Review Results

Comment

The only change in this .SRCINFO diff is a pkgrel bump from 1 to 2. This is a metadata-only rebuild indicator and does not alter sources, build commands, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by this change.

@@ -1,7 +1,7 @@
 pkgbase = pandoc-bin
 	pkgdesc = Conversion between documentation formats
 	pkgver = 3.11
-	pkgrel = 1
+	pkgrel = 2
 	url = https://pandoc.org
 	arch = x86_64
 	arch = aarch64

Comment

This change only bumps pkgrel from 1 to 2 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or any runtime behavior. No security-relevant content is introduced by this diff hunk.

@@ -1,6 +1,6 @@
 pkgname=pandoc-bin
 pkgver=3.11
-pkgrel=1
+pkgrel=2
 pkgdesc="Conversion between documentation formats"
 url="https://pandoc.org"
 license=("GPL-2.0-or-later")

Comment

The change only adds generation of zsh and fish shell completion files during package() using the already-packaged pandoc binary, alongside the existing bash completion. There are no new sources, downloads, privilege changes, or writes outside $pkgdir. The commands are straightforward and confined to packaging artifacts, so I see no meaningful security risk in this diff.

@@ -36,8 +36,13 @@ package() {
   cp -R bin share "${pkgdir}/usr"
   cp -R data citeproc "${pkgdir}/usr/share/pandoc/"
   cp COPYRIGHT MANUAL.txt "${pkgdir}/usr/share/pandoc/"
+
   bin/pandoc --completion=bash | \
     install -Dm644 /dev/stdin "$pkgdir"/usr/share/bash-completion/completions/pandoc
+  bin/pandoc --completion=zsh | \
+    install -Dm644 /dev/stdin "$pkgdir"/usr/share/zsh/site-functions/_pandoc
+  bin/pandoc --completion=fish | \
+    install -Dm644 /dev/stdin "$pkgdir"/usr/share/fish/vendor_completions.d/pandoc.fish
 }
 
 # vim: set ts=2 sw=2 et