/archive/refs/tags/v0.2.0.tar.gz
-	source = core-0.0.1.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v0.0.1.tar.gz
-	sha256sums = 301d672a3f7c0633b6716d3160e455397475a80d600e0a8cf1a6ad1e33623e10
-	sha256sums = fa9220933cf7c41747b2817504001548c63b4319ebd890737aad168136a20c0a
+	source = fvs2-0.8.0.tar.gz::https://github.com/fvs-lab/fvs2/archive/refs/tags/v0.8.0.tar.gz
+	source = core-0.1.0.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v0.1.0.tar.gz
+	sha256sums = 18e8a51e6df3068c05b95e4595f194bf095d760aa37a06a205a543154ffe7b1a
+	sha256sums = f9cbdc707a8c090b5c57e1ebd7283170586cf2dc910792daba01f4024496d8da
 
 pkgname = fvs2

Comment

The change only bumps the package and embedded core version numbers plus their source checksums. The sources remain HTTPS GitHub tag archives, with no new build steps, scripts, binaries, or privilege/persistence mechanisms introduced. I did not see any integrity red flags in the diff itself beyond the normal need to trust the updated upstream tags/checksums. Risk is low.

@@ -1,9 +1,9 @@
 # Maintainer: w568w <w568w at outlook dot com>
 
-_corever=0.0.1
+_corever=0.1.0
 
 pkgname=fvs2
-pkgver=0.2.0
+pkgver=0.8.0
 pkgrel=1
 pkgdesc='Standalone CLI for FVS v2'
 arch=('x86_64' 'aarch64')

Comment

The change only updates the package and dependency version pins plus their corresponding SHA-256 checksums. The source URLs remain HTTPS and point to the same upstream GitHub repositories, with no new build-time downloads, scripts, or privilege-related changes introduced in this hunk. I don’t see any security-relevant regression in the diff provided.

@@ -15,8 +15,8 @@ source=(
   "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
   "core-${_corever}.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v${_corever}.tar.gz"
 )
-sha256sums=('301d672a3f7c0633b6716d3160e455397475a80d600e0a8cf1a6ad1e33623e10'
-            'fa9220933cf7c41747b2817504001548c63b4319ebd890737aad168136a20c0a')
+sha256sums=('18e8a51e6df3068c05b95e4595f194bf095d760aa37a06a205a543154ffe7b1a'
+            'f9cbdc707a8c090b5c57e1ebd7283170586cf2dc910792daba01f4024496d8da')
 
 prepare() {
   local builddir="$srcdir/$pkgname-$pkgver"