Review Results

Comment

The change only bumps pkgver from 9.0 to 9.0.1 and resets pkgrel from 2 to 1 in .SRCINFO. No sources, build logic, install scripts, permissions, or dependencies are altered, and there are no new integrity or execution red flags visible in this diff. This is a routine metadata update with negligible security impact.

@@ -1,7 +1,7 @@
 pkgbase = ffmpeg-full
 	pkgdesc = Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)
-	pkgver = 9.0
-	pkgrel = 2
+	pkgver = 9.0.1
+	pkgrel = 1
 	url = https://ffmpeg.org/
 	arch = x86_64
 	license = LicenseRef-nonfree-and-unredistributable

Comment

The change is a straightforward upstream version bump in .SRCINFO from ffmpeg 9.0 to 9.0.1, with the source URLs remaining on the official HTTPS ffmpeg.org release host and the accompanying signature file updated accordingly. No new sources, scripts, build steps, or packaging metadata were introduced, and there is no indication of a supply-chain or persistence risk in this diff hunk alone.

@@ -153,8 +153,8 @@ pkgbase = ffmpeg-full
 	provides = libswscale.so
 	provides = libswresample.so
 	conflicts = ffmpeg
-	source = https://ffmpeg.org/releases/ffmpeg-9.0.tar.xz
-	source = https://ffmpeg.org/releases/ffmpeg-9.0.tar.xz.asc
+	source = https://ffmpeg.org/releases/ffmpeg-9.0.1.tar.xz
+	source = https://ffmpeg.org/releases/ffmpeg-9.0.1.tar.xz.asc
 	source = git+https://github.com/lensfun/lensfun.git
 	source = https://github.com/ggml-org/whisper.cpp/archive/v1.9.2/whisper.cpp-1.9.2.tar.gz
 	source = 010-ffmpeg-add-svt-hevc.patch

Comment

The change is limited to .SRCINFO metadata for a version bump from ffmpeg 9.0 to 9.0.1 and the corresponding source checksum update. The source URLs remain HTTPS and point to the official ffmpeg release site, with no new build-time code execution, no added network fetches, and no suspicious install/persistence behavior introduced by this metadata-only change. I see no security issue in the diff itself.

@@ -165,7 +165,7 @@ pkgbase = ffmpeg-full
 	source = 060-ffmpeg-whisper.cpp-fix-pkgconfig.patch
 	source = LICENSE
 	validpgpkeys = FCF986EA15E6E293A5644F10B4322F04D67658D8
-	sha256sums = 7f607a00dd0d28a729d5a4811205812eef01cf6ef6155025febb6f36a9062d52
+	sha256sums = cf38e0e28c7e5605942c4a77755349b0145804a397af37eb1fb4c77cb237f635
 	sha256sums = SKIP
 	sha256sums = SKIP
 	sha256sums = a6abd064fcca8b85e794d205abf328c522e9451db43a3eadc178b883b7d0e9cd

Comment

The change is a straightforward version bump in PKGBUILD from 9.0-2 to 9.0.1-1 with no added sources, build logic, install scripts, or packaging behavior changes. I do not see any new integrity, persistence, privilege-escalation, or network-fetch risks introduced by this diff hunk alone.

@@ -2,8 +2,8 @@
 # Contributor: Iacopo Isimbaldi <isiachi@rhye.it>
 
 pkgname=ffmpeg-full
-pkgver=9.0
-pkgrel=2
+pkgver=9.0.1
+pkgrel=1
 _svt_hevc_ver='4181c9ee0611baefb40b4c0ed10023cfd837d522'
 _whispercpp_ver='1.9.2'
 pkgdesc='Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)'

Comment

The change is a routine upstream version bump from ffmpeg 9.0 to 9.0.1 with the corresponding source tarball checksum update. I do not see any new sources, build-time network fetches, privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. The remaining sources are unchanged and still use HTTPS with pinned checksums/commits where applicable. Risk is low.

@@ -172,7 +172,7 @@ source=("https://ffmpeg.org/releases/ffmpeg-${pkgver}.tar.xz"{,.asc}
         '050-ffmpeg-fix-cuda-nvcc-with-gcc14.patch'
         '060-ffmpeg-whisper.cpp-fix-pkgconfig.patch'
         'LICENSE')
-sha256sums=('7f607a00dd0d28a729d5a4811205812eef01cf6ef6155025febb6f36a9062d52'
+sha256sums=('cf38e0e28c7e5605942c4a77755349b0145804a397af37eb1fb4c77cb237f635'
             'SKIP'
             'SKIP'
             'a6abd064fcca8b85e794d205abf328c522e9451db43a3eadc178b883b7d0e9cd'