Review Results

Comment

The only change in this diff is a version/source checksum bump in .SRCINFO for a Plex upstream release. The new sources are still HTTPS and point to the official Plex download domain, with pinned release artifacts and updated SHA256 sums. No build logic, install script, or packaging behavior changed in this hunk, so there is no new evidence of code execution, persistence, privilege escalation, or integrity bypass introduced by this change alone.

@@ -1,6 +1,6 @@
 pkgbase = plex-media-server
 	pkgdesc = The back-end media server component of Plex.
-	pkgver = 1.43.2.10687
+	pkgver = 1.43.3.10828
 	pkgrel = 1
 	url = https://plex.tv/
 	install = plex-media-server.install

Comment

The change only updates .SRCINFO to point at newer Plex upstream release artifacts and refreshes their checksums. The sources remain HTTPS on the official Plex download domain, there are no new build-time commands, scripts, or packaging logic introduced, and no evidence of typosquatting, floating VCS refs, or integrity bypass. Security impact is minimal and limited to a routine version bump in metadata.

@@ -26,13 +26,13 @@ pkgbase = plex-media-server
 	sha256sums = c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557
 	sha256sums = b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad
 	sha256sums = dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631
-	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.2.10687-563d026ea/redhat/plexmediaserver-1.43.2.10687-563d026ea.x86_64.rpm
-	sha256sums_x86_64 = f92926534cf5a08bf2ab6574b8f85b899a7a036689c1a746dc0dc5ef15809116
-	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.2.10687-563d026ea/redhat/plexmediaserver-1.43.2.10687-563d026ea.i686.rpm
-	sha256sums_i686 = 30be68a1a2ed5d927f98836f2480db7674e8d6a59a29098c4d6a7e7d57c84465
-	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.2.10687-563d026ea/debian/plexmediaserver_1.43.2.10687-563d026ea_armhf.deb
-	sha256sums_armv7h = faf285a61929980726af1d5a3340a17e07e7ba0670fde3a86fd24ecf1a80e6d2
-	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.2.10687-563d026ea/debian/plexmediaserver_1.43.2.10687-563d026ea_arm64.deb
-	sha256sums_aarch64 = 7fc17204098ef13f066d43fcc575adcdcefb8d25ce082bd8511eb4f600981da1
+	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10828-00f62d37d/redhat/plexmediaserver-1.43.3.10828-00f62d37d.x86_64.rpm
+	sha256sums_x86_64 = 2ff1d3e1ac1052cfadfcaa932c17f6fa775e625859aa93224c85983f00052183
+	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10828-00f62d37d/redhat/plexmediaserver-1.43.3.10828-00f62d37d.i686.rpm
+	sha256sums_i686 = 6ec375fe8d4de3bd5f3734865b6aa4245a791d7029a1216362f0625c5354cf1f
+	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.3.10828-00f62d37d/debian/plexmediaserver_1.43.3.10828-00f62d37d_armhf.deb
+	sha256sums_armv7h = a24a65361bb28ebeecadf82d4c02d023ee9b3a34ee2baa0635bfc51e1d01b1be
+	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10828-00f62d37d/debian/plexmediaserver_1.43.3.10828-00f62d37d_arm64.deb
+	sha256sums_aarch64 = f08c0ae850e331fa8204e9aa88226598d8da9181ae91f97fe01f76964ba962a0
 
 pkgname = plex-media-server

Comment

The change is a straightforward version bump in PKGBUILD: pkgver/_pkgsum and the per-architecture sha256 checksums were updated to match the new Plex Media Server release. I do not see any new sources, build-time network fetches, script execution, privilege escalation, or packaging behavior changes in the provided diff. The risk is low because the only security-relevant aspect is that the package now trusts a different upstream binary release, which is normal for an update and is still pinned by checksum.

@@ -10,8 +10,8 @@
 # Contributor: Praekon <praekon@googlemail.com>
 
 pkgname=plex-media-server
-pkgver=1.43.2.10687
-_pkgsum=563d026ea
+pkgver=1.43.3.10828
+_pkgsum=00f62d37d
 pkgrel=1
 pkgdesc='The back-end media server component of Plex.'
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')

Comment

The change only updates architecture-specific SHA-256 checksums for the package source artifacts. There are no changes to source URLs, build logic, install scripts, permissions, or runtime behavior. I did not see any indication of a supply-chain or privilege-escalation issue in this hunk. The main effect is integrity verification for different upstream binaries, which is expected for a package like plex-media-server.

@@ -39,10 +39,10 @@ sha256sums=('398ba7958598609453f5289b3d5f2389d2756158b340cf28e83c39d9ed60280b'
             'c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557'
             'b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad'
             'dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631')
-sha256sums_x86_64=('f92926534cf5a08bf2ab6574b8f85b899a7a036689c1a746dc0dc5ef15809116')
-sha256sums_i686=('30be68a1a2ed5d927f98836f2480db7674e8d6a59a29098c4d6a7e7d57c84465')
-sha256sums_armv7h=('faf285a61929980726af1d5a3340a17e07e7ba0670fde3a86fd24ecf1a80e6d2')
-sha256sums_aarch64=('7fc17204098ef13f066d43fcc575adcdcefb8d25ce082bd8511eb4f600981da1')
+sha256sums_x86_64=('2ff1d3e1ac1052cfadfcaa932c17f6fa775e625859aa93224c85983f00052183')
+sha256sums_i686=('6ec375fe8d4de3bd5f3734865b6aa4245a791d7029a1216362f0625c5354cf1f')
+sha256sums_armv7h=('a24a65361bb28ebeecadf82d4c02d023ee9b3a34ee2baa0635bfc51e1d01b1be')
+sha256sums_aarch64=('f08c0ae850e331fa8204e9aa88226598d8da9181ae91f97fe01f76964ba962a0')
 
 prepare() {
   if [[ $CARCH = armv7h ]] || [[ $CARCH = aarch64 ]]; then