Review Results

Comment

The change is a straightforward upstream version/runtime dependency update in .SRCINFO: it switches the prebuilt x86_64 source tarball from a Qt5 build to a Qt6 build, updates the corresponding checksum, and adjusts dependencies to qt6 packages with an optional qt6-wayland dependency. There are no new build-time downloads, scripts, privilege changes, install hooks, or suspicious extra sources introduced by this diff. The package still relies on an upstream-hosted binary tarball, but that was already the case; this change does not materially worsen the supply-chain risk beyond the existing trust in the vendor release and checksum pinning.

@@ -1,18 +1,19 @@
 pkgbase = masterpdfeditor
 	pkgdesc = A complete solution for viewing, creating and editing PDF files
 	pkgver = 5.9.99
-	pkgrel = 3
+	pkgrel = 4
 	url = https://code-industry.net/free-pdf-editor/
 	arch = x86_64
 	license = custom
 	makedepends = patchelf
-	source_x86_64 = https://code-industry.net/public/master-pdf-editor-5.9.99-qt5.x86_64.tar.gz
-	sha1sums_x86_64 = bf84fca45c8e416f959b9667a21baf45d87e0f39
+	source_x86_64 = https://code-industry.net/public/master-pdf-editor-5.9.99-qt6.11.1.x86_64.tar.gz
+	sha1sums_x86_64 = f6e09030bca6bc16bebb34a494e90b63ab5df484
 
 pkgname = masterpdfeditor
 	depends = libgl
 	depends = pkcs11-helper
-	depends = qt5-base
-	depends = qt5-svg
-	depends = qt5-declarative
+	depends = qt6-base
+	depends = qt6-svg
+	depends = qt6-declarative
 	depends = sane
+	optdepends = qt6-wayland: Wayland platform plugin

Comment

High-confidence supply-chain/integrity regression. The PKGBUILD now fetches the SHA1 checksum at build time via `curl` from the vendor website instead of pinning it in the source array. That bypasses Arch's checksum verification model and makes the build trust a live network response, which can be altered or fail nondeterministically. The checksum extraction also references `${_patchver}`, which is undefined in this snippet, further weakening reliability. The source URL itself remains HTTPS and on the vendor domain, and the qt5->qt6 dependency update is not inherently suspicious, but the dynamic checksum retrieval is a clear packaging integrity issue.

@@ -6,17 +6,19 @@
 
 pkgname=masterpdfeditor
 pkgver=5.9.99
-pkgrel=3
+pkgrel=4
 pkgdesc='A complete solution for viewing, creating and editing PDF files'
 url='https://code-industry.net/free-pdf-editor/'
 arch=('x86_64')
 license=('custom')
 makedepends=('patchelf')
-source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}-qt5.x86_64.tar.gz")
-sha1sums_x86_64=('bf84fca45c8e416f959b9667a21baf45d87e0f39')
+source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}-qt6.11.1.x86_64.tar.gz")
+_checksum=$(curl 'https://code-industry.net/checksum-information/' | grep -oP '[a-f0-9]{40}(?=.*master-pdf-editor-'"${pkgver}${_patchver}"'-qt6.11.1.x86_64.tar.gz)')
+sha1sums_x86_64=("${_checksum% *}")
 
 package() {
-  depends=('libgl' 'pkcs11-helper' 'qt5-base' 'qt5-svg' 'qt5-declarative' 'sane')
+  depends=('libgl' 'pkcs11-helper' 'qt6-base' 'qt6-svg' 'qt6-declarative' 'sane')
+  optdepends=('qt6-wayland: Wayland platform plugin')
 
   install -d "$pkgdir"{/opt/,/usr/bin/}
   cp -a --no-preserve=ownership master-pdf-editor-${pkgver%%.*} "$pkgdir/opt/"