Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump from one upstream snapshot to another. No new sources, scripts, dependencies, install actions, or packaging behavior are introduced here. The diff itself does not reveal any integrity or execution red flags. Note that the URL remains HTTP in .SRCINFO, but that is pre-existing and unchanged in this commit, so it is not attributable to this change.

@@ -1,6 +1,6 @@
 pkgbase = eduke32
 	pkgdesc = An advanced Duke Nukem 3D source port
-	pkgver = 20260203.r10664_ba6b7bb1d
+	pkgver = 20260807.r10669_ec5824db8
 	pkgrel = 3
 	url = http://eduke32.com/
 	install = eduke32.install

Comment

The change only updates the upstream source tarball URL and its checksum in .SRCINFO. There are no new build steps, scripts, privileges, or packaging behaviors introduced here. However, the source URL still uses plain HTTP rather than HTTPS, which is a supply-chain integrity concern because the tarball could be MITM-tampered during fetch. Since this is a metadata-only update and the package already relied on the same insecure source host pattern, I rate this low risk rather than high severity.

@@ -18,10 +18,10 @@ pkgbase = eduke32
 	optdepends = fluidsynth: alternative midi sequencer
 	optdepends = eduke32-shareware-episode: Duke Nukem 3D Demo
 	options = !debug
-	source = http://dukeworld.com/eduke32/synthesis/20260203-10664-ba6b7bb1d/eduke32_src_20260203-10664-ba6b7bb1d.tar.xz
+	source = http://dukeworld.com/eduke32/synthesis/20260807-10669-ec5824db8/eduke32_src_20260807-10669-ec5824db8.tar.xz
 	source = eduke32.png
 	source = eduke32.desktop
-	sha256sums = daa2ce53a79d1fff337da40b60f1bd13b21d03c1e22f73b2a95431ee3008c7f3
+	sha256sums = f292e2c69f7f3453dd145d19ce1c114bd7136a8a9cf5b9b6641525fd53fa56c5
 	sha256sums = b55a264b4682afabd49587d700d4c85ce6c2e7af7ce2764dd217ebe167549863
 	sha256sums = cf2ea2c6a0d85ab15e30171ed5b921f1fcf5644de7af9638c0ef60de21c44f24
 

Comment

The change only bumps the upstream snapshot identifiers in PKGBUILD (_pkgdate and _pkgrev) to a newer eduke32 revision. No new sources, scripts, build steps, permissions, or install-time behavior are introduced by this diff. Based on the provided hunk alone, this is a routine version update with no evident security impact.

@@ -2,8 +2,8 @@
 # Contributors: carstene1ns, Arkham, Christoph Zeiler and JD Steffen
 
 pkgname=eduke32
-_pkgdate=20260203
-_pkgrev='10664-ba6b7bb1d'
+_pkgdate=20260807
+_pkgrev='10669-ec5824db8'
 pkgver=$_pkgdate.r${_pkgrev/-/_}
 pkgrel=3
 pkgdesc="An advanced Duke Nukem 3D source port"

Comment

The change is a routine upstream version bump in PKGBUILD: it updates the source tarball date/revision and the corresponding SHA-256 checksum. I do note the source URL still uses plain HTTP rather than HTTPS, which is a supply-chain integrity weakness in general, but this commit does not introduce that issue and there are no new red flags such as build-time downloads, scripts, or privilege changes. Based on the diff alone, risk is low.

@@ -19,7 +19,7 @@ install=$pkgname.install
 source=("http://dukeworld.com/$pkgname/synthesis/$_pkgdate-$_pkgrev/eduke32_src_$_pkgdate-$_pkgrev.tar.xz"
         "$pkgname.png"
         "$pkgname.desktop")
-sha256sums=('daa2ce53a79d1fff337da40b60f1bd13b21d03c1e22f73b2a95431ee3008c7f3'
+sha256sums=('f292e2c69f7f3453dd145d19ce1c114bd7136a8a9cf5b9b6641525fd53fa56c5'
             'b55a264b4682afabd49587d700d4c85ce6c2e7af7ce2764dd217ebe167549863'
             'cf2ea2c6a0d85ab15e30171ed5b921f1fcf5644de7af9638c0ef60de21c44f24')
 options=(!debug)