Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 7.1.0 to 7.1.5. No sources, checksums, install scripts, build steps, permissions, or package metadata beyond pkgver were altered in the provided diff. On its face this is a routine upstream version update with no direct security red flags in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = zoom
 	pkgdesc = Video Conferencing and Web Conferencing Service
-	pkgver = 7.1.0
+	pkgver = 7.1.5
 	pkgrel = 1
 	url = https://zoom.us/
 	arch = x86_64

Comment

The change only updates .SRCINFO metadata to point at a newer upstream Zoom binary package and refreshes the corresponding SHA-512 checksum. The source remains an HTTPS URL on the official zoom.us domain, and there are no new build steps, scripts, patches, or privilege-related changes in this diff. From the reviewed hunk alone, this looks like a routine version bump with no obvious security red flags.

@@ -41,7 +41,7 @@ pkgbase = zoom
 	replaces = zoom-libs-bin
 	replaces = zoom-libs
 	options = !strip
-	source = zoom-7.1.0.3715_orig_x86_64.pkg.tar.xz::https://zoom.us/client/7.1.0.3715/zoom_x86_64.pkg.tar.xz
-	sha512sums = df795f55bcfbd26c1a6c2cc79dc6a251f9011ca097efcd43f75422652e0ee0f017539f8624aa7e51b7092b66962f24e32454a69c93b7faaaaea8f01b6c4b4463
+	source = zoom-7.1.5.4332_orig_x86_64.pkg.tar.xz::https://zoom.us/client/7.1.5.4332/zoom_x86_64.pkg.tar.xz
+	sha512sums = d5ca18a754565c569825606646488f9b51b757685fb5788b2b327356a00489812f66582c6f6d8d4ea8d03ca1c6f036b271f74f1b97f3dc2dcc54a115e13aa484
 
 pkgname = zoom

Comment

The change only bumps the Zoom package version from 7.1.0-3715 to 7.1.5-4332 in PKGBUILD metadata. No build logic, sources, checksums, install scripts, or permissions are modified in the provided diff, so there is no new security concern introduced by this change alone. The risk is low and limited to the usual trust in the upstream Zoom binary package, which is unchanged by this diff.

@@ -2,8 +2,8 @@
 # Maintainer: Christian Heusel <christian@heusel.eu>
 
 pkgname=zoom
-pkgver=7.1.0
-_subver=3715
+pkgver=7.1.5
+_subver=4332
 pkgrel=1
 pkgdesc="Video Conferencing and Web Conferencing Service"
 arch=('x86_64')

Comment

The change only updates the sha512 checksum for the upstream Zoom binary package source URL, which remains HTTPS and points to the official zoom.us client download. There are no new build steps, no added scripts, and no packaging behavior changes. The security impact is limited to integrity verification of the same upstream artifact; without evidence that the new checksum is incorrect or that the source URL changed, this looks like a routine upstream package refresh rather than a supply-chain risk.

@@ -24,7 +24,7 @@ optdepends=('pulseaudio-alsa: audio via PulseAudio'
 )
 options=(!strip)
 source=("${pkgname}-${pkgver}.${_subver}_orig_x86_64.pkg.tar.xz"::"https://zoom.us/client/${pkgver}.${_subver}/zoom_x86_64.pkg.tar.xz")
-sha512sums=('df795f55bcfbd26c1a6c2cc79dc6a251f9011ca097efcd43f75422652e0ee0f017539f8624aa7e51b7092b66962f24e32454a69c93b7faaaaea8f01b6c4b4463')
+sha512sums=('d5ca18a754565c569825606646488f9b51b757685fb5788b2b327356a00489812f66582c6f6d8d4ea8d03ca1c6f036b271f74f1b97f3dc2dcc54a115e13aa484')
 
 package() {
 	cp -dpr --no-preserve=ownership opt usr "${pkgdir}"