Review Results

Comment

The change only bumps pkgver in .SRCINFO from 3.2.32_51802 to 3.2.32_52194. No source URLs, checksums, build steps, install scripts, permissions, or package metadata beyond the version string are altered. On its face this is a routine version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = linuxqq
 	pkgdesc = New Linux QQ based on Electron
-	pkgver = 3.2.32_51802
+	pkgver = 3.2.32_52194
 	pkgrel = 1
 	epoch = 5
 	url = https://im.qq.com/linuxqq

Comment

The change only updates the pinned upstream binary package URLs and their SHA-512 checksums in .SRCINFO, pointing to the same official qqdl.gtimg.cn host over HTTPS. There is no new build logic, no added scripts, and no evidence of privilege escalation or persistence mechanisms in this diff. The package still relies on upstream prebuilt .deb artifacts, which is a general trust consideration, but this commit merely refreshes to a newer release and preserves integrity pinning via checksums.

@@ -21,11 +21,11 @@ pkgbase = linuxqq
 	options = !debug
 	source = linuxqq.sh
 	sha512sums = bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7
-	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/c97651b2/linuxqq_3.2.32-51802_amd64.deb
-	sha512sums_x86_64 = 5a397574b333671f65395e4dcbe4fa829a0cb1a3e94569daeac15582c1f17d8e1ecbfea271b66a3c303ed73228eec12dc3f9962f51826b924896c31b05c08e9e
-	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/c97651b2/linuxqq_3.2.32-51802_arm64.deb
-	sha512sums_aarch64 = 7c9b201afeef11846e4a7b10332d6a81c786b8c28957d102ebdd1d20d998c83b72e15348832ca97ec10bd183e0881ab9911ec8122f9bdc4ca98a61316e44d512
-	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/c97651b2/linuxqq_3.2.32-51802_loongarch64.deb
-	sha512sums_loong64 = aac5bb9e53554db5c95bbb2541cfda0841633e996798088756d2a16d3c8e480288fb6d8c52eecd154b1d119ddf2f1da59e58e90c9dd40a74e40518ba815f386a
+	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/3f89efc5/linuxqq_3.2.32-52194_amd64.deb
+	sha512sums_x86_64 = 67ed23ebc802d6b2c8f409316eea2e880a71e8ffdaf09bd3d2ac9aeb2dd57efa48ada919e82594948122fa72664512e038665a21ce0b9063e97baeb504deeb9c
+	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/3f89efc5/linuxqq_3.2.32-52194_arm64.deb
+	sha512sums_aarch64 = 0a26b68711ae0055e1dbb8414663be72638f07f3a471cef1cfb5e79d1ced2b09bc15337c12235450c8b3453fd7ef43ae4c03078c8f319a835d1f707dfdc96c28
+	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/3f89efc5/linuxqq_3.2.32-52194_loongarch64.deb
+	sha512sums_loong64 = 99b7fd9400910c993dd97dda294add65e58a2e3e3ff8a3860f60cf8b8a24418c6107ecfefca8f0ba76532ce92d0a9e76c9c66396c8c8a867fa3e8450aca9916c
 
 pkgname = linuxqq

Comment

The change is a routine version bump in PKGBUILD: pkgver, the upstream-derived md5 prefix, and the per-architecture SHA-512 checksums were updated to match new release artifacts. The source URLs remain HTTPS and still point to the same upstream qqdl.gtimg.cn host, with no new build-time code execution, no added install scripts, and no packaging logic changes. I do note the package continues to fetch prebuilt .deb binaries from upstream, but that was already the case and this diff does not introduce a new integrity or persistence risk beyond the normal trust in upstream release artifacts.

@@ -2,7 +2,7 @@
 # Contributor: Integral <integral@member.fsf.org>
 
 pkgname=linuxqq
-pkgver=3.2.32_51802
+pkgver=3.2.32_52194
 pkgrel=1
 epoch=5
 pkgdesc="New Linux QQ based on Electron"

Comment

The change only updates linuxqq to a newer upstream beta build by changing pkgver, the vendor download prefix, and the expected SHA-512 checksums for the architecture-specific .deb sources. The source URLs remain HTTPS and point to the same official qqdl.gtimg.cn host, with no new build-time downloads, scripts, privilege changes, or packaging logic modifications. I do not see any new security red flags in this diff itself; the main trust assumption remains the prebuilt upstream .deb, which was already present before this change.

@@ -12,16 +12,16 @@ license=('LicenseRef-QQ')
 conflicts=("${pkgname}-nt-bwrap")
 depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
 optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
-_md5_prefix=c97651b2
+_md5_prefix=3f89efc5
 _src_prefix="${pkgname}_${pkgver/_/-}"
 source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
 source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
 source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
 source=("${pkgname}.sh")
 sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
-sha512sums_x86_64=('5a397574b333671f65395e4dcbe4fa829a0cb1a3e94569daeac15582c1f17d8e1ecbfea271b66a3c303ed73228eec12dc3f9962f51826b924896c31b05c08e9e')
-sha512sums_aarch64=('7c9b201afeef11846e4a7b10332d6a81c786b8c28957d102ebdd1d20d998c83b72e15348832ca97ec10bd183e0881ab9911ec8122f9bdc4ca98a61316e44d512')
-sha512sums_loong64=('aac5bb9e53554db5c95bbb2541cfda0841633e996798088756d2a16d3c8e480288fb6d8c52eecd154b1d119ddf2f1da59e58e90c9dd40a74e40518ba815f386a')
+sha512sums_x86_64=('67ed23ebc802d6b2c8f409316eea2e880a71e8ffdaf09bd3d2ac9aeb2dd57efa48ada919e82594948122fa72664512e038665a21ce0b9063e97baeb504deeb9c')
+sha512sums_aarch64=('0a26b68711ae0055e1dbb8414663be72638f07f3a471cef1cfb5e79d1ced2b09bc15337c12235450c8b3453fd7ef43ae4c03078c8f319a835d1f707dfdc96c28')
+sha512sums_loong64=('99b7fd9400910c993dd97dda294add65e58a2e3e3ff8a3860f60cf8b8a24418c6107ecfefca8f0ba76532ce92d0a9e76c9c66396c8c8a867fa3e8450aca9916c')
 options=('!strip' '!debug')
 
 package() {