Review Results

Comment

The change is a routine version bump in .SRCINFO from 2.3.0 to 2.4.1, with the source tag updated accordingly. The source remains an HTTPS GitHub URL pointing to the same upstream repository, and there are no new build steps, scripts, or privilege-related artifacts introduced by this diff. The only notable change is replacing SKIP with a specific sha256sum entry in .SRCINFO, which is an integrity improvement rather than a risk. Based on the provided hunk alone, I see no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = qt-sudo
 	pkgdesc = A clone of LXQt sudo tool, without LXQt libs
-	pkgver = 2.3.0
+	pkgver = 2.4.1
 	pkgrel = 1
 	url = https://github.com/aarnt/qt-sudo.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from v2.3.0 to v2.4.1, with the source still pointing to the same official GitHub repository over HTTPS. The new source is pinned to a tag rather than a floating branch, which is good. The only notable change is replacing SKIP with a fixed sha256 checksum, which improves integrity. No suspicious new sources, scripts, or packaging metadata were introduced in this diff.

@@ -11,7 +11,7 @@ pkgbase = qt-sudo
 	depends = glibc
 	depends = qt6-base
 	depends = sudo
-	source = git+https://github.com/aarnt/qt-sudo.git#tag=v2.3.0
-	sha256sums = SKIP
+	source = git+https://github.com/aarnt/qt-sudo.git#tag=v2.4.1
+	sha256sums = f859d9485170454b0ed156d44c44e56a30ef566be261ae105077eacbba24e61f
 
 pkgname = qt-sudo

Comment

The change only adds a .gitignore that ignores everything except a few package metadata files. This does not affect the built package contents or introduce any execution, network, privilege, or persistence behavior. No security-relevant risk is evident from this diff alone.

@@ -0,0 +1,6 @@
+*
+!.gitignore
+!PKGBUILD
+!.SRCINFO
+!*.desktop
+!*.toml
\ No newline at end of file

Comment

The change is a straightforward version bump from 2.3.0 to 2.4.1 plus replacing SKIP with a pinned SHA-256 for the git tag source. The source remains an HTTPS GitHub URL pinned to a tag, and there are no added build steps, scripts, patches, or packaging changes that would introduce execution, persistence, or privilege-escalation risks. I did not find any suspicious network fetches, install hooks, or other red flags in the reviewed diff.

@@ -2,7 +2,7 @@
 # Contributor: MatMoul <matmoul at the google email domain which is .com>
 
 pkgname=qt-sudo
-pkgver=2.3.0
+pkgver=2.4.1
 pkgrel=1
 pkgdesc='A clone of LXQt sudo tool, without LXQt libs'
 arch=('x86_64')

Comment

The change only replaces SKIP with a fixed sha256 checksum for the existing pinned git tag source and bumps pkgver. The source remains HTTPS and tag-pinned, with no new build-time commands, install scripts, or packaging behavior changes. This improves integrity verification rather than weakening it, and I found no supply-chain or privilege-related red flags in the diff provided.

@@ -19,7 +19,7 @@ makedepends=(
   'qt6-tools'
 )
 source=("git+https://github.com/aarnt/qt-sudo.git#tag=v${pkgver}")
-sha256sums=('SKIP')
+sha256sums=('f859d9485170454b0ed156d44c44e56a30ef566be261ae105077eacbba24e61f')
 
 build() {
   cd qt-sudo