Review Results

Comment

The change is a routine version bump in .SRCINFO from 0.8.1 to 0.9.0, updating the upstream tarball URL and checksum to match. The package still sources code over HTTPS from the official GitHub repository, with no new build-time downloads, scripts, or packaging changes introduced by this diff. No integrity or persistence red flags are present in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = fvs2
 	pkgdesc = Standalone CLI for FVS v2
-	pkgver = 0.8.1
+	pkgver = 0.9.0
 	pkgrel = 1
 	url = https://github.com/fvs-lab/fvs2
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from fvs2 v0.8.1 to v0.9.0, with the corresponding checksum updated. The source remains an HTTPS GitHub release tarball from the official upstream repository, and no new build steps, scripts, or packaging metadata were introduced. Based on the provided diff alone, there are no obvious supply-chain or privilege-escalation concerns.

@@ -8,9 +8,9 @@ pkgbase = fvs2
 	license = MIT
 	makedepends = go
 	depends = glibc
-	source = fvs2-0.8.1.tar.gz::https://github.com/fvs-lab/fvs2/archive/refs/tags/v0.8.1.tar.gz
+	source = fvs2-0.9.0.tar.gz::https://github.com/fvs-lab/fvs2/archive/refs/tags/v0.9.0.tar.gz
 	source = core-0.1.1.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v0.1.1.tar.gz
-	sha256sums = adcc2e0e5130b4bb8c18ffdcc3c63522b36894d32dbae508d5c90dbeeabb1837
+	sha256sums = 74aa67ab731c7a25da4a7858cbebdd2a87f361568977b19653651bf2b1979815
 	sha256sums = 91b417276815752ab7608659b33d09d8d4b3e4d03303c2314685440808a52eb6
 
 pkgname = fvs2

Comment

The change is a straightforward version bump from 0.8.1 to 0.9.0 with an updated source checksum. The source remains the official GitHub release tarball over HTTPS, and there are no new build steps, scripts, patches, or packaging changes introduced in this diff. No integrity or privilege-escalation concerns are evident from the reviewed hunk alone.

@@ -3,7 +3,7 @@
 _corever=0.1.1
 
 pkgname=fvs2
-pkgver=0.8.1
+pkgver=0.9.0
 pkgrel=1
 pkgdesc='Standalone CLI for FVS v2'
 arch=('x86_64' 'aarch64')

Comment

The change only bumps the package version from 0.8.1 to 0.9.0 and updates the SHA256 for the upstream release tarball. The source URLs remain HTTPS GitHub tag archives, the secondary dependency tarball is unchanged, and there are no new build steps, network fetches, install-script changes, or privilege/persistence mechanisms in the reviewed hunk. Based on this diff alone, I don’t see a security issue.

@@ -15,7 +15,7 @@ source=(
   "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
   "core-${_corever}.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v${_corever}.tar.gz"
 )
-sha256sums=('adcc2e0e5130b4bb8c18ffdcc3c63522b36894d32dbae508d5c90dbeeabb1837'
+sha256sums=('74aa67ab731c7a25da4a7858cbebdd2a87f361568977b19653651bf2b1979815'
             '91b417276815752ab7608659b33d09d8d4b3e4d03303c2314685440808a52eb6')
 
 prepare() {