Review Results

Comment

The change only bumps pkgver in .SRCINFO from 3.19.5 to 3.20.0. No build logic, sources, checksums, install scripts, or permissions are altered in the reviewed hunk, so there is no direct security impact visible here. I did not identify any new integrity or execution risk from this metadata-only version update alone.

@@ -1,6 +1,6 @@
 pkgbase = unityhub
 	pkgdesc = The Unity Hub is a standalone application that streamlines the way you find, download, and manage your Unity Projects and installations.
-	pkgver = 3.19.5
+	pkgver = 3.20.0
 	pkgrel = 1
 	url = https://unity.com/
 	install = unityhub.install

Comment

The change is a straightforward version bump in .SRCINFO: it updates the Unity Hub Debian package URL from 3.19.5 to 3.20.0 and refreshes the corresponding SHA-256 checksum. The source remains HTTPS on the official Unity domain, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Based on the provided hunk alone, this is low risk.

@@ -24,10 +24,10 @@ pkgbase = unityhub
 	optdepends = libappindicator-gtk3: The official deb says this an optional dependency
 	conflicts = unityhub-beta
 	options = !strip
-	source = unityhub-3.19.5.deb::https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/UnityHubSetup-3.19.5-amd64.deb
+	source = unityhub-3.20.0.deb::https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/unityhub_3.20.0_amd64.deb
 	source = license.txt
 	source = services-config.json
-	sha256sums = 5a5b57adc9ce20931c4154c57ffded08f3ffa2743286fdf14c9e7add6b212540
+	sha256sums = 22303da6cd88026011016dd8fe2de01cbb41d630650a7448123e616680999d54
 	sha256sums = f0eb3a4bb148bb7f426e4f5b97e891265ac487710cbcba9282518537c7b5d833
 	sha256sums = 557964a3528219723750a7eabeb2e31a2d3e1b2c4a4b2e201b32d4035200562e
 

Comment

The change is a routine version bump for a binary package, with the source URL updated to the upstream Unity-hosted .deb and the checksum refreshed. I do not see any new build-time code execution, install-script changes, privilege escalation, or suspicious extra sources in this diff. The package still downloads a prebuilt upstream binary, but that was already the case and the source remains HTTPS and vendor-controlled. No additional security concerns are introduced by this hunk.

@@ -4,7 +4,7 @@
 # Contributor: Marius Glo <marius@mgl.dev>
 
 pkgname=unityhub
-pkgver=3.19.5
+pkgver=3.20.0
 pkgrel=1
 pkgdesc="The Unity Hub is a standalone application that streamlines the way you find, download, and manage your Unity Projects and installations."
 url="https://unity.com/"

Comment

The change only updates the upstream UnityHub .deb download URL and its checksum to a different official path/name. The source remains HTTPS on the vendor domain, there is no new build-time code execution, no added network fetch outside source=(), and no packaging logic changes. I don’t see any integrity or persistence red flags in this diff alone.

@@ -15,12 +15,12 @@ optdepends=(
   'libappindicator-gtk3: The official deb says this an optional dependency'
 )
 source=(
-  "$pkgname-$pkgver.deb::https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/UnityHubSetup-$pkgver-amd64.deb"
+  "$pkgname-$pkgver.deb::https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/unityhub_${pkgver}_amd64.deb"
   'license.txt'
   'services-config.json'
 )
 sha256sums=(
-  '5a5b57adc9ce20931c4154c57ffded08f3ffa2743286fdf14c9e7add6b212540'
+  '22303da6cd88026011016dd8fe2de01cbb41d630650a7448123e616680999d54'
   'f0eb3a4bb148bb7f426e4f5b97e891265ac487710cbcba9282518537c7b5d833'
   '557964a3528219723750a7eabeb2e31a2d3e1b2c4a4b2e201b32d4035200562e'
 )