Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the Oracle VirtualBox Extension Pack, updating the package version, dependency pin, noextract filename, source URL, and checksum from 7.2.14 to 7.2.16. The source remains on the official HTTPS VirtualBox download host, and there are no new scripts, patches, install hooks, or build-time execution paths introduced by this diff. No integrity or persistence red flags are present in the reviewed hunk.

@@ -1,15 +1,15 @@
 pkgbase = virtualbox-ext-oracle
 	pkgdesc = Oracle VM VirtualBox Extension Pack
-	pkgver = 7.2.14
+	pkgver = 7.2.16
 	pkgrel = 1
 	url = https://www.virtualbox.org/
 	arch = x86_64
 	license = custom:PUEL
-	depends = virtualbox=7.2.14
+	depends = virtualbox=7.2.16
 	optdepends = rdesktop: client to connect vm via RDP
-	noextract = Oracle_VirtualBox_Extension_Pack-7.2.14.vbox-extpack
+	noextract = Oracle_VirtualBox_Extension_Pack-7.2.16.vbox-extpack
 	options = !strip
-	source = https://download.virtualbox.org/virtualbox/7.2.14/Oracle_VirtualBox_Extension_Pack-7.2.14.vbox-extpack
-	sha256sums = ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d
+	source = https://download.virtualbox.org/virtualbox/7.2.16/Oracle_VirtualBox_Extension_Pack-7.2.16.vbox-extpack
+	sha256sums = d1e268cfa05223fd651703043af09f39dfb90da259ce9ec093d9d9b022f19689
 
 pkgname = virtualbox-ext-oracle

Comment

The change is a routine version bump in PKGBUILD from VirtualBox Extension Pack 7.2.14 to 7.2.16, with the source URL still using HTTPS from Oracle's official download host and the checksum updated accordingly. No new build steps, scripts, privilege changes, or additional sources were introduced. Based on the provided diff, this is low risk.

@@ -2,7 +2,7 @@
 # Maintainer: Christian Hesse <mail@eworm.de>
 
 pkgname=virtualbox-ext-oracle
-pkgver=7.2.14
+pkgver=7.2.16
 _filever="${pkgver}"
 pkgrel=1
 pkgdesc='Oracle VM VirtualBox Extension Pack'

Comment

The change only updates the SHA-256 checksum for the upstream Oracle VirtualBox Extension Pack download while keeping the source URL unchanged and HTTPS-based. There are no new build steps, scripts, network fetches, privilege changes, or packaging behavior changes. This appears to be a routine integrity hash refresh for a new upstream release, with no security red flags in the diff itself.

@@ -14,7 +14,7 @@ optdepends=('rdesktop: client to connect vm via RDP')
 options=('!strip')
 source=("https://download.virtualbox.org/virtualbox/${_filever}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
 noextract=("Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
-sha256sums=('ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d')
+sha256sums=('d1e268cfa05223fd651703043af09f39dfb90da259ce9ec093d9d9b022f19689')
 
 prepare() {
   mkdir Oracle_VirtualBox_Extension_Pack/