Review Results

Comment

The change is limited to .SRCINFO metadata: it bumps pkgrel from 1 to 2 and adds aarch64 to the declared architectures. There are no source URL changes, no new build/install commands, no added scripts, and no evidence of network access, privilege escalation, or persistence mechanisms. This appears to be a packaging metadata update only, with low security risk.

@@ -1,8 +1,9 @@
 pkgbase = mailspring-bin
 	pkgdesc = A beautiful, fast and fully open source mail client.(Prebuilt version.Use system-wide electron)
 	pkgver = 1.23.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://getmailspring.com/
+	arch = aarch64
 	arch = x86_64
 	license = GPL-3.0-only
 	depends = electron41

Comment

The change only moves the RPM source entries from the generic source/sha256sums fields to architecture-specific source_aarch64/source_x86_64 and matching checksums. The URLs remain HTTPS and point to the official Mailspring GitHub release assets, with no new build-time code execution, install-script behavior, or privilege/persistence changes introduced by this .SRCINFO update. This is a metadata-only packaging adjustment and does not materially increase supply-chain risk.

@@ -11,9 +12,11 @@ pkgbase = mailspring-bin
 	depends = tidy
 	provides = mailspring=1.23.0
 	conflicts = mailspring
-	source = mailspring-1.23.0.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.23.0/mailspring-1.23.0-0.1.x86_64.rpm
 	source = mailspring.sh
-	sha256sums = b99be331fb4144b7556edb8e11cd854464cd3e8f3716527171da7c3c8fbb16ba
 	sha256sums = a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d
+	source_aarch64 = mailspring-1.23.0-aarch64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.23.0/mailspring-1.23.0-0.1.aarch64.rpm
+	sha256sums_aarch64 = f5241eb2064537c5e177ef2b56fe3ba909ec1312ea7f7717d027c142aa084bcc
+	source_x86_64 = mailspring-1.23.0-x86_64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.23.0/mailspring-1.23.0-0.1.x86_64.rpm
+	sha256sums_x86_64 = b99be331fb4144b7556edb8e11cd854464cd3e8f3716527171da7c3c8fbb16ba
 
 pkgname = mailspring-bin

Comment

The change is low risk. It only expands the package architecture list to include aarch64, splits the prebuilt RPM sources and checksums per-architecture, and makes a packaging-only install path adjustment for the desktop file. The source URLs remain HTTPS and point to the upstream GitHub release, checksums are pinned, and there are no new build-time downloads, scripts, privilege changes, or persistence mechanisms introduced by this diff. The only substantive effect is enabling an additional architecture with its own verified upstream binary.

@@ -3,9 +3,12 @@ pkgname=mailspring-bin
 _pkgname=Mailspring
 pkgver=1.23.0
 _electronversion=41
-pkgrel=1
+pkgrel=2
 pkgdesc="A beautiful, fast and fully open source mail client.(Prebuilt version.Use system-wide electron)"
-arch=('x86_64')
+arch=(
+    'aarch64'
+    'x86_64'
+)
 url="https://getmailspring.com/"
 _ghurl="https://github.com/Foundry376/Mailspring"
 license=('GPL-3.0-only')

Comment

The change is low risk. It only adds aarch64 support by splitting the RPM source and checksums per-architecture, while keeping downloads pinned to the official GitHub release URLs over HTTPS with fixed hashes. The packaging tweak changes the desktop file install destination from an explicit filename to installing into the applications directory, which is a benign path handling change and does not introduce execution, privilege escalation, or network access. No suspicious scripts, post-install actions, or new binaries are added beyond the existing upstream RPM artifacts.

@@ -17,12 +20,12 @@ depends=(
     'db5.3'
     'tidy'
 )
-source=(
-    "${pkgname%-bin}-${pkgver}.rpm::${_ghurl}/releases/download/${pkgver}/${pkgname%-bin}-${pkgver}-0.1.${CARCH}.rpm"
-    "${pkgname%-bin}.sh"
-)
-sha256sums=('b99be331fb4144b7556edb8e11cd854464cd3e8f3716527171da7c3c8fbb16ba'
-            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+source=("${pkgname%-bin}.sh")
+source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::${_ghurl}/releases/download/${pkgver}/${pkgname%-bin}-${pkgver}-0.1.aarch64.rpm")
+source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::${_ghurl}/releases/download/${pkgver}/${pkgname%-bin}-${pkgver}-0.1.x86_64.rpm")
+sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+sha256sums_aarch64=('f5241eb2064537c5e177ef2b56fe3ba909ec1312ea7f7717d027c142aa084bcc')
+sha256sums_x86_64=('b99be331fb4144b7556edb8e11cd854464cd3e8f3716527171da7c3c8fbb16ba')
 _get_app_dir() {
     find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
 }

Comment

The change is low risk. It only refactors how the desktop file is installed (using `install -t` instead of an explicit destination filename) and splits the RPM source/checksums by architecture to support aarch64 in addition to x86_64. The sources remain HTTPS GitHub release URLs with pinned checksums, and there are no new build-time network calls, scripts, privilege changes, or packaging actions outside `$pkgdir`. I do not see any supply-chain or persistence red flags in this diff.

@@ -66,7 +69,7 @@ package() {
     install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
 	local _app_dir=$(_get_app_dir)
 	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
-    install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
+    install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
     find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
         _extension="${_i##*.}"
         _icon_path="${_i#*share/icons/}"

Comment

The change is a no-op formatting-only edit: it only removes the trailing newline at end of PKGBUILD and does not alter sources, build steps, install behavior, permissions, dependencies, or any post-install actions. No security impact is evident from this diff.

@@ -74,4 +77,4 @@ package() {
         install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
     done
     install -Dm644 "${srcdir}/usr/share/metainfo/${pkgname%-bin}.metainfo.xml" -t "${pkgdir}/usr/share/metainfo"
-}
+}
\ No newline at end of file