Review Results

Comment

The change is a straightforward version bump in .SRCINFO for NVIDIA’s official HTTPS download URL, with the checksum updated accordingly and the matching makedepends constraint raised. There are no new sources, no build-script changes, no install hooks, and no signs of added persistence or privilege escalation. Risk is low because the package still fetches a vendor .run blob, but that was already the case and this diff does not worsen the security posture beyond the usual trust in upstream NVIDIA binaries.

@@ -1,15 +1,15 @@
 pkgbase = lib32-nvidia-utils-beta
 	pkgdesc = NVIDIA drivers utilities (32-bit, beta version)
-	pkgver = 610.43.03
+	pkgver = 610.57.04
 	pkgrel = 1
 	url = https://www.nvidia.com/
 	arch = x86_64
 	license = LicenseRef-custom
-	makedepends = nvidia-utils-beta>=610.43.03
+	makedepends = nvidia-utils-beta>=610.57.04
 	options = !strip
 	options = !emptydirs
-	source = https://us.download.nvidia.com/XFree86/Linux-x86_64/610.43.03/NVIDIA-Linux-x86_64-610.43.03.run
-	sha256sums = 45e2d4c134a23c35e50f253a4aa63e7e5e8d17e3d185d4a07c8a58e9612ed392
+	source = https://us.download.nvidia.com/XFree86/Linux-x86_64/610.57.04/NVIDIA-Linux-x86_64-610.57.04.run
+	sha256sums = b2e935c66b83bb00c0c857bc8e0ee0fd52de9286b40c9cc1eec29a7ce7eb116d
 
 pkgname = lib32-nvidia-utils-beta
 	depends = lib32-gcc-libs

Comment

The change is a straightforward version bump in .SRCINFO: it updates the dependency on nvidia-utils-beta and the provided virtual package versions to 610.57.04. There are no new sources, scripts, install hooks, permissions changes, or other execution paths introduced. This does not add any obvious supply-chain or privilege-escalation risk beyond the normal trust in the upstream NVIDIA beta package metadata.

@@ -18,13 +18,13 @@ pkgname = lib32-nvidia-utils-beta
 	depends = lib32-libx11
 	depends = lib32-libxext
 	depends = lib32-zlib
-	depends = nvidia-utils-beta>=610.43.03
+	depends = nvidia-utils-beta>=610.57.04
 	optdepends = lib32-opencl-nvidia-beta: for OpenCL support
-	provides = lib32-nvidia-utils=610.43.03
+	provides = lib32-nvidia-utils=610.57.04
 	provides = lib32-vulkan-driver
 	provides = lib32-opengl-driver
-	provides = lib32-nvidia-libgl=610.43.03
-	provides = lib32-nvidia-libgl-beta=610.43.03
+	provides = lib32-nvidia-libgl=610.57.04
+	provides = lib32-nvidia-libgl-beta=610.57.04
 	conflicts = lib32-nvidia-utils
 	conflicts = lib32-nvidia-libgl
 	replaces = lib32-nvidia-libgl

Comment

The change is a straightforward version bump in .SRCINFO for NVIDIA beta packages, updating the source URL to the official NVIDIA download host and refreshing the checksum plus dependency/provides versions. I do not see any new attack surface, suspicious sources, build-time network fetches beyond the declared upstream tarball, or packaging red flags in this diff. Risk is low.

@@ -33,9 +33,9 @@ pkgname = lib32-opencl-nvidia-beta
 	pkgdesc = OpenCL implemention for NVIDIA (32-bit, beta version)
 	depends = lib32-gcc-libs
 	depends = lib32-glibc
-	depends = lib32-nvidia-utils-beta>=610.43.03
+	depends = lib32-nvidia-utils-beta>=610.57.04
 	depends = lib32-zlib
 	optdepends = opencl-headers: headers necessary for OpenCL development
-	provides = lib32-opencl-nvidia=610.43.03
+	provides = lib32-opencl-nvidia=610.57.04
 	provides = lib32-opencl-driver
 	conflicts = lib32-opencl-nvidia

Comment

This is a routine version bump for NVIDIA beta utilities: the source remains the official HTTPS NVIDIA download URL, and the only other change is the corresponding SHA-256 checksum update for the new upstream .run installer. No new build steps, scripts, privileges, or additional sources were introduced. Based on the diff provided, there are no obvious supply-chain or persistence red flags.

@@ -8,7 +8,7 @@
 
 pkgbase=lib32-nvidia-utils-beta
 pkgname=('lib32-nvidia-utils-beta' 'lib32-opencl-nvidia-beta')
-pkgver=610.43.03
+pkgver=610.57.04
 pkgrel=1
 pkgdesc='NVIDIA drivers utilities (32-bit, beta version)'
 arch=('x86_64')

Comment

The change is a straightforward version bump of the NVIDIA proprietary driver utilities package and an accompanying SHA256 update for the upstream .run installer. The source remains the official NVIDIA HTTPS download URL, there are no new build-time downloads, scripts, patches, privilege changes, or packaging logic changes in this diff. Risk is low; the main trust boundary remains the upstream binary blob, but that was already present before this change.

@@ -18,7 +18,7 @@ makedepends=("nvidia-utils-beta>=${pkgver}") # to avoid conflict during installa
 options=('!strip' '!emptydirs')
 _pkg="NVIDIA-Linux-${CARCH}-${pkgver}"
 source=("https://us.download.nvidia.com/XFree86/Linux-${CARCH}/${pkgver}/${_pkg}.run")
-sha256sums=('45e2d4c134a23c35e50f253a4aa63e7e5e8d17e3d185d4a07c8a58e9612ed392')
+sha256sums=('b2e935c66b83bb00c0c857bc8e0ee0fd52de9286b40c9cc1eec29a7ce7eb116d')
 
 # create soname links
 _create_links() {