Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.17.0 to 1.18.0. No build logic, sources, checksums, install scripts, or packaging behavior are altered in the reviewed hunk, so there is no direct security impact visible here. The risk is limited to the usual possibility that the corresponding PKGBUILD/source update elsewhere could be problematic, but that is outside this diff.

@@ -1,6 +1,6 @@
 pkgbase = localsend-bin
 	pkgdesc = An open source cross-platform alternative to AirDrop
-	pkgver = 1.17.0
+	pkgver = 1.18.0
 	pkgrel = 1
 	url = https://github.com/localsend/localsend
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from LocalSend 1.17.0 to 1.18.0 for the x86_64 and aarch64 prebuilt .deb sources, with updated SHA-256 checksums. The sources remain HTTPS GitHub release URLs for the upstream project, and there are no new build steps, scripts, permissions changes, or other suspicious packaging metadata in this diff. No integrity or persistence red flags are introduced by this change alone.

@@ -12,9 +12,9 @@ pkgbase = localsend-bin
 	provides = localsend
 	conflicts = localsend
 	options = !debug
-	source_x86_64 = https://github.com/localsend/localsend/releases/download/v1.17.0/LocalSend-1.17.0-linux-x86-64.deb
-	sha256sums_x86_64 = b0244b2c3eacb2a81d61b2662534d6036ab37ace10d6782da36b630c222fa04c
-	source_aarch64 = https://github.com/localsend/localsend/releases/download/v1.17.0/LocalSend-1.17.0-linux-arm-64.deb
-	sha256sums_aarch64 = c2c792aadabeecf864f4105f8b1f8693941bc752fda582f0d2b3794765fcf803
+	source_x86_64 = https://github.com/localsend/localsend/releases/download/v1.18.0/LocalSend-1.18.0-linux-x86-64.deb
+	sha256sums_x86_64 = dae68192ad43a59a68df06454eb5fa4e9a9f86a343fe430165efd8b18863d0f4
+	source_aarch64 = https://github.com/localsend/localsend/releases/download/v1.18.0/LocalSend-1.18.0-linux-arm-64.deb
+	sha256sums_aarch64 = eb24e724fbdf830c8fb07dfc66b76b8a649923d083278305a63d5d539db4b606
 
 pkgname = localsend-bin

Comment

The change is a straightforward version bump for a binary package, with updated upstream release URLs, checksums, and an extraction path adjustment from data.tar.xz to data.tar.zst plus a corrected source directory path from usr/share/localsend_app to opt/localsend_app. I do not see any added execution, network access, privilege escalation, or persistence mechanisms. The package still fetches from the official GitHub release URL over HTTPS and installs only into $pkgdir. Risk is low.

@@ -7,7 +7,7 @@
 # using the .deb instead of the .tar.gz as it already contains the icons as well as the .desktop file.
 
 pkgname=localsend-bin
-pkgver=1.17.0
+pkgver=1.18.0
 pkgrel=1
 pkgdesc='An open source cross-platform alternative to AirDrop'
 url=https://github.com/localsend/localsend

Comment

The change is a routine package update from LocalSend 1.17.0 to 1.18.0. The source URLs remain HTTPS and point to the official upstream GitHub release assets, and the checksums were updated accordingly. The only functional packaging change is switching extraction from data.tar.xz to data.tar.zst and adjusting the install path from usr/share/localsend_app to opt/localsend_app, which is consistent with a repackaged .deb layout change. No suspicious build-time network access, privilege escalation, post-install scripts, or other persistence mechanisms are introduced in the reviewed hunk.

@@ -19,13 +19,13 @@ provides=('localsend')
 options=(!debug)
 source_x86_64=("${url}/releases/download/v${pkgver}/LocalSend-${pkgver}-linux-x86-64.deb")
 source_aarch64=("${url}/releases/download/v${pkgver}/LocalSend-${pkgver}-linux-arm-64.deb")
-sha256sums_x86_64=('b0244b2c3eacb2a81d61b2662534d6036ab37ace10d6782da36b630c222fa04c')
-sha256sums_aarch64=('c2c792aadabeecf864f4105f8b1f8693941bc752fda582f0d2b3794765fcf803')
+sha256sums_x86_64=('dae68192ad43a59a68df06454eb5fa4e9a9f86a343fe430165efd8b18863d0f4')
+sha256sums_aarch64=('eb24e724fbdf830c8fb07dfc66b76b8a649923d083278305a63d5d539db4b606')
 _pkgdesktop="localsend_app.desktop"
 
 
 prepare() {
-	tar -xf data.tar.xz
+	tar -xf data.tar.zst
 }
 
 build() {

Comment

The change only adjusts the extraction/copy paths to match the new .deb layout for the upstream 1.18.0 release: tar now unpacks data.tar.zst instead of data.tar.xz, and the packaged app files are copied from /opt/localsend_app rather than /usr/share/localsend_app. I do not see any added network access, privilege escalation, persistence, or other suspicious behavior in this diff. The package still installs the upstream binary payload from the official GitHub release with pinned checksums.

@@ -53,7 +53,7 @@ package() {
 
 	# Executable
 	install -dm755 "${pkgdir}/opt/${pkgname%-*}/"
-	cp -a "${srcdir}/usr/share/localsend_app/." "${pkgdir}/opt/${pkgname%-*}"
+	cp -a "${srcdir}/opt/localsend_app/." "${pkgdir}/opt/${pkgname%-*}"
 	# Same as icons - rename to localsend
 	mv "${pkgdir}/opt/${pkgname%-*}/localsend_app" "${pkgdir}/opt/${pkgname%-*}/localsend"