Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 0.10.0 to 0.11.0. No sources, checksums, build steps, dependencies, install scripts, or permissions are altered in the provided hunk, so there is no direct security signal in this change alone. I did not identify any integrity or execution red flags from the diff shown.

@@ -1,6 +1,6 @@
 pkgbase = fvs2
 	pkgdesc = Standalone CLI for FVS v2
-	pkgver = 0.10.0
+	pkgver = 0.11.0
 	pkgrel = 1
 	url = https://github.com/fvs-lab/fvs2
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: both source URLs remain HTTPS and point to the official GitHub repositories, with updated tag-pinned tarballs and matching new SHA-256 checksums. No new build steps, scripts, binaries, or privilege-related metadata were introduced in this diff. Based on the provided hunk alone, there are no obvious supply-chain or packaging security concerns.

@@ -8,9 +8,9 @@ pkgbase = fvs2
 	license = MIT
 	makedepends = go
 	depends = glibc
-	source = fvs2-0.10.0.tar.gz::https://github.com/fvs-lab/fvs2/archive/refs/tags/v0.10.0.tar.gz
-	source = core-0.1.2.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v0.1.2.tar.gz
-	sha256sums = 3006cb5a221e5e46bdfc4c3dc31fed74a4ffbfd63ae0d7f2fdcfbc9311048f80
-	sha256sums = 188a681bf3d8f8d1c395bd6080fefac0016702efdd12b2fc8c3bfd717f3da884
+	source = fvs2-0.11.0.tar.gz::https://github.com/fvs-lab/fvs2/archive/refs/tags/v0.11.0.tar.gz
+	source = core-0.1.3.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v0.1.3.tar.gz
+	sha256sums = 1dc0c1cf3343f7ef69f48f2f08bec31d4994f714f87a6c09f157be8e4144e7fa
+	sha256sums = 070b9961fbb5b9ab8b51be4b8fe7c7c7119c97054be82cdd55889a68b2aacd59
 
 pkgname = fvs2

Comment

The change only bumps the package and core dependency versions and updates the corresponding source checksums. The sources are still fetched over HTTPS from the official GitHub repositories, there are no new build steps, no added scripts, and no packaging/persistence red flags in the diff. Risk is low because this is a routine version update with integrity hashes adjusted accordingly.

@@ -1,9 +1,9 @@
 # Maintainer: w568w <w568w at outlook dot com>
 
-_corever=0.1.2
+_corever=0.1.3
 
 pkgname=fvs2
-pkgver=0.10.0
+pkgver=0.11.0
 pkgrel=1
 pkgdesc='Standalone CLI for FVS v2'
 arch=('x86_64' 'aarch64')

Comment

The change only bumps pkgver/_corever and updates the corresponding SHA-256 checksums for the two HTTPS GitHub release tarballs. No new sources, no build-script logic changes, no network-at-build additions, and no install/systemd/persistence artifacts are introduced in this diff. Based on the provided hunk, this is a routine version update with no evident security impact.

@@ -15,8 +15,8 @@ source=(
   "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
   "core-${_corever}.tar.gz::https://github.com/fvs-lab/core/archive/refs/tags/v${_corever}.tar.gz"
 )
-sha256sums=('3006cb5a221e5e46bdfc4c3dc31fed74a4ffbfd63ae0d7f2fdcfbc9311048f80'
-            '188a681bf3d8f8d1c395bd6080fefac0016702efdd12b2fc8c3bfd717f3da884')
+sha256sums=('1dc0c1cf3343f7ef69f48f2f08bec31d4994f714f87a6c09f157be8e4144e7fa'
+            '070b9961fbb5b9ab8b51be4b8fe7c7c7119c97054be82cdd55889a68b2aacd59')
 
 prepare() {
   local builddir="$srcdir/$pkgname-$pkgver"