Review Results

Comment

The change is limited to .SRCINFO and only updates the recorded filename/date for an existing upstream source tarball while keeping the same HTTPS GitHub URL and branch reference. There is no new source host, no build-script logic, and no evidence of added execution or privilege-related behavior. Security impact is minimal; the main concern would be if the regenerated tarball were not actually reflected in the PKGBUILD/source integrity data, but that is a packaging consistency issue rather than a direct security issue in this diff.

@@ -76,7 +76,7 @@ pkgbase = qt5-webengine
 	options = !lto
 	options = !debug
 	source = qtwebengine-5.15.19-lts.tgz::https://github.com/qt/qtwebengine/archive/refs/tags/v5.15.19-lts.tar.gz
-	source = qtwebengine-chromium-87-based-20250423.tgz::https://github.com/qt/qtwebengine-chromium/archive/refs/heads/87-based.tar.gz
+	source = qtwebengine-chromium-87-based-20260724.tgz::https://github.com/qt/qtwebengine-chromium/archive/refs/heads/87-based.tar.gz
 	source = 0000-qt5-webengine-pipewire-0.3@chromium.patch
 	source = 0001-qt5-webengine-icu-75@chromium.patch
 	source = 0002-qt5-webengine-ninja-1.12@chromium.patch

Comment

The change only updates .SRCINFO metadata for an existing upstream tarball and its checksum. The source URL remains HTTPS and points to the same GitHub repository/branch as before; no new sources, scripts, or build logic are introduced. This is a routine checksum refresh for a newer snapshot of the same chromium-based tarball, with no evidence in the diff of malicious code execution, privilege escalation, or packaging hygiene issues. Risk is therefore low.

@@ -85,7 +85,7 @@ pkgbase = qt5-webengine
 	source = 0006-qt5-webengine-icu-78@chromium.patch
 	source = 0007-qt5-webengine-glibc-2.43-SYS_SECCOMP-as-enum@chromium.patch
 	md5sums = 1d1c4743f5b9f6601681c81f0ed953d5
-	md5sums = 5fbf73d6c48235a94620231755481628
+	md5sums = 30e900a16d886c71a74d685d1c34dfdd
 	md5sums = a21aa28d235877e7dcc35055d67d417d
 	md5sums = ce4f3cb4a30f88136b1d3d1bcef40448
 	md5sums = f1ed8795356458457a311d0e3101ba28

Comment

The change only updates one SHA256 checksum entry in .SRCINFO, which is metadata for source integrity verification. There is no evidence here of new sources, build logic, install scripts, or privilege/persistence mechanisms. On its face this is a low-risk maintenance update, though the underlying PKGBUILD/source set would need separate review if the checksum change corresponds to a source replacement.

@@ -94,7 +94,7 @@ pkgbase = qt5-webengine
 	md5sums = bdddda5a578704eb56f5ceeaab49bd2f
 	md5sums = 7c88da9ed56bd99eee3cdba5f197102c
 	sha256sums = 33cd20f4a87874f34ef3f9c8d767e006498acc3e6cff89a9c64a9e3387bbfaa5
-	sha256sums = bef1d9d0ed81778b31cbb5f592a66007bd60d1919f836529f9cd057edd9aacc1
+	sha256sums = 619478e66fe16460694dfafddd8e0f3108ee48e85f714beb66aa49fa44475593
 	sha256sums = 5e3a3c4711d964d5152a04059a2b5c1d14bb13dd29bce370120f60e85b476b6f
 	sha256sums = 7cac28ba784d24b4abf6414079548ada165343af507ecd8e23cbe7e4f63ae52f
 	sha256sums = 6672741b64d896dc555c8ee42ca2329c4f20d5f406095a69fe72da44b3a142f4

Comment

The change only updates checksums and bumps the pinned snapshot date for an existing HTTPS GitHub source tarball. There is no new source host, no build-time network fetch, no script execution, and no packaging/persistence logic introduced. The main risk is that the package now trusts a newer upstream snapshot, but that is normal for a source update and is still integrity-checked by the updated hashes. No obvious security issue in this diff.

@@ -42,7 +42,7 @@ source=(
   '0007-qt5-webengine-glibc-2.43-SYS_SECCOMP-as-enum@chromium.patch'
 )
 md5sums=('1d1c4743f5b9f6601681c81f0ed953d5'
-         '5fbf73d6c48235a94620231755481628'
+         '30e900a16d886c71a74d685d1c34dfdd'
          'a21aa28d235877e7dcc35055d67d417d'
          'ce4f3cb4a30f88136b1d3d1bcef40448'
          'f1ed8795356458457a311d0e3101ba28'

Comment

The change only updates checksum pins and advances the timestamp used in the Chromium 87-based tarball name. There is no new code execution, no new source host, and no packaging logic change. The source URL remains the official Qt GitHub archive over HTTPS, and the diff does not introduce any install scripts, binaries, or privilege-related behavior. Security impact is limited to trusting a different upstream snapshot, which is expected for a version bump and is covered by the updated checksums.

@@ -51,7 +51,7 @@ md5sums=('1d1c4743f5b9f6601681c81f0ed953d5'
          'bdddda5a578704eb56f5ceeaab49bd2f'
          '7c88da9ed56bd99eee3cdba5f197102c')
 sha256sums=('33cd20f4a87874f34ef3f9c8d767e006498acc3e6cff89a9c64a9e3387bbfaa5'
-            'bef1d9d0ed81778b31cbb5f592a66007bd60d1919f836529f9cd057edd9aacc1'
+            '619478e66fe16460694dfafddd8e0f3108ee48e85f714beb66aa49fa44475593'
             '5e3a3c4711d964d5152a04059a2b5c1d14bb13dd29bce370120f60e85b476b6f'
             '7cac28ba784d24b4abf6414079548ada165343af507ecd8e23cbe7e4f63ae52f'
             '6672741b64d896dc555c8ee42ca2329c4f20d5f406095a69fe72da44b3a142f4'

Comment

The change only updates the pinned checksum and the date embedded in the filename for an existing HTTPS GitHub source tarball. The source URL itself is unchanged and still points to the official qt/qtwebengine-chromium repository, with no new build-time network access, scripts, or privilege-related behavior introduced. I do note the date string is unusual (far in the future relative to the previous value), but it only affects the local filename label, not the fetched URL or integrity mechanism. Overall this looks like a benign source refresh/checksum update.

@@ -67,7 +67,7 @@ if : ; then
   #_srcdir='qtwebengine'
   #source[0]="git+https://github.com/qt/${_srcdir}.git#tag=v${pkgver}-lts"
   _srcdir87='qtwebengine-chromium-87-based'
-  _date87='20250423'
+  _date87='20260724'
   source[1]="${_srcdir87}-${_date87}.tgz::https://github.com/qt/qtwebengine-chromium/archive/refs/heads/87-based.tar.gz"
 else
   md5sums[0]='SKIP'