Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 12.20.2 to 12.20.4. No source URLs, checksums, build steps, permissions, install scripts, or other packaging metadata changed in the reviewed hunk. Based on this diff alone there are no new security red flags or integrity concerns to flag.

@@ -1,6 +1,6 @@
 pkgbase = postman-bin
 	pkgdesc = Build, test, and document your APIs faster
-	pkgver = 12.20.2
+	pkgver = 12.20.4
 	pkgrel = 1
 	url = https://www.getpostman.com
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from Postman 12.20.2 to 12.20.4 for both x86_64 and aarch64, with matching updated SHA-256 checksums. The source URLs remain HTTPS and point to the same official Postman download host, and there are no new build-time commands, scripts, or packaging changes introduced in this diff. Based on the provided hunk alone, this does not add any obvious supply-chain or persistence risk.

@@ -38,9 +38,9 @@ pkgbase = postman-bin
 	options = !strip
 	source = postman.desktop
 	sha256sums = d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d
-	source_x86_64 = postman-12.20.2-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.20.2/linux64
-	sha256sums_x86_64 = 9c20fef2b96ea0da3ce909d6f1c88dc6d6c93a1d704cdefd26e665b428c2c04f
-	source_aarch64 = postman-12.20.2-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.20.2/linux_arm64
-	sha256sums_aarch64 = d14d11a469474a5bb49f623861d8e979705779bcc92f3e3f96fc95c42922f9e2
+	source_x86_64 = postman-12.20.4-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.20.4/linux64
+	sha256sums_x86_64 = afc50d68d4ed77595a0710611049cd066fdb2b1e8fb9735120643ce9fc36cf1c
+	source_aarch64 = postman-12.20.4-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.20.4/linux_arm64
+	sha256sums_aarch64 = a5b44890e7c61347cafd6bd75548fc2fa051541e710accde36cdbcb0ac387648
 
 pkgname = postman-bin

Comment

The change is a straightforward version bump in PKGBUILD from 12.20.2 to 12.20.4 with updated SHA-256 checksums for the official Postman download URLs. The sources remain HTTPS and point to the vendor’s download host, there are no new build steps, scripts, patches, or packaging changes, and no additional integrity or privilege-related red flags are introduced by this diff. Risk is therefore minimal.

@@ -4,7 +4,7 @@
 # Contributor: Juan Francisco Miranda <jfmiranda at gmail dot com>
 
 pkgname=postman-bin
-pkgver=12.20.2
+pkgver=12.20.4
 pkgrel=1
 pkgdesc="Build, test, and document your APIs faster"
 provides=('postman')

Comment

The change is a straightforward version bump in PKGBUILD from Postman 12.20.2 to 12.20.4, with corresponding SHA-256 updates for the official HTTPS downloads from dl.pstmn.io. There are no new sources, no build-time network fetches beyond the declared upstream tarballs, and no changes to install scripts, permissions, or package logic. Based on the diff provided, this appears low risk and consistent with a normal upstream release update.

@@ -20,8 +20,8 @@ source_x86_64=("postman-${pkgver}-linux-${arch[0]}.tar.gz::https://dl.pstmn.io/d
 source_aarch64=("postman-${pkgver}-linux-${arch[1]}.tar.gz::https://dl.pstmn.io/download/version/${pkgver}/linux_arm64")
 
 sha256sums=('d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d')
-sha256sums_x86_64=('9c20fef2b96ea0da3ce909d6f1c88dc6d6c93a1d704cdefd26e665b428c2c04f')
-sha256sums_aarch64=('d14d11a469474a5bb49f623861d8e979705779bcc92f3e3f96fc95c42922f9e2')
+sha256sums_x86_64=('afc50d68d4ed77595a0710611049cd066fdb2b1e8fb9735120643ce9fc36cf1c')
+sha256sums_aarch64=('a5b44890e7c61347cafd6bd75548fc2fa051541e710accde36cdbcb0ac387648')
 
 package() {
   install -dm755 "${pkgdir}/opt/"