Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 2026.3 to 2026.4. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were modified in the reviewed hunk. On its face this is a routine upstream version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = mullvad-vpn-bin
 	pkgdesc = The Mullvad VPN client app for desktop
-	pkgver = 2026.3
+	pkgver = 2026.4
 	pkgrel = 1
 	url = https://www.mullvad.net
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from MullvadVPN 2026.3 to 2026.4 for both x86_64 and aarch64 release artifacts, with updated checksums. Sources remain HTTPS GitHub release URLs from the upstream project, and there are no new build-time commands, install scripts, or packaging behavior changes in this diff. No obvious supply-chain red flags are introduced by this metadata-only update.

@@ -15,13 +15,13 @@ pkgbase = mullvad-vpn-bin
 	source = mullvad-vpn.sh
 	validpgpkeys = A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF
 	sha256sums = a59c29f07b4eab9af56f0e8be42bae0d83726f5185e88de0c5a48f4098c3c0a4
-	source_x86_64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.3/MullvadVPN-2026.3_amd64.deb
-	source_x86_64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.3/MullvadVPN-2026.3_amd64.deb.asc
-	sha256sums_x86_64 = 38c6ee73ae80870688560922a28525b6d0dacc62c2e410938863d7038e931aca
+	source_x86_64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_amd64.deb
+	source_x86_64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_amd64.deb.asc
+	sha256sums_x86_64 = f1d758079e1dc90fff0c8d48256599b717e1de9879682c861a6776851c59453b
 	sha256sums_x86_64 = SKIP
-	source_aarch64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.3/MullvadVPN-2026.3_arm64.deb
-	source_aarch64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.3/MullvadVPN-2026.3_arm64.deb.asc
-	sha256sums_aarch64 = a44cdbdb50923e7fd97e5cd91934892391f3dd0f8444520b83cabb57cf403754
+	source_aarch64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_arm64.deb
+	source_aarch64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_arm64.deb.asc
+	sha256sums_aarch64 = 39d897f425f77c3fe49902cf2f3d58a02c812d482a22f95dfc069526f58e1d09
 	sha256sums_aarch64 = SKIP
 
 pkgname = mullvad-vpn-bin

Comment

The change is a simple version bump in PKGBUILD from 2026.3 to 2026.4 with no accompanying changes to source URLs, checksums, build logic, install scripts, permissions, or package metadata. On its face this does not introduce any new security risk; it appears to be a routine upstream version update. I did not observe any suspicious network fetches, privilege escalation, persistence mechanisms, or integrity regressions in the provided diff hunk.

@@ -6,7 +6,7 @@ pkgname=(
   'mullvad-vpn-daemon-bin'
 )
 pkgbase=mullvad-vpn-bin
-pkgver=2026.3
+pkgver=2026.4
 pkgrel=1
 pkgdesc="The Mullvad VPN client app for desktop"
 arch=('x86_64' 'aarch64')

Comment

The change is a routine version bump for a binary package, with updated SHA256 checksums for the new upstream .deb artifacts. The source URLs remain HTTPS and point to the official Mullvad GitHub release assets, and the existing PGP verification key is unchanged. No new build-time execution, install-script logic, or privilege/persistence mechanism is introduced in this diff. Risk is low because the trust boundary is still the upstream signed release artifact, and the only substantive change is accepting a newer release.

@@ -24,9 +24,9 @@ source=('mullvad-vpn.sh')
 source_x86_64=("https://github.com/mullvad/mullvadvpn-app/releases/download/$pkgver/MullvadVPN-${pkgver}_amd64.deb"{,.asc})
 source_aarch64=("https://github.com/mullvad/mullvadvpn-app/releases/download/$pkgver/MullvadVPN-${pkgver}_arm64.deb"{,.asc})
 sha256sums=('a59c29f07b4eab9af56f0e8be42bae0d83726f5185e88de0c5a48f4098c3c0a4')
-sha256sums_x86_64=('38c6ee73ae80870688560922a28525b6d0dacc62c2e410938863d7038e931aca'
+sha256sums_x86_64=('f1d758079e1dc90fff0c8d48256599b717e1de9879682c861a6776851c59453b'
                    'SKIP')
-sha256sums_aarch64=('a44cdbdb50923e7fd97e5cd91934892391f3dd0f8444520b83cabb57cf403754'
+sha256sums_aarch64=('39d897f425f77c3fe49902cf2f3d58a02c812d482a22f95dfc069526f58e1d09'
                     'SKIP')
 validpgpkeys=('A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF') # Mullvad (code signing) <admin@mullvad.net>