Review Results

Comment

The change only bumps the package version and updates the upstream tarball/checksum in .SRCINFO. I do note that the source URL still uses plain HTTP rather than HTTPS, which is a supply-chain integrity weakness because the archive could be MITM-tampered in transit. However, this issue already existed in the previous version and is not introduced by this diff. No new suspicious sources, build-time downloads, or packaging/persistence behavior are present in the reviewed change, so the risk of this specific update is low.

@@ -1,6 +1,6 @@
 pkgbase = geekbench
 	pkgdesc = A cross-platform benchmark that measures processor and memory performance
-	pkgver = 6.7.1
+	pkgver = 7.0.0
 	pkgrel = 1
 	url = https://www.geekbench.com/
 	arch = x86_64

Comment

Risk is low. The change only bumps the packaged upstream Geekbench tarball from 6.7.1 to 7.0.0 and updates the corresponding SHA-256 in .SRCINFO. There are no new sources, no build-script changes, no added install hooks, and no evidence of network access or privilege escalation beyond the existing upstream download. One minor hygiene issue remains unchanged: the source URL still uses plain HTTP instead of HTTPS, which is a supply-chain integrity concern, but it is pre-existing and not introduced by this diff.

@@ -9,7 +9,7 @@ pkgbase = geekbench
 	depends = gcc-libs
 	conflicts = geekbench227
 	options = !strip
-	source = http://cdn.geekbench.com/Geekbench-6.7.1-Linux.tar.gz
-	sha256sums = 0ddca977deb6d9db4bd866485f9408e72e2869d0dea0737b18d4bfe472858ace
+	source = http://cdn.geekbench.com/Geekbench-7.0.0-Linux.tar.gz
+	sha256sums = 961a00ac0ac432ffa6874764e86c59d2e098fff65b5b398bb9381bf7fc46c81b
 
 pkgname = geekbench

Comment

The change is a straightforward version bump in PKGBUILD metadata: maintainer line updated and pkgver moved from 6.7.1 to 7.0.0. No new sources, build steps, install scripts, dependencies, or packaging logic are shown in the diff, so there is no evidence here of malicious code execution, persistence, or integrity bypass. Based on the provided hunk alone, this looks low risk.

@@ -1,10 +1,11 @@
-# Maintainer: Jake <aur@ja-ke.tech>
+# Maintainer:  Radu Potop <radu at wooptoo dot com>
+# Contributor: Jake <aur@ja-ke.tech>
 # Contributor: jose <jose1711 [at] gmail (dot) com>
 # Contributor: Roman Ajsin <aysin (dot) roman [at] gmail (dot) com>
 # Contributor: Hurricane Pootis <hurricanepootis@protonmail.com>
 
 pkgname=geekbench
-pkgver=6.7.1
+pkgver=7.0.0
 pkgrel=1
 pkgdesc="A cross-platform benchmark that measures processor and memory performance"
 arch=('x86_64')

Comment

The change appears to be a straightforward upstream version bump/packaging update for Geekbench 7: it switches the installed payload from the old Geekbench 6 binaries and .plar files to the new Geekbench 7 equivalents, and updates the source checksum accordingly. The source is still fetched over plain HTTP from the vendor CDN, which is a supply-chain integrity concern in general, but that issue already existed in the previous package state and is not introduced by this diff. I do not see any new code execution, network access at build time, privilege escalation, persistence, or suspicious install-script/systemd behavior in the provided hunk.

@@ -14,14 +15,15 @@ license=("custom")
 conflicts=("geekbench227")
 source=("http://cdn.geekbench.com/Geekbench-${pkgver}-Linux.tar.gz")
 options=('!strip')
-sha256sums=('0ddca977deb6d9db4bd866485f9408e72e2869d0dea0737b18d4bfe472858ace')
+sha256sums=('961a00ac0ac432ffa6874764e86c59d2e098fff65b5b398bb9381bf7fc46c81b')
 
 package() {
-    install -D -m755 $srcdir/Geekbench-${pkgver}-Linux/${pkgname}_x86_64 $pkgdir/opt/${pkgname}/${pkgname}_x86_64
-    install -D -m755 $srcdir/Geekbench-${pkgver}-Linux/${pkgname}_avx2 $pkgdir/opt/${pkgname}/${pkgname}_avx2
-    install -D -m644 $srcdir/Geekbench-${pkgver}-Linux/geekbench.plar $pkgdir/opt/${pkgname}/geekbench.plar
-    install -D -m644 $srcdir/Geekbench-${pkgver}-Linux/geekbench-workload.plar $pkgdir/opt/${pkgname}/geekbench-workload.plar
-    install -D -m755 $srcdir/Geekbench-${pkgver}-Linux/${pkgname}6 $pkgdir/opt/${pkgname}/
-    install -d $pkgdir/usr/bin
-    ln -s /opt/${pkgname}/${pkgname}6 $pkgdir/usr/bin/${pkgname}
+    local dest="$pkgdir/opt/${pkgname}"
+    install -D -m755 "$srcdir/Geekbench-${pkgver}-Linux/${pkgname}7" "$dest/${pkgname}7"
+    install -D -m755 "$srcdir/Geekbench-${pkgver}-Linux/${pkgname}_avx2" "$dest/${pkgname}_avx2"
+    install -D -m755 "$srcdir/Geekbench-${pkgver}-Linux/${pkgname}_x86_64" "$dest/${pkgname}_x86_64"
+    install -D -m644 "$srcdir/Geekbench-${pkgver}-Linux/geekbench.plxr" "$dest/geekbench.plxr"
+    install -D -m644 "$srcdir/Geekbench-${pkgver}-Linux/geekbench-workload.plxr" "$dest/geekbench-workload.plxr"
+    install -d "$pkgdir/usr/bin"
+    ln -s "/opt/${pkgname}/${pkgname}7" "$pkgdir/usr/bin/${pkgname}"
 }