Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.22.1 to 1.24.2. .SRCINFO is metadata used by AUR helpers and does not itself introduce executable behavior. No sources, checksums, install scripts, or build logic are changed in the provided diff, so there is no direct security impact visible here.

@@ -1,6 +1,6 @@
 pkgbase = conky-lua-nv
 	pkgdesc = Lightweight system monitor for X with lua and nvidia enabled
-	pkgver = 1.22.1
+	pkgver = 1.24.2
 	pkgrel = 1
 	url = https://github.com/brndnmtthws/conky
 	install = conky-lua-nv.install

Comment

The change only bumps the upstream Conky source tarball from v1.22.1 to v1.24.2 and updates the corresponding checksum in .SRCINFO. The source remains an HTTPS GitHub release archive from the official upstream repository, with no new build-time downloads, scripts, patches, or privilege-related changes visible in this diff. Based on the provided hunk alone, this is a routine version update with no clear security red flags.

@@ -59,7 +59,7 @@ pkgbase = conky-lua-nv
 	conflicts = conky
 	replaces = torsmo
 	replaces = conky
-	source = https://github.com/brndnmtthws/conky/archive/refs/tags/v1.22.1.tar.gz
-	sha1sums = fba75c66a87e7a06360dde013954f7e457f9d1c2
+	source = https://github.com/brndnmtthws/conky/archive/refs/tags/v1.24.2.tar.gz
+	sha1sums = 3594f780f3aaeb0841ec548bf143e66e77d91fea
 
 pkgname = conky-lua-nv

Comment

The change is a straightforward version bump from 1.22.1 to 1.24.2 with an updated checksum and one CMake install-dir override. The source remains the official upstream GitHub release tarball over HTTPS, pinned to a tag, and there are no new build-time downloads, shell pipelines, privilege changes, or suspicious install-script/systemd additions in the diff. The added CMAKE_INSTALL_DATAROOTDIR=/usr/share is a packaging fix that keeps installed data under the package prefix and does not introduce a security concern. Overall this looks low risk.

@@ -7,7 +7,7 @@
 
 pkgname=conky-lua-nv
 _pkgname=conky
-pkgver=1.22.1
+pkgver=1.24.2
 pkgrel=1
 pkgdesc="Lightweight system monitor for X with lua and nvidia enabled"
 arch=('i686' 'x86_64')

Comment

The change is low risk. It updates the package version and checksum to a new upstream release and adds an explicit CMAKE_INSTALL_DATAROOTDIR=/usr/share setting, which is a normal packaging fix to keep installed data under the standard prefix. I did not see any new network fetches, privilege escalation, suspicious scripts, or other integrity concerns in the reviewed diff hunk.

@@ -29,7 +29,7 @@ optdepends=('nvidia: for NV11 and newer GPUs',
   'nvidia-390xx-dkms: for NVC0 and GF1XX (Fermi) GPUs'
   'nvidia-340xx-dkms: for NV40 and G70 (Curie) GPUs')
 source=("https://github.com/brndnmtthws/${_pkgname}/archive/refs/tags/v${pkgver}.tar.gz")
-sha1sums=('fba75c66a87e7a06360dde013954f7e457f9d1c2')
+sha1sums=('3594f780f3aaeb0841ec548bf143e66e77d91fea')
 install='conky-lua-nv.install'
 
 prepare() {

Comment

The change is low risk. It only bumps the package version and checksum and adds an explicit CMake install datarootdir of /usr/share, which is the expected Arch filesystem location. There are no new network fetches, privilege changes, post-install actions, or suspicious build steps in the reviewed hunk. The source remains the official upstream GitHub release tarball over HTTPS, and the added CMake flag does not introduce an integrity or persistence concern.

@@ -45,6 +45,7 @@ build() {
     -B build \
     -D CMAKE_BUILD_TYPE=Release \
     -D CMAKE_CXX_FLAGS="$CXXFLAGS -ffat-lto-objects" \
+    -D CMAKE_INSTALL_DATAROOTDIR=/usr/share \
     -D MAINTAINER_MODE=OFF \
     -D BUILD_DOCS=ON \
     -D BUILD_IMLIB2=ON \