Review Results

Version #1878 of megasync · commit 98765488372f · status Reviewed

Risk 1/5 · Low .SRCINFO

Result #830

Comment

The change is limited to bumping the package version and updating the upstream source tag/checksum in .SRCINFO. The source remains an HTTPS GitHub URL, but the tag changes from a Linux-specific release tag to an OSX-tagged release tag (`v6.5.0.2_OSX`), which is unusual for an Arch Linux package and merits manual verification against the PKGBUILD/upstream release. However, within this diff alone there is no direct evidence of malicious behavior, build-time code execution, or integrity bypass beyond the normal source update metadata. Risk is low but not zero due to the suspicious tag naming mismatch.

@@ -1,6 +1,6 @@
 pkgbase = megasync
 	pkgdesc = Official MEGA desktop application for syncing with MEGA Cloud Drive
-	pkgver = 6.4.0.2
+	pkgver = 6.5.0.2
 	pkgrel = 1
 	url = https://github.com/meganz/MEGAsync/
 	arch = x86_64

Risk 0/5 · Safe .SRCINFO

Result #831

Comment

The change only updates .SRCINFO metadata to track a new upstream MEGAsync tag and corresponding checksum. The source remains an HTTPS GitHub URL pinned to a specific tag, with no new build-time fetches, scripts, or packaging logic introduced in this diff. The only notable concern is that the tag name changes from a Linux-specific release to an OSX-suffixed tag, which is worth verifying against upstream, but by itself this metadata-only update does not present a clear security issue.

@@ -30,12 +30,12 @@ pkgbase = megasync
 	depends = qt5-x11extras
 	depends = sqlite
 	depends = zlib
-	source = git+https://github.com/meganz/MEGAsync.git#tag=v6.4.0.2_Linux
+	source = git+https://github.com/meganz/MEGAsync.git#tag=v6.5.0.2_OSX
 	source = meganz-sdk::git+https://github.com/meganz/sdk.git
 	source = 010-megasync-sdk-fix-cmake-dependencies-detection.patch
 	source = 020-megasync-app-fix-cmake-dependencies-detection.patch
 	source = 030-megasync-app-disable-isolated-gfx-for-disabling-freeimage-in-sdk.patch
-	sha256sums = e36708b696a4acb602f131a03b4af3a40998f9b021bf7d1ae0d2392533bb4e28
+	sha256sums = d8d97e125299fb9c061aa33cbbca050f49915925662ed40bb449be2cc57446b0
 	sha256sums = SKIP
 	sha256sums = 5219537875385e9399b1a76a5775722053880cdfc0c33b5726504e020e11ad70
 	sha256sums = a5883be2d00dbacaacf78231bfeeac27f4e8a471c3256370e94fec3e55b1d171

Risk 0/5 · Safe PKGBUILD

Result #832

Comment

The change only bumps pkgver from 6.4.0.2 to 6.5.0.2 in PKGBUILD. No source URLs, build commands, install scripts, permissions, or packaging logic were altered in the reviewed hunk, so there is no new security concern visible from this diff alone. Risk is minimal.

@@ -7,7 +7,7 @@
 # Contributor: Hexchain Tong <i at hexchain dot org>
 
 pkgname=megasync
-pkgver=6.4.0.2
+pkgver=6.5.0.2
 pkgrel=1
 pkgdesc='Official MEGA desktop application for syncing with MEGA Cloud Drive'
 arch=('x86_64')

Risk 1/5 · Low PKGBUILD

Result #833

Comment

The change is low risk. It only retargets the upstream git source from the Linux tag to the OSX tag for the same version and updates the corresponding checksum. There are no new build-time downloads, scripts, privilege changes, or packaging logic changes. The main concern is supply-chain integrity: switching to a different upstream tag could change the source contents substantially, but it is still fetched over HTTPS from the official repository and pinned to a tag, so there is no obvious malicious behavior in the diff itself.

@@ -40,12 +40,12 @@ makedepends=(
     'cmake'
     'git'
     'qt5-tools')
-source=("git+https://github.com/meganz/MEGAsync.git#tag=v${pkgver}_Linux"
+source=("git+https://github.com/meganz/MEGAsync.git#tag=v${pkgver}_OSX"
         'meganz-sdk'::'git+https://github.com/meganz/sdk.git'
         '010-megasync-sdk-fix-cmake-dependencies-detection.patch'
         '020-megasync-app-fix-cmake-dependencies-detection.patch'
         '030-megasync-app-disable-isolated-gfx-for-disabling-freeimage-in-sdk.patch')
-sha256sums=('e36708b696a4acb602f131a03b4af3a40998f9b021bf7d1ae0d2392533bb4e28'
+sha256sums=('d8d97e125299fb9c061aa33cbbca050f49915925662ed40bb449be2cc57446b0'
             'SKIP'
             '5219537875385e9399b1a76a5775722053880cdfc0c33b5726504e020e11ad70'
             'a5883be2d00dbacaacf78231bfeeac27f4e8a471c3256370e94fec3e55b1d171'