Review Results

Comment

The change only bumps the package version in .SRCINFO from 1.32.6 to 1.32.7. No sources, checksums, build steps, install scripts, or packaging metadata affecting execution or privileges were modified in the provided diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = gallery-dl
 	pkgdesc = Command-line program to download image-galleries and collections from several image hosting sites
-	pkgver = 1.32.6
+	pkgver = 1.32.7
 	pkgrel = 1
 	url = https://codeberg.org/mikf/gallery-dl
 	arch = any

Comment

The change is a straightforward upstream version bump in .SRCINFO from v1.32.6 to v1.32.7, with the corresponding sha512 checksum updated. The source remains the official Codeberg repository over HTTPS and is still pinned to a signed tag, with the same PGP key listed. No new sources, scripts, install hooks, or packaging behavior are introduced in this diff. Based on the provided hunk alone, this looks low risk.

@@ -27,8 +27,8 @@ pkgbase = gallery-dl
 	optdepends = python-psycopg: PostgreSQL support
 	optdepends = python-truststore: Support using system certificates
 	optdepends = python-jinja: Jinja template support
-	source = git+https://codeberg.org/mikf/gallery-dl.git#tag=v1.32.6?signed
+	source = git+https://codeberg.org/mikf/gallery-dl.git#tag=v1.32.7?signed
 	validpgpkeys = 3E09F5908333DD83DBDCE7375680CA389D365A88
-	sha512sums = 59df4d48dad8c60980fc0ea57abbc2aa7004839fad2f263e85a45221999f66a318b100e6b63b38c0c861829430317ea6c950a38ce7f84e28eb590eeef9534083
+	sha512sums = c3789d2627d916ecce4e09a95ecdd5ee373ba5273afbce5b0784ca4c482dd842c74472aa632e01ba28f2349da1c0384d6251a75fca9cc0b2f928714ae1473259
 
 pkgname = gallery-dl

Comment

The change is a simple version bump in PKGBUILD from 1.32.6 to 1.32.7 with no accompanying changes to sources, build steps, install scripts, or package metadata. Based on the provided diff hunk, there are no new security concerns introduced by this update itself.

@@ -2,7 +2,7 @@
 # Contributor: LLL2yu <lll2yu@protonmail.com>
 
 pkgname=gallery-dl
-pkgver=1.32.6
+pkgver=1.32.7
 pkgrel=1
 pkgdesc='Command-line program to download image-galleries and collections from several image hosting sites'
 arch=(any)

Comment

The change is a straightforward version bump from 1.32.6 to 1.32.7 with the corresponding source checksum update. The package continues to fetch from the upstream git tag over HTTPS and verifies the tag with the existing PGP key. No new build steps, scripts, dependencies, or install-time behavior were introduced in this diff. I don’t see any supply-chain, persistence, or privilege-escalation concerns in the reviewed hunk.

@@ -29,7 +29,7 @@ optdepends=(
 )
 source=(git+"${url}".git#tag=v"${pkgver}"?signed)
 validpgpkeys=(3E09F5908333DD83DBDCE7375680CA389D365A88) #Mike Fährmann
-sha512sums=('59df4d48dad8c60980fc0ea57abbc2aa7004839fad2f263e85a45221999f66a318b100e6b63b38c0c861829430317ea6c950a38ce7f84e28eb590eeef9534083')
+sha512sums=('c3789d2627d916ecce4e09a95ecdd5ee373ba5273afbce5b0784ca4c482dd842c74472aa632e01ba28f2349da1c0384d6251a75fca9cc0b2f928714ae1473259')
 
 prepare() {
     # Clean out old wheels etc.