Review Results

Comment

Risk is low. The change only bumps the package version and updates the upstream source URL and checksum in .SRCINFO. The source remains HTTPS on the official i2p project domain, and there are no new build-time commands, scripts, permissions changes, or install-time persistence mechanisms introduced by this diff. No security red flags are evident from this metadata-only update.

@@ -1,6 +1,6 @@
 pkgbase = i2p
 	pkgdesc = A distributed anonymous network
-	pkgver = 2.12.0
+	pkgver = 2.13.0
 	pkgrel = 1
 	url = https://geti2p.net
 	install = i2p.install

Comment

The change only bumps the upstream source tarball and its detached signature from I2P 2.12.0 to 2.13.0 in .SRCINFO. The source remains on the official HTTPS upstream domain, and there are no new build-time commands, scripts, or integrity regressions introduced by this metadata-only update. No suspicious mirrors, VCS floating refs, or extra sources were added. Risk is therefore minimal.

@@ -14,8 +14,8 @@ pkgbase = i2p
 	conflicts = i2p-dev
 	options = !strip
 	backup = opt/i2p/wrapper.config
-	source = https://files.i2p-projekt.de/2.12.0/i2psource_2.12.0.tar.bz2
-	source = https://files.i2p-projekt.de/2.12.0/i2psource_2.12.0.tar.bz2.sig
+	source = https://files.i2p-projekt.de/2.13.0/i2psource_2.13.0.tar.bz2
+	source = https://files.i2p-projekt.de/2.13.0/i2psource_2.13.0.tar.bz2.sig
 	source = i2prouter.service
 	source = i2p.tmpfiles
 	source = wrapper.config

Comment

The change is a straightforward version bump in .SRCINFO from i2p 2.12.0 to 2.13.0, updating the upstream tarball URLs and the corresponding source checksum. The sources remain HTTPS on the official i2p domain, and there are no new scripts, binaries, install hooks, or build-time execution changes introduced by this diff. Based on the diff alone, this does not add an obvious security risk.

@@ -25,7 +25,7 @@ pkgbase = i2p
 	source = chromium-i2p.sh
 	validpgpkeys = 2D3D2D03910C6504C1210C65EE60C0C8EE7256A8
 	validpgpkeys = 70D2060738BEF80523ACAFF7D75C03B39B5E14E1
-	sha256sums = e632ea1b8a9ccc4a1196e7615047ed16e3228a0a1791a0a90362533eeef89192
+	sha256sums = 4ea60401855d2dc3a0058b472829c9060291907bfe48c173c57dde6e7f5eb6ad
 	sha256sums = SKIP
 	sha256sums = 644b771ec7f5db3efab3206bf1f896566cdb00d410a54608fda85bdb4c2ad876
 	sha256sums = fc30dd32f48fe1c93bf36c8297ca48203a1479e4e221ebe62c57cf3c3c0347d3

Comment

The change is a simple version bump in PKGBUILD from 2.12.0 to 2.13.0 with no accompanying changes to sources, build steps, install scripts, or package metadata. Based on the provided diff hunk alone, there are no new security red flags such as added network fetches, scripts, privilege changes, or integrity regressions. Risk is minimal.

@@ -5,7 +5,7 @@
 #export LG2=en
 
 pkgname=i2p
-pkgver=2.12.0
+pkgver=2.13.0
 pkgrel=1
 pkgdesc="A distributed anonymous network"
 url="https://geti2p.net"

Comment

Risk score 0. The change only bumps pkgver from 2.12.0 to 2.13.0 and updates the corresponding source tarball checksum in PKGBUILD. The source remains the official HTTPS upstream release URL, there are no new build-time downloads, scripts, patches, privilege changes, or packaging behavior changes in this diff. This is a routine version/hash refresh with no evident security impact.

@@ -35,7 +35,7 @@ source=("${_url}/i2psource_${pkgver}.tar.bz2"{,.sig}
         #upstream.patch::'https://github.com/i2p/i2p.i2p/commit/6c0e18d3.patch'
 )
 
-sha256sums=('e632ea1b8a9ccc4a1196e7615047ed16e3228a0a1791a0a90362533eeef89192'
+sha256sums=('4ea60401855d2dc3a0058b472829c9060291907bfe48c173c57dde6e7f5eb6ad'
             'SKIP'
             '644b771ec7f5db3efab3206bf1f896566cdb00d410a54608fda85bdb4c2ad876'
             'fc30dd32f48fe1c93bf36c8297ca48203a1479e4e221ebe62c57cf3c3c0347d3'