Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 3.0.2 to 3.0.3, with the source URL still using HTTPS and pinned to an upstream GitHub release tag. The checksum was updated accordingly. No new build steps, scripts, dependencies, or packaging behavior were introduced in this diff, so there is no evident security impact from the metadata-only change itself.

@@ -1,6 +1,6 @@
 pkgbase = android-apktool
 	pkgdesc = A tool for reengineering Android apk files
-	pkgver = 3.0.2
+	pkgver = 3.0.3
 	pkgrel = 1
 	url = https://github.com/iBotPeaches/Apktool
 	arch = any

Comment

The change is a straightforward version bump in .SRCINFO from Apktool 3.0.2 to 3.0.3, with the source URL still using HTTPS and pointing to the official upstream GitHub release archive. The checksum was updated accordingly. No new sources, build steps, scripts, or packaging metadata were introduced, and there are no signs of persistence, privilege escalation, or integrity bypass in this diff. Risk is minimal.

@@ -8,7 +8,7 @@ pkgbase = android-apktool
 	makedepends = java-environment=26
 	makedepends = gradle
 	depends = java-runtime
-	source = android-apktool-3.0.2.tar.gz::https://github.com/iBotPeaches/Apktool/archive/refs/tags/v3.0.2.tar.gz
-	sha256sums = 058b9f8d2813484fdcec9fb556669861e23d1cfe2ed4dbaf78e7b877c1fc28d2
+	source = android-apktool-3.0.3.tar.gz::https://github.com/iBotPeaches/Apktool/archive/refs/tags/v3.0.3.tar.gz
+	sha256sums = 22b577d080ca53381c61cbeade7d80ff7a5f365faeb469ec80b2bce6bdd1f763
 
 pkgname = android-apktool

Comment

The change is a straightforward version bump in PKGBUILD from 3.0.2 to 3.0.3 with no accompanying logic changes in the provided hunk. By itself this does not introduce any new build steps, network fetches, privilege changes, or packaging behavior. Based on the diff shown, there are no security red flags to flag in this change alone.

@@ -2,7 +2,7 @@
 # Contributor: navigaid <navigaid@gmail.com>
 
 pkgname=android-apktool
-pkgver=3.0.2
+pkgver=3.0.3
 pkgrel=1
 _jdkver=26
 pkgdesc="A tool for reengineering Android apk files"

Comment

The change only updates the SHA-256 checksum for the existing upstream source tarball URL. The source remains an HTTPS GitHub release archive for the expected project, with no new build steps, scripts, binaries, or packaging behavior introduced. I don’t see any added supply-chain, persistence, or privilege-escalation risk in this diff hunk.

@@ -12,7 +12,7 @@ license=("Apache-2.0")
 depends=("java-runtime")
 makedepends=("java-environment=${_jdkver}" "gradle")
 source=("${pkgname}-${pkgver}.tar.gz"::"https://github.com/iBotPeaches/Apktool/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('058b9f8d2813484fdcec9fb556669861e23d1cfe2ed4dbaf78e7b877c1fc28d2')
+sha256sums=('22b577d080ca53381c61cbeade7d80ff7a5f365faeb469ec80b2bce6bdd1f763')
 
 build() {
   cd "Apktool-${pkgver}"