Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 2.6.1 to 2.6.2, with the source URL and checksum updated accordingly. The source remains HTTPS and points to the official upstream GitLab project, with no new build steps, scripts, binaries, or privilege-related metadata introduced in this diff. Based on the provided hunk alone, there are no obvious security concerns.

@@ -1,13 +1,13 @@
 pkgbase = garden-tools
 	pkgdesc = Garden grows and cultivates collections of Git trees
-	pkgver = 2.6.1
+	pkgver = 2.6.2
 	pkgrel = 1
 	url = https://gitlab.com/garden-rs/garden
 	arch = x86_64
 	license = MIT
 	makedepends = cargo
 	depends = libgcc
-	source = https://gitlab.com/garden-rs/garden/-/archive/v2.6.1/garden-v2.6.1.tar.gz
-	sha256sums = 7581743e2a622cebd1a554cec21980573fe357c5cc60ef2bf6b0fa1993314dec
+	source = https://gitlab.com/garden-rs/garden/-/archive/v2.6.2/garden-v2.6.2.tar.gz
+	sha256sums = 7c2215d6cf6bd6797aac4ad0a0145e2407f939fa2258248d67ba055b778dae03
 
 pkgname = garden-tools

Comment

The change is a routine version bump plus tightening Cargo reproducibility flags (`--locked`/`--frozen`) and an updated source checksum. The source remains the official upstream GitLab archive over HTTPS, there are no new scripts, patches, binaries, privilege changes, or install-time actions. No security red flags are introduced by this diff.

@@ -1,6 +1,6 @@
 # Maintainer: Mark Wagie <mark dot wagie at proton dot me>
 pkgname=garden-tools
-pkgver=2.6.1
+pkgver=2.6.2
 pkgrel=1
 pkgdesc="Garden grows and cultivates collections of Git trees"
 arch=('x86_64')

Comment

The change is a routine version bump plus tighter Cargo reproducibility flags. Source remains the official upstream GitLab archive over HTTPS, and the updated checksum matches the new tarball. The added --locked/--frozen flags reduce supply-chain risk by preventing dependency resolution drift during build. No new scripts, network fetches outside source(), privilege changes, or packaging red flags are introduced in this diff.

@@ -9,19 +9,19 @@ license=('MIT')
 depends=('libgcc')
 makedepends=('cargo')
 source=("https://gitlab.com/garden-rs/garden/-/archive/v${pkgver}/garden-v${pkgver}.tar.gz")
-sha256sums=('7581743e2a622cebd1a554cec21980573fe357c5cc60ef2bf6b0fa1993314dec')
+sha256sums=('7c2215d6cf6bd6797aac4ad0a0145e2407f939fa2258248d67ba055b778dae03')
 
 prepare() {
   cd "garden-v${pkgver}"
   export RUSTUP_TOOLCHAIN=stable
-  cargo fetch --target host-tuple
+  cargo fetch --locked --target host-tuple
 }
 
 build() {
   cd "garden-v${pkgver}"
   export RUSTUP_TOOLCHAIN=stable
   export CARGO_TARGET_DIR=target
-  cargo build --release
+  cargo build --frozen --release
 
   # completions
   for shell in bash fish zsh; do