Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 12.3.0 to 12.3.1, with no accompanying changes to sources, checksums, install scripts, or packaging metadata. On its face this is a routine upstream version update and does not introduce any new security-relevant behavior in the reviewed hunk. I did not see evidence in the provided diff of suspicious sources, build-time downloads, privilege escalation, or persistence mechanisms.

@@ -1,6 +1,6 @@
 pkgbase = gitkraken
 	pkgdesc = The intuitive, fast, and beautiful cross-platform Git client.
-	pkgver = 12.3.0
+	pkgver = 12.3.1
 	pkgrel = 1
 	url = https://www.gitkraken.com/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from GitKraken 12.3.0 to 12.3.1 for both x86_64 and aarch64, with corresponding checksum updates. The source URLs remain HTTPS and point to the vendor’s release API, and there are no new scripts, build steps, privilege changes, or other suspicious packaging metadata in this diff. Based on the provided hunk alone, I don’t see a security issue.

@@ -23,9 +23,9 @@ pkgbase = gitkraken
 	sha256sums = 4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e
 	sha256sums = 4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a
 	sha256sums = 5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6
-	source_x86_64 = gitkraken-12.3.0-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/12.3.0/gitkraken-amd64.tar.gz
-	sha256sums_x86_64 = a0609c00fe7c7f25dba3574f6abc88bf41c14450f70d157be2bb645650af187d
-	source_aarch64 = gitkraken-12.3.0-aarch64.tar.gz::https://api.gitkraken.dev/releases/production/linux/arm64/12.3.0/gitkraken-aarch64.tar.gz
-	sha256sums_aarch64 = 9bf90aabf89982ebd3b782d8cee60cb8fecc7e95d89c266ed8dbf914ad2b9029
+	source_x86_64 = gitkraken-12.3.1-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/12.3.1/gitkraken-amd64.tar.gz
+	sha256sums_x86_64 = 377f3b94ff1df9225906bc8134d505b14c1e6be82dea07463e14a62439b3319d
+	source_aarch64 = gitkraken-12.3.1-aarch64.tar.gz::https://api.gitkraken.dev/releases/production/linux/arm64/12.3.1/gitkraken-aarch64.tar.gz
+	sha256sums_aarch64 = 604cde7640a2375f47ad805d82e16ddbc67902517148bdd27892de09ffa78c05
 
 pkgname = gitkraken

Comment

The change is a straightforward version bump in PKGBUILD from 12.3.0 to 12.3.1 with no changes to sources, build steps, install scripts, permissions, or package metadata beyond pkgver. I see no new supply-chain, persistence, or privilege-escalation risk introduced by this diff alone.

@@ -12,7 +12,7 @@
 
 pkgname=gitkraken
 pkgrel=1
-pkgver=12.3.0
+pkgver=12.3.1
 pkgdesc="The intuitive, fast, and beautiful cross-platform Git client."
 url="https://www.gitkraken.com/"
 provides=('gitkraken')

Comment

The change only updates the package version and the expected SHA-256 checksums for the upstream release tarballs on x86_64 and aarch64. The source URLs remain HTTPS and point to the official GitKraken API, and there are no new build steps, scripts, or packaging behaviors introduced. I do not see any added supply-chain, persistence, or privilege-escalation risk in this diff.

@@ -36,8 +36,8 @@ sha256sums=('af2d2e5a44ec6e543c34f94cfb89fe34b6c05d2baf6ca9db5b6d332e4a5686e5'
             '4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e'
             '4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a'
             '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6')
-sha256sums_x86_64=('a0609c00fe7c7f25dba3574f6abc88bf41c14450f70d157be2bb645650af187d')
-sha256sums_aarch64=('9bf90aabf89982ebd3b782d8cee60cb8fecc7e95d89c266ed8dbf914ad2b9029')
+sha256sums_x86_64=('377f3b94ff1df9225906bc8134d505b14c1e6be82dea07463e14a62439b3319d')
+sha256sums_aarch64=('604cde7640a2375f47ad805d82e16ddbc67902517148bdd27892de09ffa78c05')
 options=('!strip' '!debug')
 
 package() {