Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.43.3.10828 to 1.43.3.10861. No source URLs, checksums, build logic, install scripts, or packaging metadata beyond the version number are altered in the reviewed hunk. On its face this is a routine version update with no security-relevant indicators.

@@ -1,6 +1,6 @@
 pkgbase = plex-media-server
 	pkgdesc = The back-end media server component of Plex.
-	pkgver = 1.43.3.10828
+	pkgver = 1.43.3.10861
 	pkgrel = 1
 	url = https://plex.tv/
 	install = plex-media-server.install

Comment

The change only updates .SRCINFO to point at a newer Plex upstream release and refreshes the corresponding checksums. The source URLs remain HTTPS and still reference the official downloads.plex.tv host, with no new build-time code, scripts, or packaging logic introduced in this diff. I do not see any integrity red flags beyond the normal trust in upstream binary releases already present in this package.

@@ -26,13 +26,13 @@ pkgbase = plex-media-server
 	sha256sums = c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557
 	sha256sums = b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad
 	sha256sums = dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631
-	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10828-00f62d37d/redhat/plexmediaserver-1.43.3.10828-00f62d37d.x86_64.rpm
-	sha256sums_x86_64 = 2ff1d3e1ac1052cfadfcaa932c17f6fa775e625859aa93224c85983f00052183
-	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10828-00f62d37d/redhat/plexmediaserver-1.43.3.10828-00f62d37d.i686.rpm
-	sha256sums_i686 = 6ec375fe8d4de3bd5f3734865b6aa4245a791d7029a1216362f0625c5354cf1f
-	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.3.10828-00f62d37d/debian/plexmediaserver_1.43.3.10828-00f62d37d_armhf.deb
-	sha256sums_armv7h = a24a65361bb28ebeecadf82d4c02d023ee9b3a34ee2baa0635bfc51e1d01b1be
-	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10828-00f62d37d/debian/plexmediaserver_1.43.3.10828-00f62d37d_arm64.deb
-	sha256sums_aarch64 = f08c0ae850e331fa8204e9aa88226598d8da9181ae91f97fe01f76964ba962a0
+	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10861-07dfddaeb/redhat/plexmediaserver-1.43.3.10861-07dfddaeb.x86_64.rpm
+	sha256sums_x86_64 = 2c1ff73ffd2ab8c8523fb5d37394c3cccffe0e8bd662b8a78749a7385874fb6b
+	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10861-07dfddaeb/redhat/plexmediaserver-1.43.3.10861-07dfddaeb.i686.rpm
+	sha256sums_i686 = 2d22d0061aefa7c9662fb86f6fcc19f02e6e2478f5b0fadc2dad24c4bd9d371c
+	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.3.10861-07dfddaeb/debian/plexmediaserver_1.43.3.10861-07dfddaeb_armhf.deb
+	sha256sums_armv7h = f22851c1611d03df736fd0cd9af0bc15f53c8767fd1ff69a85febbaeb22feab9
+	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10861-07dfddaeb/debian/plexmediaserver_1.43.3.10861-07dfddaeb_arm64.deb
+	sha256sums_aarch64 = 2d4006110e55cd3920c82d8aec83db21b943d57430a94db486ffbd01902f15ae
 
 pkgname = plex-media-server

Comment

The change only bumps Plex Media Server to a newer upstream release and updates the corresponding source checksums for the official Plex download URLs. No new sources, scripts, install logic, or packaging behavior were introduced, and the package still installs the same prebuilt vendor binaries from the same HTTPS endpoints. I do not see any added supply-chain or privilege-escalation risk in this diff alone.

@@ -10,8 +10,8 @@
 # Contributor: Praekon <praekon@googlemail.com>
 
 pkgname=plex-media-server
-pkgver=1.43.3.10828
-_pkgsum=00f62d37d
+pkgver=1.43.3.10861
+_pkgsum=07dfddaeb
 pkgrel=1
 pkgdesc='The back-end media server component of Plex.'
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')

Comment

The change only updates pkgver/_pkgsum and the per-architecture SHA256 checksums to match a newer upstream Plex release. I do not see any new sources, build steps, network fetches, privilege escalation, install-script logic, or packaging behavior changes in the provided diff. This is a routine version bump with integrity hashes adjusted accordingly, so the security risk appears low.

@@ -39,10 +39,10 @@ sha256sums=('398ba7958598609453f5289b3d5f2389d2756158b340cf28e83c39d9ed60280b'
             'c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557'
             'b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad'
             'dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631')
-sha256sums_x86_64=('2ff1d3e1ac1052cfadfcaa932c17f6fa775e625859aa93224c85983f00052183')
-sha256sums_i686=('6ec375fe8d4de3bd5f3734865b6aa4245a791d7029a1216362f0625c5354cf1f')
-sha256sums_armv7h=('a24a65361bb28ebeecadf82d4c02d023ee9b3a34ee2baa0635bfc51e1d01b1be')
-sha256sums_aarch64=('f08c0ae850e331fa8204e9aa88226598d8da9181ae91f97fe01f76964ba962a0')
+sha256sums_x86_64=('2c1ff73ffd2ab8c8523fb5d37394c3cccffe0e8bd662b8a78749a7385874fb6b')
+sha256sums_i686=('2d22d0061aefa7c9662fb86f6fcc19f02e6e2478f5b0fadc2dad24c4bd9d371c')
+sha256sums_armv7h=('f22851c1611d03df736fd0cd9af0bc15f53c8767fd1ff69a85febbaeb22feab9')
+sha256sums_aarch64=('2d4006110e55cd3920c82d8aec83db21b943d57430a94db486ffbd01902f15ae')
 
 prepare() {
   if [[ $CARCH = armv7h ]] || [[ $CARCH = aarch64 ]]; then