Review Results

Comment

The change only updates pinned VCS commit hashes and their corresponding checksums in .SRCINFO. Both sources remain HTTPS GitHub URLs, and the package still uses fixed commits rather than floating branches. No new sources, scripts, install hooks, or packaging behavior are introduced by this diff. The removal of the patch source from .SRCINFO is consistent with the updated source list and does not by itself indicate a security issue in this metadata-only change.

@@ -24,11 +24,9 @@ pkgbase = foldingathome
 	depends = zlib
 	optdepends = opencl-driver: GPU support
 	backup = etc/fah-client/config.xml
-	source = git+https://github.com/cauldrondevelopmentllc/cbang#commit=83a4be55c1b21d5383650f51a7887fd9c25b836c
-	source = git+https://github.com/foldingathome/fah-client-bastet#commit=2c6fbaa45e4ee4854195a9f0d4b86300975b6543
-	source = as_string_fix.patch
-	sha256sums = cc7768e72599e8e7285e981702fb96fbb0fcad22660722dbc425c16677e0ddf0
-	sha256sums = 2415b1ca05c1dc34bfbe01b6d8566bb5106c0f59d2382addeba05ff75ee4df99
-	sha256sums = 21ce7c732dc289e6eda5f4236d1f613c93228c49ce9aef0c2eb1d9d31ce1fc38
+	source = git+https://github.com/cauldrondevelopmentllc/cbang#commit=20224041bbf5e5f1ed6a3e4cd1a9e10dd08b1f1d
+	source = git+https://github.com/foldingathome/fah-client-bastet#commit=93b96817a82ade9769fba3571ac697788f13357a
+	sha256sums = 7f683cdf6e7b4710ddb00d3a8709b2e548ff71e85df98ad9ec1e4105914cefcf
+	sha256sums = 2c8f9cfaea57b268c5576cb08f539a5d3ef1daaddff6bd2786b9e8aba243e6cd
 
 pkgname = foldingathome

Comment

The change is a straightforward version/source bump in PKGBUILD: it updates pkgver and pins both git sources to new upstream commits with matching checksums, while removing an old patch/prepare step. I did not see any new build-time downloads, shell execution, privilege escalation, or packaging changes that would introduce a security concern. The only notable effect is that the package now tracks newer upstream revisions, but the sources remain HTTPS GitHub commits and the package still builds and installs in the normal way.

@@ -4,7 +4,7 @@
 # Contributor: paul2lv <paul2lv@gmail.com>
 # Contributor: dtw <dibblethewrecker@gmail.com>
 pkgname=foldingathome
-pkgver=8.5.5
+pkgver=8.5.6
 pkgrel=1
 epoch=1
 pkgdesc='A distributed computing project for simulating protein dynamics'

Comment

The change is a routine upstream version bump that updates two pinned git sources to new commits and removes a local patch/prepare step. The sources remain HTTPS and pinned to specific commits, with updated checksums, so there is no obvious supply-chain or integrity regression in the PKGBUILD itself. I did note that the package ships a systemd service and polkit rule, but those were already present in the unchanged packaging logic and are not introduced by this diff. No new network fetches, privilege escalation, or suspicious install-time actions were added in the reviewed hunk.

@@ -29,17 +29,10 @@ makedepends=('git'
              'snappy')
 backup=("etc/fah-client/config.xml")
 install="fah.install"
-source=("git+https://github.com/cauldrondevelopmentllc/cbang#commit=83a4be55c1b21d5383650f51a7887fd9c25b836c"
-        "git+https://github.com/foldingathome/fah-client-bastet#commit=2c6fbaa45e4ee4854195a9f0d4b86300975b6543"
-        "as_string_fix.patch")
-sha256sums=('cc7768e72599e8e7285e981702fb96fbb0fcad22660722dbc425c16677e0ddf0'
-            '2415b1ca05c1dc34bfbe01b6d8566bb5106c0f59d2382addeba05ff75ee4df99'
-            '21ce7c732dc289e6eda5f4236d1f613c93228c49ce9aef0c2eb1d9d31ce1fc38')
-
-prepare() {
-	cd cbang
-	patch -p1 -i ../as_string_fix.patch
-}
+source=("git+https://github.com/cauldrondevelopmentllc/cbang#commit=20224041bbf5e5f1ed6a3e4cd1a9e10dd08b1f1d"
+        "git+https://github.com/foldingathome/fah-client-bastet#commit=93b96817a82ade9769fba3571ac697788f13357a")
+sha256sums=('7f683cdf6e7b4710ddb00d3a8709b2e548ff71e85df98ad9ec1e4105914cefcf'
+            '2c8f9cfaea57b268c5576cb08f539a5d3ef1daaddff6bd2786b9e8aba243e6cd')
 
 build() {
 	export CBANG_HOME=$PWD/cbang

Comment

This change is a benign informational update in the .install script: it only changes the printed web interface URL from v8-4 to v8-5. There is no added code execution, network access, privilege escalation, persistence, or packaging behavior change. The rest of the install script context appears unchanged, and this diff does not affect runtime package contents.

@@ -48,7 +48,7 @@ post_install() {
 	echo "  systemctl restart $NAME"
 	echo
 	echo "Access the web interface by going to"
-	echo " https://v8-4.foldingathome.org/"
+	echo " https://v8-5.foldingathome.org/"
 	echo
 	echo "If upgrading from v7 move /etc/fahclient/config.xml to $CLIENT_CONFIG to retain settings"
 	echo