Review Results

Comment

The change is a straightforward version bump in .SRCINFO for dxvk-bin, updating the upstream release URL and checksum to match dxvk 3.1.0. No new sources, scripts, install hooks, privilege-related files, or build logic are introduced by this diff. The package still points to the official GitHub release tarball over HTTPS and retains the existing setup script checksum. Based on the provided hunk alone, there are no security red flags.

@@ -1,19 +1,19 @@
 pkgbase = dxvk-bin
 	pkgdesc = A Vulkan-based compatibility layer for Direct3D 9/10/11 which allows running 3D applications on Linux using Wine (Windows DLL binary files)
-	pkgver = 3.0.2
+	pkgver = 3.1.0
 	pkgrel = 1
 	url = https://github.com/doitsujin/dxvk
 	arch = x86_64
 	license = zlib/libpng
 	provides = dxvk
 	provides = d9vk
-	provides = dxvk=3.0.2
+	provides = dxvk=3.1.0
 	conflicts = dxvk
 	conflicts = d9vk
 	options = !strip
-	source = https://github.com/doitsujin/dxvk/releases/download/v3.0.2/dxvk-3.0.2.tar.gz
+	source = https://github.com/doitsujin/dxvk/releases/download/v3.1/dxvk-3.1.tar.gz
 	source = setup_dxvk.sh
-	sha256sums = 9c538924110a7cdef871ca36dee218c0774124374ffdeb38af4b76be55bdf7c2
+	sha256sums = 30f9cc326874be344285582275446968cfa4c069db31ce56df312d6644179154
 	sha256sums = 2ca9ece1b6c36446e9f6955d3d03ab72b173c8f85539a2848febc51b38be705e
 
 pkgname = dxvk-bin

Comment

The change is a straightforward version bump in PKGBUILD: it updates pkgver/_githubver, the upstream release URL, checksum, and the install paths to match the new release tarball layout. I did not find any new execution paths, network fetches outside source=(), privilege changes, or suspicious metadata. The package still pulls from the official upstream GitHub releases over HTTPS and remains a binary package with the same install script and dependencies. Risk is therefore minimal.

@@ -3,7 +3,8 @@
 
 pkgbase=dxvk-bin
 pkgname=('dxvk-bin')
-pkgver=3.0.2
+pkgver=3.1.0
+_githubver=3.1
 pkgrel=1
 pkgdesc="A Vulkan-based compatibility layer for Direct3D 9/10/11 which allows running 3D applications on Linux using Wine (Windows DLL binary files)"
 url="https://github.com/doitsujin/dxvk"

Comment

Low risk. The change only updates the package version and switches the download/extraction path from the full upstream release version (3.1.0) to the corresponding upstream archive naming scheme (3.1), while keeping the source on the official GitHub release URL over HTTPS and preserving checksum verification. No new build-time network fetches, scripts, privilege changes, or install-time persistence mechanisms were introduced. The only notable concern is that the package version and upstream archive version now differ intentionally, but this appears consistent with DXVK's release naming rather than suspicious behavior.

@@ -12,17 +13,17 @@ arch=('x86_64')
 provides=("dxvk" "d9vk" "dxvk=$pkgver")
 conflicts=("dxvk" "d9vk")
 options=(!strip)
-source=("https://github.com/doitsujin/dxvk/releases/download/v$pkgver/dxvk-$pkgver.tar.gz"
+source=("https://github.com/doitsujin/dxvk/releases/download/v$_githubver/dxvk-$_githubver.tar.gz"
 "setup_dxvk.sh"
 )
-sha256sums=('9c538924110a7cdef871ca36dee218c0774124374ffdeb38af4b76be55bdf7c2'
+sha256sums=('30f9cc326874be344285582275446968cfa4c069db31ce56df312d6644179154'
             '2ca9ece1b6c36446e9f6955d3d03ab72b173c8f85539a2848febc51b38be705e')
 
 package_dxvk-bin () {
         depends=('vulkan-icd-loader')
         optdepends=('lib32-vulkan-icd-loader: 32-bit Windows application support')
-        install -D "dxvk-$pkgver"/x32/* -t "$pkgdir/usr/share/dxvk/x32"
-        install -D "dxvk-$pkgver"/x64/* -t "$pkgdir/usr/share/dxvk/x64"
+        install -D "dxvk-$_githubver"/x32/* -t "$pkgdir/usr/share/dxvk/x32"
+        install -D "dxvk-$_githubver"/x64/* -t "$pkgdir/usr/share/dxvk/x64"
         install setup_dxvk.sh -t "$pkgdir/usr/share/dxvk/"
         install -d "$pkgdir/usr/bin"
         ln -s /usr/share/dxvk/setup_dxvk.sh "$pkgdir/usr/bin/setup_dxvk"