Review Results

Comment

The change is a routine version bump in .SRCINFO: it updates pkgver/pkgrel and replaces the upstream .deb URLs and their SHA-512 checksums for all architectures. The source remains HTTPS on the official qqdl.gtimg.cn host, and there are no new build steps, scripts, permissions changes, or packaging logic introduced by this diff. I do note the package continues to fetch prebuilt upstream binaries, but that was already the case and this change does not worsen the trust model or add new red flags.

@@ -1,7 +1,7 @@
 pkgbase = linuxqq
 	pkgdesc = New Linux QQ based on Electron
-	pkgver = 3.2.32_51728
-	pkgrel = 2
+	pkgver = 3.2.32_51802
+	pkgrel = 1
 	epoch = 5
 	url = https://im.qq.com/linuxqq
 	arch = x86_64

Comment

The change only updates the prebuilt .deb source URLs and their checksums in .SRCINFO for linuxqq. The URLs remain HTTPS and point to the same upstream qqdl.gtimg.cn host, with no new build-time code execution, install-script changes, or packaging logic changes. This is a routine version bump of vendor binaries; the main trust concern is inherent to shipping a prebuilt upstream .deb, but this diff does not introduce additional risk beyond that baseline.

@@ -21,11 +21,11 @@ pkgbase = linuxqq
 	options = !debug
 	source = linuxqq.sh
 	sha512sums = bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7
-	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/a1bdd796/linuxqq_3.2.32-51728_amd64.deb
-	sha512sums_x86_64 = 3cb4f8f881f1f593e4fc06f1ba7eba3b324113e7feb103c982e085db49efd5a9a6e2c4ee012eac0347e29565b0cf094d9ff74f112a61dc8bb6d198d5585fdbd7
-	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/a1bdd796/linuxqq_3.2.32-51728_arm64.deb
-	sha512sums_aarch64 = aca411dec0a8a82d0213de5217be5c1fa0097f2a96b88dc54ceca4baf7731e9243e88c27631793f12c96b75ad15d0005a1f3d1673fbce0143188c3ce9026a25a
-	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/a1bdd796/linuxqq_3.2.32-51728_loongarch64.deb
-	sha512sums_loong64 = 184e54b1899375a9fda3eacee0f671b4e94aad63d8e3205e0e4a31b872129ed20d4fd4df69e142637f77ab2ae49b3292959d426cb0b5cc1d1ccbea2806251633
+	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/c97651b2/linuxqq_3.2.32-51802_amd64.deb
+	sha512sums_x86_64 = 5a397574b333671f65395e4dcbe4fa829a0cb1a3e94569daeac15582c1f17d8e1ecbfea271b66a3c303ed73228eec12dc3f9962f51826b924896c31b05c08e9e
+	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/c97651b2/linuxqq_3.2.32-51802_arm64.deb
+	sha512sums_aarch64 = 7c9b201afeef11846e4a7b10332d6a81c786b8c28957d102ebdd1d20d998c83b72e15348832ca97ec10bd183e0881ab9911ec8122f9bdc4ca98a61316e44d512
+	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/c97651b2/linuxqq_3.2.32-51802_loongarch64.deb
+	sha512sums_loong64 = aac5bb9e53554db5c95bbb2541cfda0841633e996798088756d2a16d3c8e480288fb6d8c52eecd154b1d119ddf2f1da59e58e90c9dd40a74e40518ba815f386a
 
 pkgname = linuxqq

Comment

The change is a routine upstream version bump: pkgver/pkgrel and the per-architecture source checksums/md5 prefix are updated to match a new QQ release. The package still downloads the vendor .deb over HTTPS from the same upstream host, with no new build-time code execution, no new install script, and no packaging logic changes. I do note the package continues to ship a prebuilt binary blob from upstream, but that was already the case and is not introduced by this diff. No additional security regression is evident in the provided hunk.

@@ -2,8 +2,8 @@
 # Contributor: Integral <integral@member.fsf.org>
 
 pkgname=linuxqq
-pkgver=3.2.32_51728
-pkgrel=2
+pkgver=3.2.32_51802
+pkgrel=1
 epoch=5
 pkgdesc="New Linux QQ based on Electron"
 arch=('x86_64' 'aarch64' 'loong64')

Comment

The change is limited to bumping the packaged QQ version and updating the per-architecture download prefix and SHA-512 checksums. I do not see any new build-time code execution, install-script changes, privilege escalation, or suspicious extra sources. The package still downloads a prebuilt upstream .deb over HTTPS from qqdl.gtimg.cn, which is consistent with the existing packaging model, and the new hashes pin the new artifacts. No additional red flags are introduced by this diff alone.

@@ -12,16 +12,16 @@ license=('LicenseRef-QQ')
 conflicts=("${pkgname}-nt-bwrap")
 depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
 optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
-_md5_prefix=a1bdd796
+_md5_prefix=c97651b2
 _src_prefix="${pkgname}_${pkgver/_/-}"
 source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
 source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
 source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
 source=("${pkgname}.sh")
 sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
-sha512sums_x86_64=('3cb4f8f881f1f593e4fc06f1ba7eba3b324113e7feb103c982e085db49efd5a9a6e2c4ee012eac0347e29565b0cf094d9ff74f112a61dc8bb6d198d5585fdbd7')
-sha512sums_aarch64=('aca411dec0a8a82d0213de5217be5c1fa0097f2a96b88dc54ceca4baf7731e9243e88c27631793f12c96b75ad15d0005a1f3d1673fbce0143188c3ce9026a25a')
-sha512sums_loong64=('184e54b1899375a9fda3eacee0f671b4e94aad63d8e3205e0e4a31b872129ed20d4fd4df69e142637f77ab2ae49b3292959d426cb0b5cc1d1ccbea2806251633')
+sha512sums_x86_64=('5a397574b333671f65395e4dcbe4fa829a0cb1a3e94569daeac15582c1f17d8e1ecbfea271b66a3c303ed73228eec12dc3f9962f51826b924896c31b05c08e9e')
+sha512sums_aarch64=('7c9b201afeef11846e4a7b10332d6a81c786b8c28957d102ebdd1d20d998c83b72e15348832ca97ec10bd183e0881ab9911ec8122f9bdc4ca98a61316e44d512')
+sha512sums_loong64=('aac5bb9e53554db5c95bbb2541cfda0841633e996798088756d2a16d3c8e480288fb6d8c52eecd154b1d119ddf2f1da59e58e90c9dd40a74e40518ba815f386a')
 options=('!strip' '!debug')
 
 package() {