Review Results

Version #1754 of discord_arch_electron · commit bbc998b2274e · status Reviewed

Risk 0/5 · Safe .SRCINFO

Result #379

Comment

The only change in this diff is a pkgver bump in .SRCINFO from 1.0.146 to 1.0.149. No source URLs, build logic, install scripts, permissions, or packaging metadata beyond the version number changed. On its face this is a routine upstream version update with no security-relevant red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = discord_arch_electron
 	pkgdesc = Discord using system provided electron for increased security and performance
-	pkgver = 1.0.146
+	pkgver = 1.0.149
 	pkgrel = 1
 	epoch = 1
 	url = https://discord.com

Risk 0/5 · Safe .SRCINFO

Result #380

Comment

The change is a routine version bump of Discord Electron assets from 1.0.146 to 1.0.149 in .SRCINFO, with all sources still fetched over HTTPS from Discord-owned domains and the checksums updated accordingly. No new sources, build steps, scripts, or packaging behavior were introduced in this diff, and there are no signs of privilege escalation or persistence mechanisms. Risk is low because the review is limited to metadata-only source/version updates.

@@ -18,39 +18,39 @@ pkgbase = discord_arch_electron
 	provides = discord
 	conflicts = discord
 	options = !strip
-	source = https://dl.discordapp.net/apps/linux/1.0.146/discord-1.0.146.tar.gz
+	source = https://dl.discordapp.net/apps/linux/1.0.149/discord-1.0.149.tar.gz
 	source = LICENSE.html::https://discord.com/terms
 	source = OSS-LICENSES.html::https://discord.com/licenses
 	source = discord-launcher.sh
 	source = krisp-patcher.py
-	source = core-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/full.distro
-	source = discord_desktop_core-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_desktop_core/1/full.distro
-	source = discord_zstd-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_zstd/1/full.distro
-	source = discord_krisp-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_krisp/1/full.distro
-	source = discord_rpc-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_rpc/1/full.distro
-	source = discord_utils-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_utils/1/full.distro
-	source = discord_voice-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_voice/1/full.distro
-	source = discord_game_utils-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_game_utils/1/full.distro
-	source = discord_erlpack-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_erlpack/1/full.distro
-	source = discord_modules-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_modules/1/full.distro
-	source = discord_spellcheck-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_spellcheck/1/full.distro
-	source = discord_dispatch-1.0.146.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.146/discord_dispatch/1/full.distro
-	sha512sums = b90cf25a6e615e836e0ef248b3090f23d90c2a6d73faeb21954ba669fb39275c26ac58a8f9e92445254c29fb90716cab54bee06f701cde88f74578c4228bc22b
+	source = core-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/full.distro
+	source = discord_desktop_core-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_desktop_core/1/full.distro
+	source = discord_zstd-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_zstd/1/full.distro
+	source = discord_krisp-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_krisp/1/full.distro
+	source = discord_rpc-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_rpc/1/full.distro
+	source = discord_utils-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_utils/1/full.distro
+	source = discord_voice-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_voice/1/full.distro
+	source = discord_game_utils-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_game_utils/1/full.distro
+	source = discord_erlpack-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_erlpack/1/full.distro
+	source = discord_modules-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_modules/1/full.distro
+	source = discord_spellcheck-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_spellcheck/1/full.distro
+	source = discord_dispatch-1.0.149.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.149/discord_dispatch/1/full.distro
+	sha512sums = 07cec6aea9e36ffe7d786b55ea76f38e7469d14fc2c2d853686230f416f4e07886f02c883d929338d4b87c3d7a0b412f0e0da94f62f6b976d65a59dab759bff0
 	sha512sums = SKIP
 	sha512sums = SKIP
 	sha512sums = d5373e2b2e9754bdcdbcda81fc1392ce6605939651839868823f3c3e0bf16f6fba2fb73bc1a0ff230eebd743d1463f2e8b2295503248f14845b3a56e57385bd1
 	sha512sums = 85da93530b2b92faad58cc84d0f7ddaea6b22fbec413e806c1981eb6369a301ec995eee6bfbe6b828e2cd0baf6168e578bbde456f2450a13199994ff9a1e7cd0
-	sha512sums = dca9bbf55afcb1425af7bd0fc4d891fe0cc37859436a8b2a1ae9d29689d72e574dc2f974d468a86527c0420847fd27af5517da7b02075ee2eebe8bd2d43a7d09
-	sha512sums = 88024b0faf4e4db8e283af9081b88072ec8ab908e4b72a7c0bab8ae7fcb3c5ae09b2b3e34af0b35429b51f46be359dc39983191e376a762c6c4831d4918a9792
-	sha512sums = b7a676bd7e7cb1a9d57aaad1c828499f7ecdc0360bb982a3138181bb29710354509c50998344004c73ca2b87f7866a603109c2cb79b848b3240fa08a35578b16
-	sha512sums = 7283eb04ec779a5f679e7c90f793c5d9bb2a6a44507f966156d831f0013ebcad507fbcc07d037719740861f3e23f95a532b5c9d0da707932a0da9ffd7e17349d
-	sha512sums = 6e75733d93b41b4a3d59749ce5331b9da4d6fb5fad1266bf639a948cc497c05b03ea3f15bfd6384e819730bd220dbf34dbb967c90f9683bb2529f73a4ed5897b
-	sha512sums = e88e7ce27b6d406d1fe631964b772067bc52808a74ecb57a96b5585199ec2aceab405321f9d9faf9199870fd83823afc6c5402eb85c9ed41826cedb60d8925d9
-	sha512sums = fc5dd9840f0b13bf8b66dc4901833c701293a914c54765c04c18414755f237284e93e1a7bf2660120507263500f9ab385c1c9966fe0f33e368b3fae9d695b432
-	sha512sums = f23b41b7e55c6611a77767c4ccd7010bfc5a901d241ac91826b191ca7d894e5960eda1afde05a0b52564b555006ce762620b08c9378eff733a0b89c5fd49a3e4
-	sha512sums = 755e37330fc16d99f630ed0036eaabf83b4f137123c72eae35fe47996d243ceaed1ddc6f1891efaeffb3f28fa4c0eb9b2be76308df50d98a97be24c37f5e41f0
-	sha512sums = 83454dd202685f368d0934c3949e2d3e2ecb30dd89c7a593f9210318828cd3b3b4813e216e45bcc1752b0b0d214f1979bf7ba14d00e0840e0c238cfeec88aa63
-	sha512sums = aee5b9cd718d803618e6f83f4f004853f283e89c5c8bc87b61b85189787aed0c710bba2b9ab81e148e18c685e5a1bcbe18554cc67f6123be360c3299349d0edc
-	sha512sums = 959e30368d9c4d4e82fe4beb2457f3287365e1fcb3ee5e44eb8d8e648e30b2b2ec2aa346b7bfa46d24b8f496193b154c89c471c997fe9d7d5b64277dcc5092ca
+	sha512sums = 8a630c3376cf7069f57ca22f2420e11a834c57be8a7016b9ae7125d4bd2a61b3456ba217b075e8554bfdfde3e4f59e4ff8758370641389c388af5a3383642c14
+	sha512sums = 21a12d18a330046d9d9dd7593be827b40baa4cf3915ce7968a279b43febb99c4c8a4134d2f26f3649cd991559fe155699cd5feb91bd97510bc2323de8d033bc2
+	sha512sums = 810c1219f3d008b945e75951d468d64aed2b342208c1eb9756374a880283a8a9984cf6bfa94e608fe48b3de8bdbf75f80789a1f6c1987637933e776b035b2a0a
+	sha512sums = 905e69d2af3615c80dd772d0096cb9a3773cfa42d4616f7f1709d78a4b0b8c9de19fd62d5c68943bd489fbb931aea593c1c5c67cf1c89c20d01b74158b963a81
+	sha512sums = f65e4f4b20eeac3b0efc958592fb184521b3c74d4ef95ebf12783bd057fa777ed1ff0c7b0a59369c50dc089a13f15d0799a461747d670fc37a171bb637b27ac8
+	sha512sums = 3d7410f8bdaad81563696eba0c185d187052289c29d8f23eed7067e9725e95cfa18d3ffd49c69431bf90bff943af63dcd1d823cfb0c8ee5f90a2ce8a752439c4
+	sha512sums = 11cea4c898b7290c73f3cc9aebfb4b115709487710cfe5a15843c9c21003714a57ade0440db680f44ae2ad202485e4ce302e99b44e20a4d3761b1d49b0f87192
+	sha512sums = e0f8c7c4b16d0ec39fa0e7b04954135568778e431f88aecc1292ec953a33278733f155ff876b2e4150c80894fadefbc99f8f0d7d7c6acf5cd093b098fb3be1bd
+	sha512sums = c3c48374265aa106301020463416133975536ad99e7c00e7617714270d9ee470b0143800216494fde14e2c2409322ee6dafed01497d68fda8af53f9f8ef29f23
+	sha512sums = 6e4e6c8d8d7338b88e3875a863b003472d46991b60f8df545a282efd0f09d0d6ddf53c813b5c394b42ce5d6bc489e6d3febb71e5d88a9bc0d623a467aef87416
+	sha512sums = 22a795896e538aa8065001acb0ea66363a879db672e8d72cea85dea4f516b68a341ef33b4516cf968f1215b17b7d434ae454ff55c94151a27086b87394460380
+	sha512sums = 802492d1d83dd3f197eb0e7a3fcde1f8b02a664d198729fc81b0c81a811bf29c2d0bfb7592a52f6e165efaaed9bdcea91a43000cb0d2bc16a8d63d62f06901f6
 
 pkgname = discord_arch_electron

Risk 0/5 · Safe PKGBUILD

Result #381

Comment

This change only bumps pkgver from 1.0.146 to 1.0.149 and refreshes the corresponding source checksums. The source URLs remain HTTPS and point to Discord’s official distribution endpoints, with no new build steps, scripts, privileges, or packaging behavior introduced. I did not find any evidence of added network fetches outside source=(), shell execution, persistence mechanisms, or other supply-chain red flags in this diff.

@@ -9,7 +9,7 @@
 _pkgname=discord
 _electron=electron
 pkgname=${_pkgname}_arch_electron
-pkgver=1.0.146
+pkgver=1.0.149
 pkgrel=1
 epoch=1
 pkgdesc="Discord using system provided ${_electron} for increased security and performance"

Risk 0/5 · Safe PKGBUILD

Result #382

Comment

The change only refreshes the sha512 checksums for existing upstream Discord tarballs; the source URLs remain HTTPS and unchanged, and there are no new build steps, scripts, or privilege/network behaviors introduced. I don’t see any supply-chain red flags in this hunk beyond the normal trust placed in upstream release artifacts.

@@ -46,23 +46,23 @@ source=("https://dl.discordapp.net/apps/linux/${pkgver}/${_pkgname}-${pkgver}.ta
         "discord_modules-${pkgver}.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/${pkgver}/discord_modules/1/full.distro"
         "discord_spellcheck-${pkgver}.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/${pkgver}/discord_spellcheck/1/full.distro"
         "discord_dispatch-${pkgver}.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/${pkgver}/discord_dispatch/1/full.distro")
-sha512sums=('b90cf25a6e615e836e0ef248b3090f23d90c2a6d73faeb21954ba669fb39275c26ac58a8f9e92445254c29fb90716cab54bee06f701cde88f74578c4228bc22b'
+sha512sums=('07cec6aea9e36ffe7d786b55ea76f38e7469d14fc2c2d853686230f416f4e07886f02c883d929338d4b87c3d7a0b412f0e0da94f62f6b976d65a59dab759bff0'
             '2590151db4404a9ecbae2c45269c74f5ea26479967de5bc0b221a9143f4efeeeda9e335c23cf1f982680ab4fd895dcf3fd5731bd230908b3b2568eee0ec223ec'
             '5cccf397a772fed0db9b19253e496e78af27810227325ce681de985e2e0fbbdb195873d9642574ad3ae7bfcf4699bfdaa16933ca50c13cb98a1ff53c86c6de05'
             'd5373e2b2e9754bdcdbcda81fc1392ce6605939651839868823f3c3e0bf16f6fba2fb73bc1a0ff230eebd743d1463f2e8b2295503248f14845b3a56e57385bd1'
             '85da93530b2b92faad58cc84d0f7ddaea6b22fbec413e806c1981eb6369a301ec995eee6bfbe6b828e2cd0baf6168e578bbde456f2450a13199994ff9a1e7cd0'
-            'dca9bbf55afcb1425af7bd0fc4d891fe0cc37859436a8b2a1ae9d29689d72e574dc2f974d468a86527c0420847fd27af5517da7b02075ee2eebe8bd2d43a7d09'
-            '88024b0faf4e4db8e283af9081b88072ec8ab908e4b72a7c0bab8ae7fcb3c5ae09b2b3e34af0b35429b51f46be359dc39983191e376a762c6c4831d4918a9792'
-            'b7a676bd7e7cb1a9d57aaad1c828499f7ecdc0360bb982a3138181bb29710354509c50998344004c73ca2b87f7866a603109c2cb79b848b3240fa08a35578b16'
-            '7283eb04ec779a5f679e7c90f793c5d9bb2a6a44507f966156d831f0013ebcad507fbcc07d037719740861f3e23f95a532b5c9d0da707932a0da9ffd7e17349d'
-            '6e75733d93b41b4a3d59749ce5331b9da4d6fb5fad1266bf639a948cc497c05b03ea3f15bfd6384e819730bd220dbf34dbb967c90f9683bb2529f73a4ed5897b'
-            'e88e7ce27b6d406d1fe631964b772067bc52808a74ecb57a96b5585199ec2aceab405321f9d9faf9199870fd83823afc6c5402eb85c9ed41826cedb60d8925d9'
-            'fc5dd9840f0b13bf8b66dc4901833c701293a914c54765c04c18414755f237284e93e1a7bf2660120507263500f9ab385c1c9966fe0f33e368b3fae9d695b432'
-            'f23b41b7e55c6611a77767c4ccd7010bfc5a901d241ac91826b191ca7d894e5960eda1afde05a0b52564b555006ce762620b08c9378eff733a0b89c5fd49a3e4'
-            '755e37330fc16d99f630ed0036eaabf83b4f137123c72eae35fe47996d243ceaed1ddc6f1891efaeffb3f28fa4c0eb9b2be76308df50d98a97be24c37f5e41f0'
-            '83454dd202685f368d0934c3949e2d3e2ecb30dd89c7a593f9210318828cd3b3b4813e216e45bcc1752b0b0d214f1979bf7ba14d00e0840e0c238cfeec88aa63'
-            'aee5b9cd718d803618e6f83f4f004853f283e89c5c8bc87b61b85189787aed0c710bba2b9ab81e148e18c685e5a1bcbe18554cc67f6123be360c3299349d0edc'
-            '959e30368d9c4d4e82fe4beb2457f3287365e1fcb3ee5e44eb8d8e648e30b2b2ec2aa346b7bfa46d24b8f496193b154c89c471c997fe9d7d5b64277dcc5092ca')
+            '8a630c3376cf7069f57ca22f2420e11a834c57be8a7016b9ae7125d4bd2a61b3456ba217b075e8554bfdfde3e4f59e4ff8758370641389c388af5a3383642c14'
+            '21a12d18a330046d9d9dd7593be827b40baa4cf3915ce7968a279b43febb99c4c8a4134d2f26f3649cd991559fe155699cd5feb91bd97510bc2323de8d033bc2'
+            '810c1219f3d008b945e75951d468d64aed2b342208c1eb9756374a880283a8a9984cf6bfa94e608fe48b3de8bdbf75f80789a1f6c1987637933e776b035b2a0a'
+            '905e69d2af3615c80dd772d0096cb9a3773cfa42d4616f7f1709d78a4b0b8c9de19fd62d5c68943bd489fbb931aea593c1c5c67cf1c89c20d01b74158b963a81'
+            'f65e4f4b20eeac3b0efc958592fb184521b3c74d4ef95ebf12783bd057fa777ed1ff0c7b0a59369c50dc089a13f15d0799a461747d670fc37a171bb637b27ac8'
+            '3d7410f8bdaad81563696eba0c185d187052289c29d8f23eed7067e9725e95cfa18d3ffd49c69431bf90bff943af63dcd1d823cfb0c8ee5f90a2ce8a752439c4'
+            '11cea4c898b7290c73f3cc9aebfb4b115709487710cfe5a15843c9c21003714a57ade0440db680f44ae2ad202485e4ce302e99b44e20a4d3761b1d49b0f87192'
+            'e0f8c7c4b16d0ec39fa0e7b04954135568778e431f88aecc1292ec953a33278733f155ff876b2e4150c80894fadefbc99f8f0d7d7c6acf5cd093b098fb3be1bd'
+            'c3c48374265aa106301020463416133975536ad99e7c00e7617714270d9ee470b0143800216494fde14e2c2409322ee6dafed01497d68fda8af53f9f8ef29f23'
+            '6e4e6c8d8d7338b88e3875a863b003472d46991b60f8df545a282efd0f09d0d6ddf53c813b5c394b42ce5d6bc489e6d3febb71e5d88a9bc0d623a467aef87416'
+            '22a795896e538aa8065001acb0ea66363a879db672e8d72cea85dea4f516b68a341ef33b4516cf968f1215b17b7d434ae454ff55c94151a27086b87394460380'
+            '802492d1d83dd3f197eb0e7a3fcde1f8b02a664d198729fc81b0c81a811bf29c2d0bfb7592a52f6e165efaaed9bdcea91a43000cb0d2bc16a8d63d62f06901f6')
 
 # Skip "LICENSE.html" and "OSS-LICENSES.html" files hashes as they are unstable
 # Since "updpkgsums"/"pkgctl version upgrade" overwrite the checksum array with