Review Results

Comment

The change is limited to .SRCINFO metadata updating the package version from 5.2.3.32296 to 5.2.4.32425 and regenerating the timestamp. No build logic, sources, checksums, install scripts, or permissions are changed in the provided diff hunk. On its face this is a routine version bump with no security-relevant red flags in the reviewed change.

@@ -1,7 +1,7 @@
 # Generated by mksrcinfo v8
-# Thu Jul  2 03:20:32 UTC 2026
+# Thu Jul 23 10:02:59 UTC 2026
 pkgbase = bcompare
-	pkgver = 5.2.3.32296
+	pkgver = 5.2.4.32425
 	pkgrel = 1
 	url = https://www.scootersoftware.com
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO: the source URL remains HTTPS on the vendor’s official domain, and the checksum is updated accordingly. No new build steps, scripts, dependencies, or privilege-related metadata were introduced. I don’t see any supply-chain red flags in this diff alone.

@@ -10,8 +10,8 @@ pkgbase = bcompare
 	makedepends = sed
 	depends = qt6-base
 	options = !strip
-	source = https://www.scootersoftware.com/bcompare-5.2.3.32296.x86_64.tar.gz
-	sha256sums = 2ed6179a20c7842439e454dd85546951b000ef865c3a87314c8f229655cbd3aa
+	source = https://www.scootersoftware.com/files/bcompare-5.2.4.32425.x86_64.tar.gz
+	sha256sums = c1a050d3741e422e1f0fd270d2301d5087b9217cf5d91647da408231a5b09dcf
 
 pkgname = bcompare
 	pkgdesc = Beyond Compare 5: Compare, sync, and merge files and folders.

Comment

Risk is low. The change is a straightforward version bump plus an updated upstream download URL and checksum. The source remains HTTPS and points to the vendor’s official site, with no new build-time commands, scripts, or packaging logic changes. I do note that this package ships a prebuilt upstream tarball (so trust is entirely in the vendor release and checksum), but this commit does not introduce any new integrity or execution concerns beyond that existing model.

@@ -12,7 +12,7 @@
 
 pkgbase=bcompare
 pkgname=('bcompare' 'bcompare-kde6' 'bcompare-kde5' 'bcompare-kde4' 'bcompare-nautilus' 'bcompare-thunar' 'bcompare-cinnamon' 'bcompare-mate')
-pkgver=5.2.3.32296
+pkgver=5.2.4.32425
 pkgrel=1
 arch=('x86_64')
 url='https://www.scootersoftware.com'

Comment

The change is a straightforward upstream version bump plus a source URL path adjustment from scootersoftware.com to scootersoftware.com/files, with a matching checksum update. I do not see any new build-time execution, extra sources, privilege escalation, persistence mechanisms, or integrity regressions in the diff. The package still downloads a single HTTPS tarball from the vendor site and verifies it with SHA-256. Risk is low.

@@ -20,8 +20,8 @@ license=('custom')
 groups=('utility')
 depends=('qt6-base')
 makedepends=('sed')
-source=("https://www.scootersoftware.com/${pkgbase}-${pkgver}.x86_64.tar.gz")
-sha256sums=('2ed6179a20c7842439e454dd85546951b000ef865c3a87314c8f229655cbd3aa')
+source=("https://www.scootersoftware.com/files/${pkgbase}-${pkgver}.x86_64.tar.gz")
+sha256sums=('c1a050d3741e422e1f0fd270d2301d5087b9217cf5d91647da408231a5b09dcf')
 options=('!strip') # Do not strip binaries because it breaks them down
 
  prepare() {