Review Results

Comment

The change is a straightforward version bump in .SRCINFO: it updates pkgver/pkgrel and replaces the GitHub release tarball URLs and checksums for fvs2 and its core dependency. The sources remain HTTPS and point to the upstream GitHub repositories, with no new build-time network behavior, scripts, or packaging directives introduced in this diff. No obvious supply-chain red flags are present in the metadata change alone.

@@ -1,16 +1,16 @@
 pkgbase = fvs2
 	pkgdesc = Standalone CLI for FVS v2
-	pkgver = 0.9.0
-	pkgrel = 2
+	pkgver = 0.10.0
+	pkgrel = 1
 	url = https://github.com/fvs-lab/fvs2
 	arch = x86_64
 	arch = aarch64
 	license = MIT
 	makedepends = go
 	depends = glibc
-	source = fvs2-0.9.0.tar.gz::https://github.com/fvs-lab/fvs2/archive/refs/tags/v0.9.0.tar.gz
-	source = core-0.1.1.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v0.1.1.tar.gz
-	sha256sums = 74aa67ab731c7a25da4a7858cbebdd2a87f361568977b19653651bf2b1979815
-	sha256sums = 91b417276815752ab7608659b33d09d8d4b3e4d03303c2314685440808a52eb6
+	source = fvs2-0.10.0.tar.gz::https://github.com/fvs-lab/fvs2/archive/refs/tags/v0.10.0.tar.gz
+	source = core-0.1.2.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v0.1.2.tar.gz
+	sha256sums = 3006cb5a221e5e46bdfc4c3dc31fed74a4ffbfd63ae0d7f2fdcfbc9311048f80
+	sha256sums = 188a681bf3d8f8d1c395bd6080fefac0016702efdd12b2fc8c3bfd717f3da884
 
 pkgname = fvs2

Comment

The change only bumps the upstream/core version and resets pkgrel. No build logic, sources, install scripts, permissions, or dependency changes are introduced in the provided diff hunk. Based on this diff alone there are no security-relevant red flags such as new network fetches, privilege escalation, persistence, or integrity bypasses.

@@ -1,10 +1,10 @@
 # Maintainer: w568w <w568w at outlook dot com>
 
-_corever=0.1.1
+_corever=0.1.2
 
 pkgname=fvs2
-pkgver=0.9.0
-pkgrel=2
+pkgver=0.10.0
+pkgrel=1
 pkgdesc='Standalone CLI for FVS v2'
 arch=('x86_64' 'aarch64')
 url='https://github.com/fvs-lab/fvs2'

Comment

The change is a routine version bump of the upstream tarball and its dependency submodule, with updated checksums. The sources remain HTTPS GitHub release archives, there are no new build-time network fetches beyond the existing `go mod download`, no added install scripts, and no suspicious packaging changes such as privilege escalation, persistence, or external binaries. Based on the diff provided, this looks low risk.

@@ -15,8 +15,8 @@ source=(
   "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
   "core-${_corever}.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v${_corever}.tar.gz"
 )
-sha256sums=('74aa67ab731c7a25da4a7858cbebdd2a87f361568977b19653651bf2b1979815'
-            '91b417276815752ab7608659b33d09d8d4b3e4d03303c2314685440808a52eb6')
+sha256sums=('3006cb5a221e5e46bdfc4c3dc31fed74a4ffbfd63ae0d7f2fdcfbc9311048f80'
+            '188a681bf3d8f8d1c395bd6080fefac0016702efdd12b2fc8c3bfd717f3da884')
 
 prepare() {
   local builddir="$srcdir/$pkgname-$pkgver"