Review Results

Comment

The change only bumps pkgver in .SRCINFO from 0.25.2 to 0.25.3. No sources, checksums, build logic, install scripts, or packaging metadata affecting execution/privileges were changed in the provided diff. On its face this is a routine version update with no security-relevant behavior introduced by the diff itself.

@@ -1,6 +1,6 @@
 pkgbase = freetube
 	pkgdesc = An open source desktop YouTube player built with privacy in mind.
-	pkgver = 0.25.2
+	pkgver = 0.25.3
 	pkgrel = 1
 	url = https://freetubeapp.io
 	arch = x86_64

Comment

The change only bumps the upstream release tarball from v0.25.2-beta to v0.25.3-beta and updates the corresponding SHA-256 in .SRCINFO. The source remains an HTTPS GitHub release archive, there are no new sources, no build-script changes, and no added install-time or privilege-related behavior in the reviewed diff. On its face this is a routine version/hash refresh with no security red flags in the .SRCINFO change itself.

@@ -12,10 +12,10 @@ pkgbase = freetube
 	license = AGPL-3.0-or-later
 	makedepends = pnpm
 	depends = electron42
-	source = https://github.com/FreeTubeApp/FreeTube/archive/v0.25.2-beta.tar.gz
+	source = https://github.com/FreeTubeApp/FreeTube/archive/v0.25.3-beta.tar.gz
 	source = freetube.desktop
 	source = freetube.sh
-	sha256sums = 1a90edfdd97e305f2701a05e6bf3a35de76d8cb5a3b9826376c4faa2aec0335c
+	sha256sums = 70fdf96406ca699d1919d189efe8e8ec901c88a6721e40a4cce6770ffbc3409b
 	sha256sums = ada2b4b8f6a1e8896acbce4f4d311228d2c86026c273ffa00afa3247294f8b1e
 	sha256sums = 1b202a62d3ba821df518926bdea76f6a4532f6c30a5c21d44cb9b9b374e543f7
 

Comment

Low risk change: this is a routine version bump in PKGBUILD from 0.25.2 to 0.25.3 with the corresponding source checksum update. The source remains an HTTPS GitHub release tarball, there are no new build-time commands, no added scripts, and no packaging/persistence changes. I did not see any supply-chain red flags in the provided diff.

@@ -3,7 +3,7 @@
 
 pkgname=freetube
 _pkgname=FreeTube
-pkgver=0.25.2
+pkgver=0.25.3
 _electron=electron42
 pkgrel=1
 pkgdesc='An open source desktop YouTube player built with privacy in mind.'

Comment

The change is a routine version bump from 0.25.2 to 0.25.3 with a corresponding SHA-256 checksum update for the upstream GitHub release tarball. The source remains an HTTPS GitHub archive URL, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in the diff. No security red flags are introduced by this hunk alone.

@@ -15,7 +15,7 @@ url=https://freetubeapp.io
 source=(https://github.com/FreeTubeApp/FreeTube/archive/v$pkgver-beta.tar.gz
         freetube.desktop
         freetube.sh)
-sha256sums=('1a90edfdd97e305f2701a05e6bf3a35de76d8cb5a3b9826376c4faa2aec0335c'
+sha256sums=('70fdf96406ca699d1919d189efe8e8ec901c88a6721e40a4cce6770ffbc3409b'
             'ada2b4b8f6a1e8896acbce4f4d311228d2c86026c273ffa00afa3247294f8b1e'
             '1b202a62d3ba821df518926bdea76f6a4532f6c30a5c21d44cb9b9b374e543f7')