Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.16.0 to 2.17.0. No source URLs, checksums, build steps, install scripts, permissions, or package metadata beyond the version number are altered here. Based on the provided diff alone, there is no evidence of a security issue introduced by this change.

@@ -1,6 +1,6 @@
 pkgbase = teams-for-linux
 	pkgdesc = Unofficial Microsoft Teams client for Linux using Electron.
-	pkgver = 2.16.0
+	pkgver = 2.17.0
 	pkgrel = 1
 	url = https://github.com/IsmaelMartinez/teams-for-linux
 	arch = aarch64

Comment

The change is a straightforward version bump in .SRCINFO from teams-for-linux 2.16.0 to 2.17.0, with the corresponding source tarball URL and checksum updated. The source remains an HTTPS GitHub release archive from the upstream project, and there are no new build steps, scripts, binaries, or privilege-related artifacts introduced in this diff. Based on the provided hunk alone, this does not add any obvious supply-chain or persistence risk.

@@ -15,9 +15,9 @@ pkgbase = teams-for-linux
 	depends = libxss
 	depends = nss
 	optdepends = libfido2: WebAuthn with FIDO2 devices
-	source = teams-for-linux-2.16.0.tar.gz::https://github.com/IsmaelMartinez/teams-for-linux/archive/v2.16.0.tar.gz
+	source = teams-for-linux-2.17.0.tar.gz::https://github.com/IsmaelMartinez/teams-for-linux/archive/v2.17.0.tar.gz
 	source = teams-for-linux.desktop
-	sha256sums = 616363926dd600458c07c8b810da27f8e6af7cff8c3e8826264af9866001114c
+	sha256sums = 6e2bd12a61a15c1fea796b3b0b0fde043c9476f530ecfcca0de467920b3b2644
 	sha256sums = e67c98084736f797c575970935dd773b5c348ea3d9522bc5db733a92361fc05e
 
 pkgname = teams-for-linux

Comment

The change is a routine version bump in PKGBUILD from 2.16.0 to 2.17.0 with the corresponding source tarball checksum update. The source remains the official GitHub release archive over HTTPS, and there are no new build steps, scripts, privilege changes, or additional sources introduced in this diff. Based on the provided hunk, there are no security red flags.

@@ -3,7 +3,7 @@
 # Contributor: Ivelin Velkov <ivelin dot velkov at gmail dot com>
 
 pkgname=teams-for-linux
-pkgver=2.16.0
+pkgver=2.17.0
 pkgrel=1
 pkgdesc="Unofficial Microsoft Teams client for Linux using Electron."
 arch=("aarch64" "armv7h" "i686" "x86_64")

Comment

The change only updates the upstream release version and the corresponding SHA-256 checksum for the GitHub tarball source. The source remains HTTPS and pinned to a tagged release archive, with no new build steps, scripts, or packaging behavior introduced. No security-relevant red flags are present in this diff.

@@ -16,7 +16,7 @@ source=(
   "${pkgname}-${pkgver}.tar.gz::https://github.com/IsmaelMartinez/${pkgname}/archive/v${pkgver}.tar.gz"
   "${pkgname}.desktop"
 )
-sha256sums=('616363926dd600458c07c8b810da27f8e6af7cff8c3e8826264af9866001114c'
+sha256sums=('6e2bd12a61a15c1fea796b3b0b0fde043c9476f530ecfcca0de467920b3b2644'
             'e67c98084736f797c575970935dd773b5c348ea3d9522bc5db733a92361fc05e')
 
 build() {