Review Results

Comment

This is a straightforward version bump in .SRCINFO from 3.9.3 to 3.10.0, with corresponding checksum and Java dependency updates (JDK/runtime 17 -> 21). The source remains the official upstream GitHub release tarball over HTTPS, and there are no new scripts, patches, install hooks, or build-time network behaviors introduced in this change. No integrity or persistence red flags are visible in the diff itself.

@@ -1,20 +1,20 @@
 pkgbase = ipscan
 	pkgdesc = Angry IP Scanner (or simply ipscan) is an open-source and cross-platform network scanner designed to be fast and simple to use. It scans IP addresses and ports as well as has many other features.
-	pkgver = 3.9.3
+	pkgver = 3.10.0
 	pkgrel = 1
 	url = https://angryip.org
 	arch = i686
 	arch = x86_64
 	license = GPL2
-	makedepends = jdk17-openjdk
-	depends = java-runtime>=17
+	makedepends = jdk21-openjdk
+	depends = java-runtime>=21
 	source = ipscan
 	source = ipscan.desktop
 	source = build.gradle.patch
-	source = https://github.com/angryip/ipscan/archive/refs/tags/3.9.3.zip
+	source = https://github.com/angryip/ipscan/archive/refs/tags/3.10.0.zip
 	sha512sums = e2caf62412c35a7a29128d0ae176aca1e4a45cf81e44b76e4bb23ad1c0633fa8833d674d7d514942a170ab54223b6c4a93ab458f2736107e7bbe9a5e806a7c5e
 	sha512sums = c17db5e4ac90af8675e9ac2a8e77f1322beb8bacb578a288bcfbf8da67270004ec40314b2793ea8ed8eeeeb64f9c03b3f80694e38c55be9d213486b825689a0f
 	sha512sums = 8ec4aae1b2226af984e58acd20ddc7d78268ab53a1f39cb6c85143741638727cf94794597bb9755483968c5f93e37cc96c33c61527529c074782f9447914399a
-	sha512sums = ae4fc4e8f6985cfc0e4c032e6347445917767797745d2e958c069d46bce23ef066a4fee4cd410d9a501802224d0b6dcbf325cc0537bad17bf78a45004e49d272
+	sha512sums = 03b992d45ff0feee79d5c8c8b3a3d1dfe68bc0804298729c18a2c761a95c21ec43748724a81bb1fa730d8d0fcabfdcd97c36c4d0f3393144d540ab30c3697f61
 
 pkgname = ipscan

Comment

The change is low risk. It updates the package to a new upstream release, switches the Java toolchain from 17 to 21, and adjusts the packaged JAR name to select the architecture-specific artifact. The source remains the official GitHub release tarball over HTTPS, and the only new logic is a simple CARCH-to-archive-name mapping. I do not see any added network fetches outside source=(), privilege escalation, persistence mechanisms, or suspicious install-time behavior in this diff.

@@ -3,14 +3,17 @@
 # Maintainer:  max.bra <max dot bra at alice dot it>
 
 pkgname=ipscan
-pkgver=3.9.3
+pkgver=3.10.0
 pkgrel=1
 pkgdesc='Angry IP Scanner (or simply ipscan) is an open-source and cross-platform network scanner designed to be fast and simple to use. It scans IP addresses and ports as well as has many other features.'
 arch=('i686' 'x86_64')
 license=('GPL2')
 url='https://angryip.org'
-depends=('java-runtime>=17')
-makedepends=(jdk17-openjdk)
+depends=('java-runtime>=21')
+makedepends=(jdk21-openjdk)
+
+[[ $CARCH == "i686" ]] && _intarch=linux
+[[ $CARCH == "x86_64" ]] && _intarch=linux64
 
 source=(ipscan ipscan.desktop build.gradle.patch \
   "https://github.com/angryip/${pkgname}/archive/refs/tags/${pkgver}.zip")

Comment

The change is low risk. It updates the package to a new upstream release, refreshes the checksum, and adjusts the Java runtime/toolchain and installed JAR name to match the new release artifacts. The source remains the official GitHub tag over HTTPS, and there are no new build-time network fetches, privilege escalations, install-script changes, or suspicious packaging behaviors in the diff. The only notable change is the switch to Java 21 and architecture-specific JAR selection, which is expected for a version bump.

@@ -18,7 +21,7 @@ source=(ipscan ipscan.desktop build.gradle.patch \
 sha512sums=('e2caf62412c35a7a29128d0ae176aca1e4a45cf81e44b76e4bb23ad1c0633fa8833d674d7d514942a170ab54223b6c4a93ab458f2736107e7bbe9a5e806a7c5e'
             'c17db5e4ac90af8675e9ac2a8e77f1322beb8bacb578a288bcfbf8da67270004ec40314b2793ea8ed8eeeeb64f9c03b3f80694e38c55be9d213486b825689a0f'
             '8ec4aae1b2226af984e58acd20ddc7d78268ab53a1f39cb6c85143741638727cf94794597bb9755483968c5f93e37cc96c33c61527529c074782f9447914399a'
-            'ae4fc4e8f6985cfc0e4c032e6347445917767797745d2e958c069d46bce23ef066a4fee4cd410d9a501802224d0b6dcbf325cc0537bad17bf78a45004e49d272')
+            '03b992d45ff0feee79d5c8c8b3a3d1dfe68bc0804298729c18a2c761a95c21ec43748724a81bb1fa730d8d0fcabfdcd97c36c4d0f3393144d540ab30c3697f61')
 
 prepare() {
   cd "${srcdir}/${pkgname}-${pkgver}"

Comment

The change only updates the Java runtime path used during build from OpenJDK 17 to OpenJDK 21. This is a narrow build-environment adjustment with no added network access, no new sources, no install-script changes, and no packaging/persistence behavior. I do not see a security regression in the diff itself.

@@ -30,7 +33,7 @@ prepare() {
 build() {
   cd "${srcdir}/${pkgname}-${pkgver}"
   unset _JAVA_OPTIONS
-  export PATH=/usr/lib/jvm/java-17-openjdk/bin:$PATH
+  export PATH=/usr/lib/jvm/java-21-openjdk/bin:$PATH
   GRADLE_USER_HOME="${srcdir}" ./gradlew current
 }
 

Comment

The change is low risk. It only updates the package to the new upstream release, switches the Java toolchain from 17 to 21, and narrows the installed JAR filename to the architecture-specific artifact produced by the build. The source URL remains the official GitHub release archive over HTTPS, and the checksum was updated accordingly. I do not see any added network fetches, privilege changes, persistence mechanisms, or suspicious install-time actions in this diff.

@@ -39,5 +42,5 @@ package() {
   install -Dm755 "../${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
   install -Dm644 "../${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
   install -Dm644 resources/images/icon256.png "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
-  install -Dm644 build/libs/ipscan-*-${pkgver}.jar "$pkgdir/usr/share/java/$pkgname/$pkgname.jar"
+  install -Dm644 build/libs/ipscan-*-${pkgver}-$_intarch.jar "$pkgdir/usr/share/java/$pkgname/$pkgname.jar"
 }