Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.43.3.10896 to 1.43.4.10903. No sources, checksums, build logic, install scripts, or permissions are modified in the reviewed diff, so there is no direct security impact visible here. I did not see any new integrity or execution red flags in this change alone.

@@ -1,6 +1,6 @@
 pkgbase = plex-media-server-plexpass
 	pkgdesc = The back-end media server component of Plex.
-	pkgver = 1.43.3.10896
+	pkgver = 1.43.4.10903
 	pkgrel = 1
 	url = https://plex.tv/
 	install = plex-media-server.install

Comment

The change is a straightforward version bump in .SRCINFO, updating Plex download URLs and checksums for all architectures. The sources remain HTTPS and still point to the official Plex download domain, with no new build-time code, scripts, or packaging logic introduced. I do note that this package ships prebuilt upstream binaries, so trust is still entirely in Plex and the updated checksums, but this diff itself does not add any new security concern beyond the existing risk profile.

@@ -27,13 +27,13 @@ pkgbase = plex-media-server-plexpass
 	sha256sums = c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557
 	sha256sums = b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad
 	sha256sums = 7bb97271eb2dc5d1dcb95f9763f505970d234df17f1b8d79b467b9020257915a
-	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10896-cb3ebc72d/redhat/plexmediaserver-1.43.3.10896-cb3ebc72d.x86_64.rpm
-	sha256sums_x86_64 = ea678ff32fc7d42f9105d28ada1495f00ef5139c05550f37a68bacfefe1f4c31
-	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10896-cb3ebc72d/redhat/plexmediaserver-1.43.3.10896-cb3ebc72d.i686.rpm
-	sha256sums_i686 = 565394c842ca75c171e89ed753d1fb15db5855e60d6bd467afd5ae6561e0e361
-	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.3.10896-cb3ebc72d/debian/plexmediaserver_1.43.3.10896-cb3ebc72d_armhf.deb
-	sha256sums_armv7h = 59a8f5ee5bcb64b8827e1d759855d5eca35b2f76eb8055df75cbbc3d01f09567
-	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10896-cb3ebc72d/debian/plexmediaserver_1.43.3.10896-cb3ebc72d_arm64.deb
-	sha256sums_aarch64 = 2a7ad1306795d391551d778eec21e6426fcfefd95f0bb288771611f62d8e7d2d
+	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/redhat/plexmediaserver-1.43.4.10903-e5521bd8c.x86_64.rpm
+	sha256sums_x86_64 = 391598ee0e495794ad60a596eb7386435d4ce4bf5ff8e922cf1f686bee91467b
+	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/redhat/plexmediaserver-1.43.4.10903-e5521bd8c.i686.rpm
+	sha256sums_i686 = 51bb10dfedd829f6fd067e5ba62dd94e49f138f2b22dcff962b2c5eeac3fb726
+	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/debian/plexmediaserver_1.43.4.10903-e5521bd8c_armhf.deb
+	sha256sums_armv7h = 908f716cebaf053500427ff132e56b59f4a69bfda5da927e8439bbf009cb1212
+	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/debian/plexmediaserver_1.43.4.10903-e5521bd8c_arm64.deb
+	sha256sums_aarch64 = 945e86d0514f61492b5169bbeac6e91892b336f6895d78632bec017b5908e5ab
 
 pkgname = plex-media-server-plexpass

Comment

The change is a routine version bump in PKGBUILD: pkgver and the corresponding upstream checksum fragment were updated, with no new sources, scripts, install hooks, permissions changes, or build logic modifications. Based on the provided diff, there are no obvious supply-chain or packaging security concerns introduced by this change.

@@ -13,8 +13,8 @@
 # Based on the plex-media-server package by Maxime Gauduin.
 
 pkgname=plex-media-server-plexpass
-pkgver=1.43.3.10896
-_pkgsum=cb3ebc72d
+pkgver=1.43.4.10903
+_pkgsum=e5521bd8c
 pkgrel=1
 pkgdesc='The back-end media server component of Plex.'
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')

Comment

The change only updates the package version, upstream build identifier, and the expected SHA-256 checksums for the architecture-specific source artifacts. No new sources, URLs, scripts, install hooks, permissions changes, or build logic were introduced. The package still fetches from the official Plex download domain over HTTPS, and the diff does not add any suspicious execution or persistence behavior. Security impact is limited to integrity metadata refresh for a new upstream release.

@@ -43,10 +43,10 @@ sha256sums=('b7f2fb1cbedde54a79a1794ec9f35f8bdeb033a4c5453ec77944ca7fe77cd9b7'
             'c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557'
             'b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad'
             '7bb97271eb2dc5d1dcb95f9763f505970d234df17f1b8d79b467b9020257915a')
-sha256sums_x86_64=('ea678ff32fc7d42f9105d28ada1495f00ef5139c05550f37a68bacfefe1f4c31')
-sha256sums_i686=('565394c842ca75c171e89ed753d1fb15db5855e60d6bd467afd5ae6561e0e361')
-sha256sums_armv7h=('59a8f5ee5bcb64b8827e1d759855d5eca35b2f76eb8055df75cbbc3d01f09567')
-sha256sums_aarch64=('2a7ad1306795d391551d778eec21e6426fcfefd95f0bb288771611f62d8e7d2d')
+sha256sums_x86_64=('391598ee0e495794ad60a596eb7386435d4ce4bf5ff8e922cf1f686bee91467b')
+sha256sums_i686=('51bb10dfedd829f6fd067e5ba62dd94e49f138f2b22dcff962b2c5eeac3fb726')
+sha256sums_armv7h=('908f716cebaf053500427ff132e56b59f4a69bfda5da927e8439bbf009cb1212')
+sha256sums_aarch64=('945e86d0514f61492b5169bbeac6e91892b336f6895d78632bec017b5908e5ab')
 
 prepare() {
   if [[ $CARCH = armv7h ]] || [[ $CARCH = aarch64 ]]; then