AUR AI Reviewer

Review Results

Version #1819 of ngrok · commit 9b7e269d317b · status Reviewed

Risk 0/5 · Safe .SRCINFO
Result #674

Comment

The only change in this .SRCINFO hunk is a version bump from 3.39.9 to 3.39.10. There are no changes to source URLs, checksums, dependencies, install scripts, permissions, or packaging behavior in the provided diff. On its own, this is low risk and does not introduce an obvious supply-chain or privilege-escalation concern.

@@ -1,6 +1,6 @@
 pkgbase = ngrok
 	pkgdesc = A tunneling, reverse proxy for developing and understanding networked, HTTP services
-	pkgver = 3.39.9
+	pkgver = 3.39.10
 	pkgrel = 1
 	url = https://ngrok.com
 	arch = i686
Risk 0/5 · Safe .SRCINFO
Result #675

Comment

The change only bumps ngrok’s upstream release tarball URLs and corresponding SHA256 checksums in .SRCINFO from 3.39.9 to 3.39.10. The sources remain HTTPS on the official Equinox bin host, are version-pinned, and there are no new build-time commands, install-script changes, or packaging red flags in this diff. Based on the provided hunk alone, this looks like a routine version update with no evident security issue.

@@ -12,13 +12,13 @@ pkgbase = ngrok
 	options = !strip
 	source = TERMS-OF-SERVICE.txt
 	sha256sums = d1fce3c7e78d5f7e5307238ee5f371b7a10911aeb249e3358e945eaa8cf2f1b2
-	source_i686 = https://bin.equinox.io/a/jEtFg4yox4u/ngrok-v3-3.39.9-linux-386.tar.gz
-	sha256sums_i686 = 9daf4b21dd2b9743949992706c1ef44457b1dfd44542f182a2c55ea59115c52b
-	source_x86_64 = https://bin.equinox.io/a/5nBQH3CiRsa/ngrok-v3-3.39.9-linux-amd64.tar.gz
-	sha256sums_x86_64 = 0b74db428f655944292cf6c554d35c8941faeccff87d5a6835152c7a08281ff0
-	source_armv7h = https://bin.equinox.io/a/6z2GognC1cY/ngrok-v3-3.39.9-linux-arm.tar.gz
-	sha256sums_armv7h = b0f9e39668406d361d44a242546ebba4144256ff3c320032205379c18a1ead83
-	source_aarch64 = https://bin.equinox.io/a/bd5z9PXqhwe/ngrok-v3-3.39.9-linux-arm64.tar.gz
-	sha256sums_aarch64 = 97fb70d88c83ee44d9655b67e877702a1fc0e75656d33d414043772cd3750c1f
+	source_i686 = https://bin.equinox.io/a/yYu6hg4DiE/ngrok-v3-3.39.10-linux-386.tar.gz
+	sha256sums_i686 = cff5b6e704090d9fccc9c43b44d6418ca8445eff2187433466a223adac81353a
+	source_x86_64 = https://bin.equinox.io/a/9sRAW6esxUB/ngrok-v3-3.39.10-linux-amd64.tar.gz
+	sha256sums_x86_64 = 9dfbe1a914e69cc7e980d61e6bd5a642025918102c5bc69905d1c57703aca3e8
+	source_armv7h = https://bin.equinox.io/a/fPHdc3GnMU4/ngrok-v3-3.39.10-linux-arm.tar.gz
+	sha256sums_armv7h = a23e84d4706587740a5d590fa57fc42e289f2fd23c8694e9265a398890efb753
+	source_aarch64 = https://bin.equinox.io/a/hqQ7mubGtHu/ngrok-v3-3.39.10-linux-arm64.tar.gz
+	sha256sums_aarch64 = 7176f5e5d5a2f6c332ff911ef895741f13168f1f0c225492c4412bde8b2f9a0d
 
 pkgname = ngrok
Risk 0/5 · Safe PKGBUILD
Result #676

Comment

The change is a routine version bump in PKGBUILD from 3.39.9 to 3.39.10 with no accompanying changes to sources, checksums, build logic, install scripts, or package metadata. On its face this does not introduce new attack surface or packaging risk beyond the usual trust in the upstream release already referenced by the package.

@@ -4,7 +4,7 @@
 # Contributor: Peter Sutton (foxxy) <foxxy@foxdogstudios.com>
 
 pkgname=ngrok
-pkgver=3.39.9
+pkgver=3.39.10
 pkgrel=1
 pkgdesc='A tunneling, reverse proxy for developing and understanding networked, HTTP services'
 url='https://ngrok.com'
Risk 0/5 · Safe PKGBUILD
Result #677

Comment

The change is a routine version bump of upstream ngrok release artifacts from 3.39.9 to 3.39.10, with matching per-arch SHA256 updates. The sources remain HTTPS from the official bin.equinox.io distribution endpoint, and there are no new build-time commands, install-script changes, privilege escalations, or packaging behavior changes in this hunk. Risk is low; the only residual concern is that this package ships prebuilt upstream binaries, so trust is still placed in upstream release integrity, but this diff itself does not introduce additional red flags.

@@ -12,15 +12,15 @@ license=('LicenseRef-custom')
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')
 optdepends=('bash-completion: Bash completion support')
 source=("TERMS-OF-SERVICE.txt")
-source_x86_64=("https://bin.equinox.io/a/5nBQH3CiRsa/ngrok-v3-3.39.9-linux-amd64.tar.gz")
-source_i686=("https://bin.equinox.io/a/jEtFg4yox4u/ngrok-v3-3.39.9-linux-386.tar.gz")
-source_armv7h=("https://bin.equinox.io/a/6z2GognC1cY/ngrok-v3-3.39.9-linux-arm.tar.gz")
-source_aarch64=("https://bin.equinox.io/a/bd5z9PXqhwe/ngrok-v3-3.39.9-linux-arm64.tar.gz")
+source_x86_64=("https://bin.equinox.io/a/9sRAW6esxUB/ngrok-v3-3.39.10-linux-amd64.tar.gz")
+source_i686=("https://bin.equinox.io/a/yYu6hg4DiE/ngrok-v3-3.39.10-linux-386.tar.gz")
+source_armv7h=("https://bin.equinox.io/a/fPHdc3GnMU4/ngrok-v3-3.39.10-linux-arm.tar.gz")
+source_aarch64=("https://bin.equinox.io/a/hqQ7mubGtHu/ngrok-v3-3.39.10-linux-arm64.tar.gz")
 sha256sums=('d1fce3c7e78d5f7e5307238ee5f371b7a10911aeb249e3358e945eaa8cf2f1b2')
-sha256sums_i686=('9daf4b21dd2b9743949992706c1ef44457b1dfd44542f182a2c55ea59115c52b')
-sha256sums_x86_64=('0b74db428f655944292cf6c554d35c8941faeccff87d5a6835152c7a08281ff0')
-sha256sums_armv7h=('b0f9e39668406d361d44a242546ebba4144256ff3c320032205379c18a1ead83')
-sha256sums_aarch64=('97fb70d88c83ee44d9655b67e877702a1fc0e75656d33d414043772cd3750c1f')
+sha256sums_i686=('cff5b6e704090d9fccc9c43b44d6418ca8445eff2187433466a223adac81353a')
+sha256sums_x86_64=('9dfbe1a914e69cc7e980d61e6bd5a642025918102c5bc69905d1c57703aca3e8')
+sha256sums_armv7h=('a23e84d4706587740a5d590fa57fc42e289f2fd23c8694e9265a398890efb753')
+sha256sums_aarch64=('7176f5e5d5a2f6c332ff911ef895741f13168f1f0c225492c4412bde8b2f9a0d')
 
 # In order to make Ngrok's built-in updater happy, we need to avoid modifying the binary
 options=(!strip)