Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 3.2.32_52194 to 3.2.33_52892. There are no source URL, checksum, build script, install script, or permission changes in the provided diff, so this update does not introduce any new obvious supply-chain or privilege-escalation risk on its own. Any risk would depend on the corresponding upstream package contents, which are not changed here.

@@ -1,6 +1,6 @@
 pkgbase = linuxqq
 	pkgdesc = New Linux QQ based on Electron
-	pkgver = 3.2.32_52194
+	pkgver = 3.2.33_52892
 	pkgrel = 1
 	epoch = 5
 	url = https://im.qq.com/linuxqq

Comment

The change only updates the upstream .deb source URLs and their corresponding SHA-512 checksums for each architecture. The sources remain HTTPS on the same official qqdl.gtimg.cn host, and the package continues to pin exact release artifacts with matching checksums. No new build-time code, scripts, privileges, or packaging behavior are introduced by this .SRCINFO-only update. Risk is therefore minimal.

@@ -21,11 +21,11 @@ pkgbase = linuxqq
 	options = !debug
 	source = linuxqq.sh
 	sha512sums = bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7
-	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/3f89efc5/linuxqq_3.2.32-52194_amd64.deb
-	sha512sums_x86_64 = 67ed23ebc802d6b2c8f409316eea2e880a71e8ffdaf09bd3d2ac9aeb2dd57efa48ada919e82594948122fa72664512e038665a21ce0b9063e97baeb504deeb9c
-	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/3f89efc5/linuxqq_3.2.32-52194_arm64.deb
-	sha512sums_aarch64 = 0a26b68711ae0055e1dbb8414663be72638f07f3a471cef1cfb5e79d1ced2b09bc15337c12235450c8b3453fd7ef43ae4c03078c8f319a835d1f707dfdc96c28
-	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/3f89efc5/linuxqq_3.2.32-52194_loongarch64.deb
-	sha512sums_loong64 = 99b7fd9400910c993dd97dda294add65e58a2e3e3ff8a3860f60cf8b8a24418c6107ecfefca8f0ba76532ce92d0a9e76c9c66396c8c8a867fa3e8450aca9916c
+	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/1763096b/linuxqq_3.2.33-52892_amd64.deb
+	sha512sums_x86_64 = 8b12141690c38708508627817f40188d23da5e357164a0cdd6395530b9abad88d06da44c36ff85262872eb8bf2995c184c391048f63a004be81284a444ebb53e
+	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/1763096b/linuxqq_3.2.33-52892_arm64.deb
+	sha512sums_aarch64 = 27636f05d56ef2cc21bd5ae45375648cfe2d6ce1ebb7418a8ae0318ae7d61aab44482d276a29552dce374420dbbd9ee66653406e0ddcac0a5f87211a320ea6fc
+	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/1763096b/linuxqq_3.2.33-52892_loongarch64.deb
+	sha512sums_loong64 = dc7cec63e6ec10acfa0e973157d80f28ff46418f51f20626e35103057e68a1bc82f355c267abc2b1dee0a57893814496d13e32085e56afbcbc6e1419b39cbd17
 
 pkgname = linuxqq

Comment

This change is a routine version bump of a binary package. The only substantive edits are updated upstream version strings, download paths, and corresponding SHA-512 checksums for the architecture-specific .deb payloads. The sources remain HTTPS from the same upstream domain, there are no new build-time commands, no install-script changes, and no added persistence or privilege-escalation behavior. Risk is low because the package still relies on upstream-provided binaries, but that was already the case before this diff.

@@ -2,7 +2,7 @@
 # Contributor: Integral <integral@member.fsf.org>
 
 pkgname=linuxqq
-pkgver=3.2.32_52194
+pkgver=3.2.33_52892
 pkgrel=1
 epoch=5
 pkgdesc="New Linux QQ based on Electron"

Comment

The change is a routine upstream version bump in PKGBUILD: it updates the QQNT beta download URLs from 9.9.33 to 9.9.35 and refreshes the corresponding source checksums and prefix. The sources remain HTTPS on the same official qqdl.gtimg.cn host, and there are no new build-time commands, install-script changes, privilege escalations, or additional artifacts introduced in this diff. I do note that this package ships a prebuilt .deb from upstream rather than building from source, so trust is still largely delegated to the vendor, but this specific change does not add any new security red flags beyond that existing packaging model.

@@ -12,16 +12,16 @@ license=('LicenseRef-QQ')
 conflicts=("${pkgname}-nt-bwrap")
 depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
 optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
-_md5_prefix=3f89efc5
+_md5_prefix=1763096b
 _src_prefix="${pkgname}_${pkgver/_/-}"
-source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
-source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
-source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
+source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
+source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
+source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
 source=("${pkgname}.sh")
 sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
-sha512sums_x86_64=('67ed23ebc802d6b2c8f409316eea2e880a71e8ffdaf09bd3d2ac9aeb2dd57efa48ada919e82594948122fa72664512e038665a21ce0b9063e97baeb504deeb9c')
-sha512sums_aarch64=('0a26b68711ae0055e1dbb8414663be72638f07f3a471cef1cfb5e79d1ced2b09bc15337c12235450c8b3453fd7ef43ae4c03078c8f319a835d1f707dfdc96c28')
-sha512sums_loong64=('99b7fd9400910c993dd97dda294add65e58a2e3e3ff8a3860f60cf8b8a24418c6107ecfefca8f0ba76532ce92d0a9e76c9c66396c8c8a867fa3e8450aca9916c')
+sha512sums_x86_64=('8b12141690c38708508627817f40188d23da5e357164a0cdd6395530b9abad88d06da44c36ff85262872eb8bf2995c184c391048f63a004be81284a444ebb53e')
+sha512sums_aarch64=('27636f05d56ef2cc21bd5ae45375648cfe2d6ce1ebb7418a8ae0318ae7d61aab44482d276a29552dce374420dbbd9ee66653406e0ddcac0a5f87211a320ea6fc')
+sha512sums_loong64=('dc7cec63e6ec10acfa0e973157d80f28ff46418f51f20626e35103057e68a1bc82f355c267abc2b1dee0a57893814496d13e32085e56afbcbc6e1419b39cbd17')
 options=('!strip' '!debug')
 
 package() {