Review Results

Comment

The .SRCINFO change is limited to a version bump from 1.3.17.2-3 to 1.3.18.1-1 and does not introduce any new sources, build steps, install scripts, permissions, or metadata that would indicate a security issue. On its face this is a routine package update; any risk would depend on the accompanying PKGBUILD/source changes, which are not part of this diff hunk.

@@ -1,7 +1,7 @@
 pkgbase = aseprite
 	pkgdesc = Create animated sprites and pixel art
-	pkgver = 1.3.17.2
-	pkgrel = 3
+	pkgver = 1.3.18.1
+	pkgrel = 1
 	url = https://www.aseprite.org/
 	arch = x86_64
 	license = LicenseRef-Aseprite-EULA

Comment

Risk score 0. This change only updates .SRCINFO metadata for a normal upstream version bump: the release tarball URL, the pinned aseprite-strings git commit, and the corresponding checksums/pkgrel. The sources remain HTTPS and pinned to specific release/tag/commit values, with no new build-time commands, scripts, or privilege-related artifacts introduced in this diff.

@@ -32,12 +32,12 @@ pkgbase = aseprite
 	depends = fontconfig
 	depends = libxcursor
 	depends = libxrandr
-	noextract = Aseprite-v1.3.17.2-Source.zip
+	noextract = Aseprite-v1.3.18.1-Source.zip
 	noextract = skia-m124.tar.gz
-	source = https://github.com/aseprite/aseprite/releases/download/v1.3.17.2/Aseprite-v1.3.17.2-Source.zip
+	source = https://github.com/aseprite/aseprite/releases/download/v1.3.18.1/Aseprite-v1.3.18.1-Source.zip
 	source = skia-m124.tar.gz::https://github.com/aseprite/skia/archive/refs/tags/m124-08a5439a6b.tar.gz
 	source = skia-m124-icu::git+https://chromium.googlesource.com/chromium/deps/icu.git#commit=a0718d4f121727e30b8d52c7a189ebf5ab52421f
-	source = aseprite-strings::git+https://github.com/aseprite/strings.git#commit=341376d40ed7ab4fb21eaa2331cf7fd8d9fb4f6d
+	source = aseprite-strings::git+https://github.com/aseprite/strings.git#commit=417074f649f359f98511fc87a707c276d87f5739
 	source = desktop.patch
 	source = shared-fmt.patch
 	source = shared-libarchive.patch

Comment

The change is a routine metadata refresh in .SRCINFO for a new upstream release: version bump, updated source URL, and corresponding checksum updates for the release zip and the aseprite-strings git source. All sources remain HTTPS and pinned to a specific commit/tag; there are no new scripts, binaries, install hooks, or build-time network behaviors introduced by this diff. I do note that .SRCINFO is only generated metadata, so the security-relevant question is whether the underlying PKGBUILD changed safely, but within the provided diff there are no red flags.

@@ -50,10 +50,10 @@ pkgbase = aseprite
 	source = shared_libjpeg-turbo.patch
 	source = change_use_of_removed_intrinsic.patch
 	source = fmt-12.2.0-include-format.patch
-	sha256sums = 3895afca60608e86ffbba20c32af95a6e59f8d7ebe6d2617236f159b42176bfe
+	sha256sums = 438e7a1571990383beca761eca829402f14f225e164730eb2edc71b2e9566e58
 	sha256sums = c2a567d6b8bb933a92615cbdee0de268d02c3a06863337ee8822eedab9ed66ba
 	sha256sums = b52f179a687ef2f91a52b696ab6581f4a37df5e88cb22040fa1ec6567cf0ebb1
-	sha256sums = e2021cabe800b033afb799bc24f51e4b09cfb4d76afca4cf44f1cc05fb88bdf8
+	sha256sums = 883d1b25014deded64c3baa8e680dc3e2e486ca7b9c9116015c3cc557c2af781
 	sha256sums = 8b14e36939e930de581e95abf0591645aa0fcfd47161cf88b062917dbaaef7f9
 	sha256sums = c3591d376180d99ff8001c3d549c0bd18ef5e4d95f1755ccaa8e2fd65dd5d2b3
 	sha256sums = 96d75ecc951712e80734f476511658fcc3c91fc1655fe9a01453c3fc8c2a9274

Comment

The change is a straightforward version bump of the upstream Aseprite release plus updated checksums and a pinned commit for the auxiliary strings dependency. I do not see any new red flags in the diff: sources remain HTTPS, the VCS dependency is still pinned to a specific commit, and there are no added build-time downloads, shell execution, privilege escalation, or packaging changes. The pkgrel reset is normal for a new upstream version. Overall this looks low risk.

@@ -10,10 +10,10 @@
 # Contributor: Jomar Milan <jomarm@jomarm.com>
 
 pkgname=aseprite
-pkgver=1.3.17.2
+pkgver=1.3.18.1
 _skiaver=m124
 _skiahash=08a5439a6b
-pkgrel=3
+pkgrel=1
 pkgdesc='Create animated sprites and pixel art'
 arch=('x86_64')
 url="https://www.aseprite.org/"

Comment

The change only updates the pinned upstream release tarball and the pinned aseprite-strings git submodule commit, along with matching checksums. The source URLs remain HTTPS and point to the official upstream repositories, and there is no new build-time network access, script execution, privilege escalation, or packaging behavior introduced by this diff. I did not find any suspicious install scripts, systemd units, or other artifacts in the reviewed hunk. Overall this looks like a routine upstream version bump with integrity metadata updates.

@@ -46,7 +46,7 @@ source=("https://github.com/aseprite/aseprite/releases/download/v$pkgver/Aseprit
         # forgive me, I couldn't figure out linker errors.
         # update commit with skia
         skia-$_skiaver-icu::git+https://chromium.googlesource.com/chromium/deps/icu.git#commit=a0718d4f121727e30b8d52c7a189ebf5ab52421f
-		aseprite-strings::git+https://github.com/aseprite/strings.git#commit=341376d40ed7ab4fb21eaa2331cf7fd8d9fb4f6d
+		aseprite-strings::git+https://github.com/aseprite/strings.git#commit=417074f649f359f98511fc87a707c276d87f5739
         desktop.patch
         shared-fmt.patch
         # Based on https://patch-diff.githubusercontent.com/raw/aseprite/aseprite/pull/2535.patch

Comment

The change is a routine version bump plus checksum updates and a pinned commit update for the vendored `aseprite-strings` git source. The source URLs remain HTTPS and pinned to specific commits, and there are no new build-time network fetches, scripts, privilege changes, or packaging behavior changes in the diff. I don’t see any security-relevant red flags in this hunk beyond the normal trust in upstream release artifacts and the updated dependency commit.

@@ -63,10 +63,10 @@ source=("https://github.com/aseprite/aseprite/releases/download/v$pkgver/Aseprit
         fmt-12.2.0-include-format.patch)
 noextract=("Aseprite-v$pkgver-Source.zip"
            "skia-$_skiaver.tar.gz") # Don't extract Aseprite or skia sources at the root
-sha256sums=('3895afca60608e86ffbba20c32af95a6e59f8d7ebe6d2617236f159b42176bfe'
+sha256sums=('438e7a1571990383beca761eca829402f14f225e164730eb2edc71b2e9566e58'
             'c2a567d6b8bb933a92615cbdee0de268d02c3a06863337ee8822eedab9ed66ba'
             'b52f179a687ef2f91a52b696ab6581f4a37df5e88cb22040fa1ec6567cf0ebb1'
-            'e2021cabe800b033afb799bc24f51e4b09cfb4d76afca4cf44f1cc05fb88bdf8'
+            '883d1b25014deded64c3baa8e680dc3e2e486ca7b9c9116015c3cc557c2af781'
             '8b14e36939e930de581e95abf0591645aa0fcfd47161cf88b062917dbaaef7f9'
             'c3591d376180d99ff8001c3d549c0bd18ef5e4d95f1755ccaa8e2fd65dd5d2b3'
             '96d75ecc951712e80734f476511658fcc3c91fc1655fe9a01453c3fc8c2a9274'