Review Results

Comment

The change is a routine version bump in .SRCINFO for an AUR browser package. It updates the upstream RPM source URL from one Vivaldi snapshot release to the next and refreshes the corresponding SHA-512 checksums. The source remains HTTPS and points to the official Vivaldi download host; there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Based on the provided hunk alone, this appears low risk.

@@ -1,8 +1,8 @@
 # Generated by makepkg 7.1.0
-# Fri Aug 28 11:10:18 UTC 2026
+# Tue Sep  1 12:13:11 UTC 2026
 pkgbase = vivaldi-snapshot
 	pkgdesc = An advanced browser made with the power user in mind. Snapshot
-	pkgver = 8.2.4133.31
+	pkgver = 8.2.4133.38
 	pkgrel = 1
 	url = https://vivaldi.com
 	arch = x86_64

Comment

The change only updates the upstream Vivaldi snapshot RPM version and its corresponding SHA-512 checksum in .SRCINFO. The source remains an HTTPS download from the official Vivaldi domain, with no new build steps, scripts, patches, or privilege-related changes introduced by this diff. I do not see any supply-chain red flags in the reviewed hunk.

@@ -36,9 +36,9 @@ pkgbase = vivaldi-snapshot
 	optdepends = upower: Battery Status API support
 	options = !strip
 	options = !zipman
-	source = https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-8.2.4133.31-1.x86_64.rpm
+	source = https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-8.2.4133.38-1.x86_64.rpm
 	source = 0001-add-support-for-user-flags.patch
-	sha512sums = b600a8f5814d99be1f907977d81a9e5f38a8379d7ae14b37512e202f1a411b2326613fffcd16efb8849e8f78b544ba311e2fdf2b7957684f6a6500c6dba95e69
-	sha512sums = a9bdab0fb0f394af17d1b126bae2d0cdc55e63eaa6eaf36eb994735047d3d7bc5000d75ab930f74b76b283c5addefbd4e4e63c5e4f2908bd53c270e73641c19d
+	sha512sums = 77465279fd3a992054ff08f83e28c94f7d66db31b88c13778a15b683971f5bef64780eca539f5113aef0785f2cc96e443c8199e600d534a2344d49ae323f9dbb
+	sha512sums = 6b230614419416c44adf8fc2a677f8b1f1aca16949d20b7499417737001a6e9e314fc5841afaf402ad55b09910fca4c70fa7b6d38509b0546959bdbefb036726
 
 pkgname = vivaldi-snapshot

Comment

Risk is low. The patch only adds support for reading user-supplied flags from a per-user config file and appending them to the browser launch command. There is no network access, privilege escalation, persistence, or packaging-time execution introduced. The main security consideration is that the new code performs unquoted word splitting on $VIVALDI_USER_FLAGS when invoking vivaldi-bin, so a malicious or malformed config file can inject arbitrary command-line arguments into the browser process. However, this is explicitly user-controlled input in the user's own config directory, not a supply-chain or package compromise. No high-severity issue is evident in this diff alone.

@@ -1,18 +1,18 @@
-From 68c2dec905a7c88895c458dd40708ab9989385cf Mon Sep 17 00:00:00 2001
+From 091faff8c4249e5e5e06b83370350776281bbf54 Mon Sep 17 00:00:00 2001
 From: BlackEagle <ike.devolder@gmail.com>
 Date: Wed, 19 Jan 2022 20:57:58 +0100
 Subject: [PATCH] add support for user flags
 
 Signed-off-by: BlackEagle <ike.devolder@gmail.com>
 ---
- vivaldi-stable | 9 ++++++++-
+ vivaldi | 9 ++++++++-
  1 file changed, 8 insertions(+), 1 deletion(-)
 
-diff --git a/vivaldi-stable b/vivaldi-stable
-index 5b5f1bf..8e95859 100755
---- a/vivaldi-stable
-+++ b/vivaldi-stable
-@@ -53,6 +53,13 @@ export CHROME_VERSION_EXTRA="stable"
+diff --git a/vivaldi b/vivaldi
+index 2f87883..b8fe8a0 100755
+--- a/vivaldi
++++ b/vivaldi
+@@ -117,6 +117,13 @@ export CHROME_VERSION_EXTRA="stable"
  # We don't want bug-buddy intercepting our crashes. http://crbug.com/24120
  export GNOME_DISABLE_CRASH_DIALOG=SET_BY_GOOGLE_CHROME
  

Comment

The change adds support for user-supplied flags by expanding an unquoted environment variable into the browser launcher: `exec -a "$0" "$HERE/vivaldi-bin" $VIVALDI_USER_FLAGS "$@"`. This is not a supply-chain compromise by itself, but it does introduce shell word-splitting and glob expansion on an environment-controlled variable before handing off to the binary. That can cause unexpected argument injection or behavior changes if the variable is set to crafted content, though it remains within the user's own session and does not create persistence or privilege escalation. No network access, downloads, or root-level actions are introduced in this patch.

@@ -26,12 +26,12 @@ index 5b5f1bf..8e95859 100755
  # Sanitize std{in,out,err} because they'll be shared with untrusted child
  # processes (http://crbug.com/376567).
  exec < /dev/null
-@@ -60,4 +67,4 @@ exec > >(exec cat)
+@@ -124,4 +131,4 @@ exec > >(exec cat)
  exec 2> >(exec cat >&2)
  
  # Note: exec -a below is a bashism.
 -exec -a "$0" "$HERE/vivaldi-bin" "$@"
 +exec -a "$0" "$HERE/vivaldi-bin" $VIVALDI_USER_FLAGS "$@"
 -- 
-2.34.1
+2.55.0
 

Comment

The change is a straightforward version bump in PKGBUILD from 8.2.4133.31 to 8.2.4133.38, with no changes to source URLs, build logic, install scripts, dependencies, or packaging behavior. I see no new integrity, persistence, or code-execution concerns in this diff hunk alone.

@@ -2,8 +2,8 @@
 # Contributor: TZ86
 
 pkgname=vivaldi-snapshot
-_rpmversion=8.2.4133.31-1
-pkgver=8.2.4133.31
+_rpmversion=8.2.4133.38-1
+pkgver=8.2.4133.38
 pkgrel=1
 pkgdesc='An advanced browser made with the power user in mind. Snapshot'
 url="https://vivaldi.com"

Comment

The change only bumps the Vivaldi snapshot version and updates the corresponding SHA-512 checksums for the RPM source and existing patch. The source remains an HTTPS download from the official Vivaldi domain, with no new sources, scripts, install hooks, or build-time network behavior introduced. No privilege, persistence, or packaging-hygiene red flags are present in this diff.

@@ -42,8 +42,8 @@ optdepends=(
 )
 source=("https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-${_rpmversion}.x86_64.rpm"
         '0001-add-support-for-user-flags.patch')
-sha512sums=('b600a8f5814d99be1f907977d81a9e5f38a8379d7ae14b37512e202f1a411b2326613fffcd16efb8849e8f78b544ba311e2fdf2b7957684f6a6500c6dba95e69'
-            'a9bdab0fb0f394af17d1b126bae2d0cdc55e63eaa6eaf36eb994735047d3d7bc5000d75ab930f74b76b283c5addefbd4e4e63c5e4f2908bd53c270e73641c19d')
+sha512sums=('77465279fd3a992054ff08f83e28c94f7d66db31b88c13778a15b683971f5bef64780eca539f5113aef0785f2cc96e443c8199e600d534a2344d49ae323f9dbb'
+            '6b230614419416c44adf8fc2a677f8b1f1aca16949d20b7499417737001a6e9e314fc5841afaf402ad55b09910fca4c70fa7b6d38509b0546959bdbefb036726')
 
 package() {
     cp --parents -a {opt,usr/bin,usr/share} "$pkgdir"