Review Results

Comment

The change is a straightforward version bump in .SRCINFO from Zotero 9.0.6 to 10.0, with corresponding upstream download URLs and updated SHA256 checksums for each architecture. The sources remain HTTPS and point to the official Zotero download endpoint, with no added scripts, patches, install hooks, or packaging behavior changes visible in this diff. Based on the provided hunk alone, there are no obvious supply-chain or privilege-escalation concerns.

@@ -1,6 +1,6 @@
 pkgbase = zotero-bin
 	pkgdesc = Zotero Standalone. Is a free, easy-to-use tool to help you collect, organize, cite, and share your research sources.
-	pkgver = 9.0.6
+	pkgver = 10.0
 	pkgrel = 1
 	url = https://www.zotero.org/download
 	arch = x86_64

Comment

The change only updates .SRCINFO metadata to point at Zotero 10.0 release tarballs and their corresponding SHA256 sums. The sources remain HTTPS from the official Zotero domain, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. This is a routine version bump with integrity hashes updated accordingly.

@@ -14,11 +14,11 @@ pkgbase = zotero-bin
 	conflicts = zotero
 	source = zotero.desktop
 	sha256sums = f727308716741cf9746b92047b890c3f76c4b8b010bc5ed21b5cdb1be85e21e9
-	source_x86_64 = Zotero-9.0.6_linux_x86_64.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-x86_64&version=9.0.6
-	sha256sums_x86_64 = 0db6e8f94bd0d84e862e6ef5c3e217030e173c0cd3c6dfbc836252c650fea3dd
-	source_i686 = Zotero-9.0.6_linux_i686.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-i686&version=9.0.6
-	sha256sums_i686 = 2cea60eaabac6df2b02bf84a3c7d0b11c98be3ef7b7793f0585e98d717c26762
-	source_aarch64 = Zotero-9.0.6_linux_arm64.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-arm64&version=9.0.6
-	sha256sums_aarch64 = 5784ebc634387ae6dee1d4abc05ee0f73886c3ce444e2ea0956dd9f2972b4ec6
+	source_x86_64 = Zotero-10.0_linux_x86_64.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-x86_64&version=10.0
+	sha256sums_x86_64 = fad10b2bee0b6178248a0ffb7b4add0bc2b1e71088f47d5549423e1cc80034b8
+	source_i686 = Zotero-10.0_linux_i686.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-i686&version=10.0
+	sha256sums_i686 = bcd76a17b57237fb48aa5f7831131fc6cbf3a5b2de1f3f5c328977c5fa369863
+	source_aarch64 = Zotero-10.0_linux_arm64.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-arm64&version=10.0
+	sha256sums_aarch64 = 3ef4eece2d4ee8db82e44cc203e41638824d3e8587b99f0b509efd2053e97c3a
 
 pkgname = zotero-bin

Comment

The change only bumps pkgver from 9.0.6 to 10.0 and updates the expected SHA-256 checksums for the upstream Zotero release tarballs on the official zotero.org download endpoint. The source URLs remain HTTPS and point to the vendor’s download site, with no new build-time code execution, no added scripts, and no packaging/persistence changes. The package still installs a prebuilt upstream binary as before; this diff does not introduce additional supply-chain or privilege-escalation risk beyond the normal trust in the upstream release artifact.

@@ -3,7 +3,7 @@
 # Contributor: Matthias Kurz <m.kurz@irregular.at>
 
 pkgname=zotero-bin
-pkgver=9.0.6
+pkgver=10.0
 pkgrel=1
 pkgdesc="Zotero Standalone. Is a free, easy-to-use tool to help you collect, organize, cite, and share your research sources."
 arch=('x86_64' 'i686' 'aarch64')

Comment

The change only updates pkgver from 9.0.6 to 10.0 and refreshes the corresponding SHA-256 checksums for the upstream Zotero release tarballs on zotero.org. The source URLs remain HTTPS and point to the official upstream download endpoint, with no new build-time code execution, no added scripts, and no packaging/persistence changes. This is a routine version bump with integrity metadata updates only.

@@ -14,9 +14,9 @@ provides=('zotero')
 conflicts=('zotero')
 
 sha256sums=('f727308716741cf9746b92047b890c3f76c4b8b010bc5ed21b5cdb1be85e21e9')
-sha256sums_x86_64=('0db6e8f94bd0d84e862e6ef5c3e217030e173c0cd3c6dfbc836252c650fea3dd')
-sha256sums_i686=('2cea60eaabac6df2b02bf84a3c7d0b11c98be3ef7b7793f0585e98d717c26762')
-sha256sums_aarch64=('5784ebc634387ae6dee1d4abc05ee0f73886c3ce444e2ea0956dd9f2972b4ec6')
+sha256sums_x86_64=('fad10b2bee0b6178248a0ffb7b4add0bc2b1e71088f47d5549423e1cc80034b8')
+sha256sums_i686=('bcd76a17b57237fb48aa5f7831131fc6cbf3a5b2de1f3f5c328977c5fa369863')
+sha256sums_aarch64=('3ef4eece2d4ee8db82e44cc203e41638824d3e8587b99f0b509efd2053e97c3a')
 source=("zotero.desktop")
 source_x86_64=("Zotero-${pkgver}_linux_x86_64.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-x86_64&version=${pkgver}")
 source_i686=("Zotero-${pkgver}_linux_i686.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-i686&version=${pkgver}")