Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.92.144 to 1.93.129. No source URLs, checksums, build commands, install scripts, permissions, or package metadata affecting trust boundaries changed in the provided diff. On its face this is a routine upstream version update with no security red flags visible in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.92.144
+	pkgver = 1.93.129
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a straightforward version bump in .SRCINFO for the Brave binary package: updated provided version, noextract filenames, and upstream GitHub release URLs/checksums for x86_64 and aarch64. The sources remain HTTPS and point to the official Brave release repository, with pinned release artifacts and matching checksums. No new build-time code, install-script behavior, privilege escalation, or persistence mechanism is introduced by this metadata-only update.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.92.144
+	provides = brave=1.93.129
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.92.144-x86_64.zip
-	noextract = brave-bin-1.92.144-aarch64.zip
+	noextract = brave-bin-1.93.129-x86_64.zip
+	noextract = brave-bin-1.93.129-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.92.144-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.144/brave-browser-1.92.144-linux-amd64.zip
-	sha256sums_x86_64 = 67854d08fb57d45620341ebb4df4c9164cbd3fe5cd2c696f2b0ac8d16a3945a2
-	source_aarch64 = brave-bin-1.92.144-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.144/brave-browser-1.92.144-linux-arm64.zip
-	sha256sums_aarch64 = 18315a79caff2a86f7928445804cb9cb3a2c8d10e0d24c3382de7e0391ce6145
+	source_x86_64 = brave-bin-1.93.129-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.93.129/brave-browser-1.93.129-linux-amd64.zip
+	sha256sums_x86_64 = 5a0ef0629ca7f574d5e105071bd77f2e12c1cf0a9c100ab5b6967b915287a525
+	source_aarch64 = brave-bin-1.93.129-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.93.129/brave-browser-1.93.129-linux-arm64.zip
+	sha256sums_aarch64 = b03616b31662f6d2f7863d397834a5c865096cd62a8035fab56104ae49c26fbd
 
 pkgname = brave-bin

Comment

The change only bumps pkgver from 1.92.144 to 1.93.129 in PKGBUILD. No build logic, sources, checksums, install scripts, or packaging behavior changed, so there is no new security-relevant behavior to assess in this diff. Risk is effectively unchanged.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.92.144
+pkgver=1.93.129
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

The change is a routine version bump for a binary package, with only updated SHA-256 checksums for the upstream Brave release archives. The source URLs remain HTTPS and point to the official Brave GitHub release assets, and there are no new build steps, scripts, or privilege-related changes in the diff. I do not see any supply-chain red flags in this hunk beyond the inherent trust in the upstream binary release.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('67854d08fb57d45620341ebb4df4c9164cbd3fe5cd2c696f2b0ac8d16a3945a2')
-sha256sums_aarch64=('18315a79caff2a86f7928445804cb9cb3a2c8d10e0d24c3382de7e0391ce6145')
+sha256sums_x86_64=('5a0ef0629ca7f574d5e105071bd77f2e12c1cf0a9c100ab5b6967b915287a525')
+sha256sums_aarch64=('b03616b31662f6d2f7863d397834a5c865096cd62a8035fab56104ae49c26fbd')
 
 prepare() {
 	mkdir -p brave