Review Results

Comment

The change only updates .SRCINFO metadata to reflect a version bump from patool 4.0.5-3 to 4.0.7-1. No sources, checksums, build logic, install scripts, or package contents are modified in the reviewed diff, so there is no new security-relevant behavior introduced here. Based on this diff alone, the risk is minimal.

@@ -1,7 +1,7 @@
 pkgbase = patool
 	pkgdesc = portable command line archive file manager
-	pkgver = 4.0.5
-	pkgrel = 3
+	pkgver = 4.0.7
+	pkgrel = 1
 	url = https://wummel.github.io/patool/
 	arch = any
 	license = GPL-3.0-only

Comment

The change is a straightforward version bump in .SRCINFO from patool 4.0.5 to 4.0.7 with an updated upstream GitHub release tarball and matching SHA256. The source remains HTTPS on the official upstream repository, there are no added build-time commands, no new scripts, and no packaging/persistence red flags in the diff provided. Based on this diff alone, I see no security concern.

@@ -15,7 +15,7 @@ pkgbase = patool
 	optdepends = 7zip: extracting various not natively supported formats (upstream suggested)
 	optdepends = unarchiver: extracting various not natively supported formats
 	optdepends = unrar: extracting RAR files
-	source = https://github.com/wummel/patool/releases/download/4.0.5/patool-4.0.5.tar.gz
-	sha256sums = 1c8bbbbe1f421181bf7055ada975befb024c1677449e9d36f42bb45ac69f8b4c
+	source = https://github.com/wummel/patool/releases/download/4.0.7/patool-4.0.7.tar.gz
+	sha256sums = 08dcb019997f55aa730a873185aeddbb397e2be757157769721942784cb4a97f
 
 pkgname = patool

Comment

The change is a routine version bump from 4.0.5 to 4.0.7 with a corresponding SHA-256 checksum update for the upstream release tarball. The source remains an HTTPS GitHub release URL under the expected upstream project, and there are no new build steps, scripts, patches, or packaging changes that would introduce code execution or persistence risks. No suspicious metadata changes are present beyond the normal pkgver/pkgrel and checksum update.

@@ -3,8 +3,8 @@
 # Contributor: Daniel Larsson <znixen@live.se>
 
 pkgname=patool
-pkgver=4.0.5
-pkgrel=3
+pkgver=4.0.7
+pkgrel=1
 pkgdesc="portable command line archive file manager"
 arch=('any')
 url="https://wummel.github.io/patool/"

Comment

The change is a straightforward upstream version bump from 4.0.5 to 4.0.7 with an updated SHA-256 checksum for the release tarball. The source remains the official GitHub release URL over HTTPS, there are no new build-time network fetches, no added scripts/patches, and no packaging logic changes that would introduce privilege escalation or persistence. Based on the provided diff, this appears low risk.

@@ -16,7 +16,7 @@ optdepends=("lz4: extracting LZ4 archives"
     "unarchiver: extracting various not natively supported formats"
     "unrar: extracting RAR files")
 source=(https://github.com/wummel/${pkgname}/releases/download/${pkgver}/${pkgname}-${pkgver}.tar.gz)
-sha256sums=('1c8bbbbe1f421181bf7055ada975befb024c1677449e9d36f42bb45ac69f8b4c')
+sha256sums=('08dcb019997f55aa730a873185aeddbb397e2be757157769721942784cb4a97f')
 
 
 build() {