Review Results

Comment

The change is limited to bumping the package version in .SRCINFO from 2026.2 to 2026.2.0.1. No sources, checksums, build steps, install scripts, permissions, or systemd-related artifacts are modified. On its face this is a metadata-only version update with no security-relevant behavior change in the reviewed diff.

@@ -1,6 +1,6 @@
 pkgbase = rider
 	pkgdesc = A cross-platform .NET IDE by JetBrains.
-	pkgver = 2026.2
+	pkgver = 2026.2.0.1
 	pkgrel = 1
 	epoch = 1
 	url = https://www.jetbrains.com/rider/

Comment

The change only updates the upstream JetBrains Rider tarball URLs and their corresponding SHA-256 checksums in .SRCINFO, moving from 2026.2 to 2026.2.0.1 for x86_64 and aarch64. The sources remain HTTPS on the official JetBrains download domain, and the integrity hashes are pinned. No build logic, install scripts, permissions, or persistence-related artifacts are changed. This appears to be a routine version bump with no security red flags in the diff provided.

@@ -15,9 +15,9 @@ pkgbase = rider
 	options = staticlibs
 	source = jetbrains-rider.desktop
 	sha256sums = 4d5438fd52380ccd09deef98cb82707f296ebb27a3faed2fceb1b68eba335ec8
-	source_x86_64 = https://download-cf.jetbrains.com/rider/JetBrains.Rider-2026.2.tar.gz
-	sha256sums_x86_64 = eebbc49e29852496cbc7f6399eb47b56e8a95fc921c4dae7c05cca6b2f6d22a7
-	source_aarch64 = https://download-cf.jetbrains.com/rider/JetBrains.Rider-2026.2-aarch64.tar.gz
-	sha256sums_aarch64 = 7ef76057543c80b81807f8a1ae9ba4256f43a8bba9678e4918a69deefa2f008a
+	source_x86_64 = https://download-cf.jetbrains.com/rider/JetBrains.Rider-2026.2.0.1.tar.gz
+	sha256sums_x86_64 = 7e973d689b9f3b6422c3b772af5b8eb0c1ecbc1aee16e5f80f4298d5eae99b0a
+	source_aarch64 = https://download-cf.jetbrains.com/rider/JetBrains.Rider-2026.2.0.1-aarch64.tar.gz
+	sha256sums_aarch64 = 32e2b576f8b77e73dd4b21133de1245b893b84d14f90762d68a8e9fc86737485
 
 pkgname = rider

Comment

The change only bumps pkgver and updates the expected SHA-256 checksums for the JetBrains Rider release tarballs on the official HTTPS download host. No build logic, install scripts, permissions, or additional sources were introduced, and there are no new execution or persistence vectors in the diff. This appears to be a routine upstream version refresh with integrity metadata updates only.

@@ -1,7 +1,7 @@
 # Maintainer: Tim Hellhake
 
 pkgname=rider
-pkgver='2026.2'
+pkgver='2026.2.0.1'
 pkgrel=1
 epoch=1
 pkgdesc='A cross-platform .NET IDE by JetBrains.'

Comment

The change only updates the pinned SHA-256 checksums for the upstream JetBrains Rider tarballs on x86_64 and aarch64, alongside the package version bump. The download URLs remain HTTPS and still point to the official JetBrains CDN, with no new build-time execution, install-script logic, or packaging behavior changes. I do not see any added supply-chain or persistence risk in this diff; the main effect is to accept new upstream release artifacts.

@@ -18,9 +18,9 @@ _srcfile="JetBrains.Rider-${pkgver}"
 source=('jetbrains-rider.desktop')
 sha256sums=('4d5438fd52380ccd09deef98cb82707f296ebb27a3faed2fceb1b68eba335ec8')
 source_x86_64=("https://download-cf.jetbrains.com/rider/${_srcfile}.tar.gz")
-sha256sums_x86_64=('eebbc49e29852496cbc7f6399eb47b56e8a95fc921c4dae7c05cca6b2f6d22a7')
+sha256sums_x86_64=('7e973d689b9f3b6422c3b772af5b8eb0c1ecbc1aee16e5f80f4298d5eae99b0a')
 source_aarch64=("https://download-cf.jetbrains.com/rider/${_srcfile}-aarch64.tar.gz")
-sha256sums_aarch64=('7ef76057543c80b81807f8a1ae9ba4256f43a8bba9678e4918a69deefa2f008a')
+sha256sums_aarch64=('32e2b576f8b77e73dd4b21133de1245b893b84d14f90762d68a8e9fc86737485')
 
 package() {
     install_base="/opt"