Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 17.10.0 to 17.11.0. No source URLs, checksums, build steps, dependencies, install scripts, or permissions were altered in the reviewed diff, so there is no direct security signal here. Based on this hunk alone, the change appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = ocrmypdf
 	pkgdesc = A tool to add an OCR text layer to scanned PDF files, allowing them to be searched
-	pkgver = 17.10.0
+	pkgver = 17.11.0
 	pkgrel = 1
 	url = https://github.com/ocrmypdf/OCRmyPDF
 	install = ocrmypdf.install

Comment

The change is a straightforward upstream version bump in .SRCINFO from ocrmypdf 17.10.0 to 17.11.0, with the source URL still using HTTPS on files.pythonhosted.org and the checksum updated accordingly. No new sources, scripts, build steps, or packaging metadata that would suggest privilege escalation, persistence, or integrity bypass were introduced in this diff. Based on the provided hunk alone, this appears low risk.

@@ -30,7 +30,7 @@ pkgbase = ocrmypdf
 	depends = python-uharfbuzz
 	depends = python-fpdf2
 	optdepends = jbig2enc: Better compression algorithm; results in smaller PDF files
-	source = https://files.pythonhosted.org/packages/source/o/ocrmypdf/ocrmypdf-17.10.0.tar.gz
-	sha256sums = 3e80a22e7ca9a746034e990414c9f18791f168800f3ede92101504f45be6129c
+	source = https://files.pythonhosted.org/packages/source/o/ocrmypdf/ocrmypdf-17.11.0.tar.gz
+	sha256sums = 8e41cbba23bba9ce20bc557576211e1829d1beaef00183bacd227b4b9482af87
 
 pkgname = ocrmypdf

Comment

The change only bumps pkgver from 17.10.0 to 17.11.0 in PKGBUILD. No source URLs, checksums, build steps, dependencies, install scripts, or packaging logic were modified in the provided diff hunk, so there is no new security-relevant behavior to assess from this change alone.

@@ -5,7 +5,7 @@
 # Contributor: Daniel Reuter <daniel.robin.reuter@googlemail.com>
 
 pkgname=ocrmypdf
-pkgver=17.10.0
+pkgver=17.11.0
 pkgrel=1
 pkgdesc="A tool to add an OCR text layer to scanned PDF files, allowing them to be searched"
 url="https://github.com/ocrmypdf/OCRmyPDF"

Comment

The change only updates the SHA-256 checksum for the upstream PyPI source tarball in PKGBUILD. The source URL remains HTTPS and points to the official files.pythonhosted.org host, with no new build steps, scripts, or packaging logic introduced. I did not find any added network fetches, privilege escalation, persistence mechanisms, or suspicious artifacts in this diff hunk. Risk is low and limited to normal upstream source integrity tracking.

@@ -17,7 +17,7 @@ depends=('python>=3.9' 'img2pdf' 'python-pillow' 'tesseract' 'ghostscript' 'unpa
 makedepends=('python-hatch-vcs' 'python-build' 'python-installer' 'python-wheel')
 optdepends=('jbig2enc: Better compression algorithm; results in smaller PDF files')
 source=("https://files.pythonhosted.org/packages/source/${pkgname::1}/$pkgname/$pkgname-$pkgver.tar.gz")
-sha256sums=('3e80a22e7ca9a746034e990414c9f18791f168800f3ede92101504f45be6129c')
+sha256sums=('8e41cbba23bba9ce20bc557576211e1829d1beaef00183bacd227b4b9482af87')
 install="${pkgname}.install"
 
 build() {