Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 23.4.1 to 23.5.0. No source URLs, checksums, build steps, install scripts, or packaging metadata were altered in the reviewed diff, so there is no direct security concern visible here. Risk is minimal and limited to the usual trust in the upstream release itself, which is outside the scope of this single metadata-only change.

@@ -1,6 +1,6 @@
 pkgbase = asterisk
 	pkgdesc = A complete PBX solution
-	pkgver = 23.4.1
+	pkgver = 23.5.0
 	pkgrel = 1
 	url = https://www.asterisk.org
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from asterisk 23.4.1 to 23.5.0, with the corresponding SHA-256 updated for the tarball. No new sources, scripts, build steps, or privilege-related artifacts were introduced, and the remaining auxiliary sources/checksums are unchanged. Based on the provided diff hunk alone, this does not present an obvious security concern.

@@ -135,12 +135,12 @@ pkgbase = asterisk
 	backup = etc/asterisk/voicemail.conf
 	backup = etc/asterisk/websocket_client.conf
 	backup = etc/asterisk/xmpp.conf
-	source = https://downloads.asterisk.org/pub/telephony/asterisk/releases/asterisk-23.4.1.tar.gz
+	source = https://downloads.asterisk.org/pub/telephony/asterisk/releases/asterisk-23.5.0.tar.gz
 	source = asterisk.sysusers
 	source = asterisk.logrotated
 	source = asterisk.tmpfiles
 	source = fix-upnp.patch
-	sha256sums = 9d90269af187c8437087ba96f569e656a6a4a9a0a2347489c9e81ff1c37d2c51
+	sha256sums = 8ed3a237e6d8dff94a09527a83143530b5afcc1aee73fa7b85c069bda507adac
 	sha256sums = 38a53911647fb2308482179cba605ebf12345df37eed23eb4ea67bf0bf041486
 	sha256sums = b97dc10a262621c95e4b75e024834712efd58561267b59b9171c959ecd9f7164
 	sha256sums = 1b6b489d4f71015bfc56ce739d92df7e9abdb349aed6f5a47dd9c18d84546c1b

Comment

The change is a routine version bump from 23.4.1 to 23.5.0 with the corresponding source checksum update. The source remains the official Asterisk download URL over HTTPS, and there are no new build steps, scripts, patches, or privilege-related changes introduced in this diff. No security issues are evident from the reviewed hunk.

@@ -7,7 +7,7 @@
 # Contributor: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 
 pkgname=asterisk
-pkgver=23.4.1
+pkgver=23.5.0
 pkgrel=1
 pkgdesc='A complete PBX solution'
 arch=(x86_64 i686 aarch64 armv7h)

Comment

The change only updates the PKGBUILD to the new upstream release 23.5.0 and refreshes the source checksum accordingly. The source is still fetched over HTTPS from the official Asterisk download site, and there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in this diff. I did not see any added persistence, backdoor, or integrity red flags in the reviewed hunk.

@@ -147,7 +147,7 @@ source=("https://downloads.asterisk.org/pub/telephony/$pkgname/releases/$_archiv
         "$pkgname.logrotated"
         "$pkgname.tmpfiles"
         "fix-upnp.patch")
-sha256sums=('9d90269af187c8437087ba96f569e656a6a4a9a0a2347489c9e81ff1c37d2c51'
+sha256sums=('8ed3a237e6d8dff94a09527a83143530b5afcc1aee73fa7b85c069bda507adac'
             '38a53911647fb2308482179cba605ebf12345df37eed23eb4ea67bf0bf041486'
             'b97dc10a262621c95e4b75e024834712efd58561267b59b9171c959ecd9f7164'
             '1b6b489d4f71015bfc56ce739d92df7e9abdb349aed6f5a47dd9c18d84546c1b'