Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 5.1.0 to 5.1.1, with the source URL and checksum updated accordingly. No new sources, scripts, install hooks, or packaging behavior are introduced by this diff. The source remains an HTTPS GitHub release tarball, and there are no signs of added persistence, privilege escalation, or build-time code execution in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = sabnzbd
 	pkgdesc = A web-interface based binary newsgrabber with NZB file support
-	pkgver = 5.1.0
+	pkgver = 5.1.1
 	pkgrel = 1
 	url = http://www.sabnzbd.org
 	install = sabnzbd.install

Comment

The change is a straightforward version bump in .SRCINFO from SABnzbd 5.1.0 to 5.1.1 with the corresponding source tarball checksum update. The source remains an HTTPS GitHub release asset, there are no new sources, scripts, or packaging directives introduced, and no signs of privilege escalation or build-time network abuse in this diff. Risk is minimal.

@@ -48,12 +48,12 @@ pkgbase = sabnzbd
 	optdepends = python-orjson: ~2x faster than ujson, requires rust
 	optdepends = par2cmdline-turbo: a faster par2cmdline fork
 	backup = var/lib/sabnzbd/sabnzbd.ini
-	source = https://github.com/sabnzbd/sabnzbd/releases/download/5.1.0/SABnzbd-5.1.0-src.tar.gz
+	source = https://github.com/sabnzbd/sabnzbd/releases/download/5.1.1/SABnzbd-5.1.1-src.tar.gz
 	source = sabnzbd.service
 	source = sabnzbd@.service
 	source = sabnzbd.sysusers
 	source = sabnzbd.tmpfiles
-	sha256sums = fde3e836dd037cf96366310bd8df8d121026f8ddb956adb897ee37a633b056f8
+	sha256sums = 134fa126635c6cc154737fd4ce058fcd52af00fb59347f573064513f12370412
 	sha256sums = 5dc8b69f1cc88fa8a37e16585e6c61243745e3ac21c8d331f98a7012a86d6e7a
 	sha256sums = fcc4e5a9ff4bc28cf4dd9fdb28f1ebd440669e630d8677a1afbef97349ac7466
 	sha256sums = 525f294372963fde09db08b0368c80078a16d4cefcb34f8179706336709afdf7

Comment

The change is a routine version bump from 5.1.0 to 5.1.1 with the corresponding source checksum update. No new sources, build steps, install scripts, permissions changes, or other security-relevant packaging logic were introduced in the provided diff hunk. Based on this change alone, I found no evidence of supply-chain risk or malicious behavior.

@@ -1,7 +1,7 @@
 # Maintainer: Donald Webster <fryfrog@gmail.com>
 
 pkgname=sabnzbd
-pkgver=5.1.0
+pkgver=5.1.1
 pkgrel=1
 pkgdesc='A web-interface based binary newsgrabber with NZB file support'
 url='http://www.sabnzbd.org'

Comment

The change is a straightforward version bump from 5.1.0 to 5.1.1 with an updated SHA256 for the upstream release tarball. No new sources, scripts, patches, or packaging logic were introduced, and the existing PKGBUILD still only installs files into $pkgdir. The source remains an HTTPS GitHub release URL and the systemd/sysusers/tmpfiles artifacts are unchanged from the prior revision. I do note the package URL is still HTTP, but that predates this change and is not part of the diff under review. Overall this diff does not introduce a security concern.

@@ -66,7 +66,7 @@ source=(
   'sabnzbd.tmpfiles'
 )
         
-sha256sums=('fde3e836dd037cf96366310bd8df8d121026f8ddb956adb897ee37a633b056f8'
+sha256sums=('134fa126635c6cc154737fd4ce058fcd52af00fb59347f573064513f12370412'
             '5dc8b69f1cc88fa8a37e16585e6c61243745e3ac21c8d331f98a7012a86d6e7a'
             'fcc4e5a9ff4bc28cf4dd9fdb28f1ebd440669e630d8677a1afbef97349ac7466'
             '525f294372963fde09db08b0368c80078a16d4cefcb34f8179706336709afdf7'