Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 26.2.0 to 26.3.0, with the source URL and SHA256 updated to the corresponding upstream CodeWeavers .deb. No new sources, scripts, build steps, permissions changes, or packaging metadata red flags are introduced by this diff. Based on the provided hunk alone, this appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = crossover
 	pkgdesc = Run Windows Programs on Linux
-	pkgver = 26.2.0
+	pkgver = 26.3.0
 	pkgrel = 1
 	url = https://www.codeweavers.com/crossover
 	install = crossover.install

Comment

The change is a straightforward version bump in .SRCINFO for the package source from CodeWeavers' HTTPS-hosted official download to a newer release, with the corresponding SHA-256 checksum updated. There are no new sources, no build-script changes, no added execution paths, and no integrity red flags in the diff itself. Based on the provided hunk alone, this appears low risk.

@@ -14,8 +14,8 @@ pkgbase = crossover
 	depends = vte3
 	depends = python-cairo
 	optdepends = unzip: required to install Guild Wars, automatic installer extraction
-	source = https://media.codeweavers.com/pub/crossover/cxlinux/demo/crossover_26.2.0-1.deb
-	sha256sums = b33bafd2ff142398a55974da20416f7a81d69b200ee1378e3f55eea9cf5b9bcb
+	source = https://media.codeweavers.com/pub/crossover/cxlinux/demo/crossover_26.3.0-1.deb
+	sha256sums = 34e2521d8cf0af0128844e1c3cfd498e9bced711d85ef7164142127c376b4282
 	depends_i686 = glibc>=2.11
 	depends_i686 = libice
 	depends_i686 = libsm

Comment

The change is a trivial version bump in PKGBUILD from 26.2.0 to 26.3.0 with no modifications to sources, checksums, build steps, install scripts, permissions, or package metadata beyond pkgver. Based on the provided diff alone, there are no new security red flags introduced by this change.

@@ -5,7 +5,7 @@
 # Contributor: Philipp 'TamCore' B. <philipp [at] tamcore [dot] eu>
 
 pkgname=crossover
-pkgver=26.2.0
+pkgver=26.3.0
 pkgrel=1
 _pkgdebrel=1
 pkgdesc="Run Windows Programs on Linux"

Comment

The change only updates the SHA-256 checksum for the existing upstream .deb source URL. The source remains HTTPS and points to the same CodeWeavers download location; there are no new build steps, scripts, patches, or packaging changes. This is a low-risk integrity metadata update, likely reflecting an upstream file refresh or repackaging. No obvious supply-chain or privilege-escalation concerns are introduced by this diff alone.

@@ -16,7 +16,7 @@ makedepends=('tar')
 install=${pkgname}.install
 
 source=("https://media.codeweavers.com/pub/${pkgname}/cxlinux/demo/${pkgname}_${pkgver}-${_pkgdebrel}.deb")
-sha256sums=('b33bafd2ff142398a55974da20416f7a81d69b200ee1378e3f55eea9cf5b9bcb')
+sha256sums=('34e2521d8cf0af0128844e1c3cfd498e9bced711d85ef7164142127c376b4282')
 
 depends=( 
     'python' 'desktop-file-utils' 'python-gobject' 'vte3' 'python-cairo'