Review Results

Comment

The change only bumps pkgver in .SRCINFO from 12.3.1 to 12.4.0. No source URLs, checksums, build steps, install scripts, or packaging permissions are altered in the reviewed diff, so there is no direct security concern visible here. Any risk would depend on the corresponding PKGBUILD/source update, which is outside this single-hunk change.

@@ -1,6 +1,6 @@
 pkgbase = gitkraken
 	pkgdesc = The intuitive, fast, and beautiful cross-platform Git client.
-	pkgver = 12.3.1
+	pkgver = 12.4.0
 	pkgrel = 1
 	url = https://www.gitkraken.com/
 	arch = x86_64

Comment

The change is a routine version bump in .SRCINFO from GitKraken 12.3.1 to 12.4.0, updating the x86_64 and aarch64 release tarball URLs and their corresponding SHA-256 checksums. The sources remain HTTPS on the official GitKraken release API, there are no new build-time commands, scripts, or packaging changes, and no integrity red flags are introduced by this metadata-only update. Risk is minimal.

@@ -23,9 +23,9 @@ pkgbase = gitkraken
 	sha256sums = 4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e
 	sha256sums = 4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a
 	sha256sums = 5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6
-	source_x86_64 = gitkraken-12.3.1-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/12.3.1/gitkraken-amd64.tar.gz
-	sha256sums_x86_64 = 377f3b94ff1df9225906bc8134d505b14c1e6be82dea07463e14a62439b3319d
-	source_aarch64 = gitkraken-12.3.1-aarch64.tar.gz::https://api.gitkraken.dev/releases/production/linux/arm64/12.3.1/gitkraken-aarch64.tar.gz
-	sha256sums_aarch64 = 604cde7640a2375f47ad805d82e16ddbc67902517148bdd27892de09ffa78c05
+	source_x86_64 = gitkraken-12.4.0-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/12.4.0/gitkraken-amd64.tar.gz
+	sha256sums_x86_64 = 7f7e56b5bf345c1da3bcc3ff4f50bf51bf8292399f471e5c5bc2213bfafefb4d
+	source_aarch64 = gitkraken-12.4.0-aarch64.tar.gz::https://api.gitkraken.dev/releases/production/linux/arm64/12.4.0/gitkraken-aarch64.tar.gz
+	sha256sums_aarch64 = 66d6d7cc158187074afd0d6933a1636a7c15c14f9c0404e7c45599f3c9cad3e9
 
 pkgname = gitkraken

Comment

The change is a straightforward version bump in PKGBUILD from 12.3.1 to 12.4.0, with updated architecture-specific checksums. No new sources, scripts, install hooks, privilege changes, or build-time network behavior were introduced in the diff. Based on the provided hunk alone, this does not present an obvious security concern beyond the usual need to trust the new upstream release artifacts.

@@ -12,7 +12,7 @@
 
 pkgname=gitkraken
 pkgrel=1
-pkgver=12.3.1
+pkgver=12.4.0
 pkgdesc="The intuitive, fast, and beautiful cross-platform Git client."
 url="https://www.gitkraken.com/"
 provides=('gitkraken')

Comment

The change only updates the package version and the pinned SHA-256 checksums for the upstream release tarballs on x86_64 and aarch64. The source URLs remain HTTPS and point to the official GitKraken release API, with no new scripts, build steps, install hooks, or packaging behavior changes. I do not see any added supply-chain, persistence, or privilege-escalation risk in this diff alone.

@@ -36,8 +36,8 @@ sha256sums=('af2d2e5a44ec6e543c34f94cfb89fe34b6c05d2baf6ca9db5b6d332e4a5686e5'
             '4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e'
             '4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a'
             '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6')
-sha256sums_x86_64=('377f3b94ff1df9225906bc8134d505b14c1e6be82dea07463e14a62439b3319d')
-sha256sums_aarch64=('604cde7640a2375f47ad805d82e16ddbc67902517148bdd27892de09ffa78c05')
+sha256sums_x86_64=('7f7e56b5bf345c1da3bcc3ff4f50bf51bf8292399f471e5c5bc2213bfafefb4d')
+sha256sums_aarch64=('66d6d7cc158187074afd0d6933a1636a7c15c14f9c0404e7c45599f3c9cad3e9')
 options=('!strip' '!debug')
 
 package() {