Review Results

Comment

The change updates the package to a newer Citrix release and adds aarch64 support. The source URLs remain HTTPS and point to Citrix’s official download domain, with per-arch SHA-256 checksums provided, so there is no obvious integrity or supply-chain red flag in this .SRCINFO-only diff. No build-time execution, install-script logic, or privilege-related behavior is introduced here. Risk is low because the change is limited to metadata and source pinning for a vendor release.

@@ -1,10 +1,11 @@
 pkgbase = icaclient
 	pkgdesc = Citrix Workspace App (a.k.a. ICAClient, Citrix Receiver)
-	pkgver = 26.04.0.105
-	pkgrel = 3
+	pkgver = 26.04.10.1
+	pkgrel = 1
 	url = https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html
 	install = citrix-client.install
 	arch = x86_64
+	arch = aarch64
 	license = LicenseRef-Citrix
 	depends = alsa-lib
 	depends = curl

Comment

The change only updates .SRCINFO to point at newer Citrix release tarballs and adds an aarch64 source/checksum. The URLs remain HTTPS on the official Citrix download domain, and the sources are pinned by exact versioned tarball names with matching SHA-256 sums. No new build-time code, scripts, or privilege-related artifacts are introduced by this diff. Based on the provided hunk alone, this is low risk.

@@ -42,7 +43,9 @@ pkgbase = icaclient
 	sha256sums = a3bd74aaf19123cc550cde71b5870d7dacf9883b7e7a85c90e03b508426c16c4
 	sha256sums = 0e3a6c7cf7fa9eee7dcde7356e90ffa1cb312bffc0813a0bf123d2f918dc369d
 	sha256sums = 739da3fca95d07fc3076522acc6b6c1b12b988047bd2fb3c87e37231e49f2e1f
-	source_x86_64 = icaclient-x64-26.04.0.105.tar.gz::https://downloads.citrix.com/26374/linuxx64-gcc-8-26.04.0.105.tar.gz
-	sha256sums_x86_64 = afec7036209b3223f556c1ef1ca84ada24448454ef13880ff658e84a358818ab
+	source_x86_64 = icaclient-x64-26.04.10.1.tar.gz::https://downloads.citrix.com/26543/linuxx64-gcc-8-26.04.10.1.tar.gz
+	sha256sums_x86_64 = 8c0a22cad4a4cda802cb5d3bb09b89779d20f68ba5e454b86485354c557356b5
+	source_aarch64 = icaclient-arm64-26.04.10.1.tar.gz::https://downloads.citrix.com/26543/linuxarm64-26.04.10.1.tar.gz
+	sha256sums_aarch64 = 4e65c1d449a2a9f21905135cc02418fbe434bc23705cad26dbe81ef4b3b9bd54
 
 pkgname = icaclient

Comment

The change is limited to bumping the Citrix Workspace App version, adding aarch64 support, and updating the corresponding source/checksum entries. The source is still fetched from Citrix over HTTPS, and the new architecture-specific tarball is pinned by checksum. I do note the PKGBUILD continues to scrape the vendor download page at build time with curl/grep/sed to discover the tarball URL, which is a reproducibility/integrity weakness, but that behavior pre-existed this change and the reviewed diff does not introduce a new execution or persistence vector. No new install-script, systemd, privilege, or packaging red flags are present in the diff.

@@ -7,10 +7,10 @@
 # Contributor: Giorgio Azzinnaro <giorgio@azzinna.ro>
 
 pkgname=icaclient
-pkgver=26.04.0.105
-pkgrel=3
+pkgver=26.04.10.1
+pkgrel=1
 pkgdesc="Citrix Workspace App (a.k.a. ICAClient, Citrix Receiver)"
-arch=(x86_64)
+arch=(x86_64 aarch64)
 url='https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html'
 license=(LicenseRef-Citrix)
 depends=(alsa-lib curl gst-plugins-base-libs libc++ libc++abi

Comment

The change adds aarch64 support by fetching an additional upstream Citrix tarball and adding a matching checksum. The source URL is still derived from the official Citrix download page over HTTPS, and there are no new build-time commands, privilege escalations, or install-script changes in this diff. The only notable risk is the package now accepts a second architecture-specific binary blob from upstream, but that is expected for this proprietary client and is pinned by checksum. No high-confidence security issue is evident in the reviewed hunk.

@@ -26,6 +26,7 @@ backup=('opt/Citrix/ICAClient/config/appsrv.ini'
 _dl_urls_="$(curl -sL "$url" | grep -F ".tar.gz?__gda__")"
 _dl_urls="$(echo "$_dl_urls_" | grep -F "$pkgver.tar.gz?__gda__")"
 _source64=https:"$(echo "$_dl_urls" | sed -En 's|^.*rel="(//.*/linuxx64-[^"]*)".*$|\1|p')"
+_sourceaarch64=https:"$(echo "$_dl_urls" | sed -En 's|^.*rel="(//.*/linuxarm64-[^"]*)".*$|\1|p')"
 source=('citrix-configmgr.desktop'
         'citrix-conncenter.desktop'
         'citrix-wfica.desktop'

Comment

The change adds aarch64 support by introducing a new upstream tarball URL and checksum, and updates the x86_64 tarball checksum for the new release. I do not see any new execution paths, privilege changes, post-install behavior, or suspicious external fetches beyond the existing build-time scraping of Citrix's official download page. The new source remains HTTPS and points to the vendor site, and the added architecture/source entries are consistent with the package's purpose. Main caveat is that the PKGBUILD still relies on runtime scraping of upstream download links, but that was pre-existing and not introduced by this diff.

@@ -35,6 +36,7 @@ source=('citrix-configmgr.desktop'
         'ctxcwalogd.service'
         'ctxusbd.service')
 source_x86_64=("$pkgname-x64-$pkgver.tar.gz::$_source64")
+source_aarch64=("$pkgname-arm64-$pkgver.tar.gz::$_sourceaarch64")
 sha256sums=('643427b6e04fc47cd7d514af2c2349948d3b45f536c434ba8682dcb1d4314736'
             '446bfe50e5e1cb027415b264a090cede1468dfbdc8b55e5ce14e9289b6134119'
             '1dc6d6592fa08c44fb6a4efa0dc238e9e78352bb799ef2e1a92358b390868064'

Comment

The change is low risk. It only updates the package version, adds aarch64 support, and refreshes the expected SHA-256 checksums for the upstream Citrix tarballs. I did not see any new code execution, privilege escalation, persistence, or install-script changes in this diff. The source URLs are still derived from the official Citrix download page over HTTPS, and the package continues to verify downloaded archives with checksums. The only caveat is that the PKGBUILD still fetches the tarball URL at build time by scraping the vendor page, but that behavior pre-existed this change and is not introduced by the hunk under review.

@@ -43,7 +45,8 @@ sha256sums=('643427b6e04fc47cd7d514af2c2349948d3b45f536c434ba8682dcb1d4314736'
             'a3bd74aaf19123cc550cde71b5870d7dacf9883b7e7a85c90e03b508426c16c4'
             '0e3a6c7cf7fa9eee7dcde7356e90ffa1cb312bffc0813a0bf123d2f918dc369d'
             '739da3fca95d07fc3076522acc6b6c1b12b988047bd2fb3c87e37231e49f2e1f')
-sha256sums_x86_64=('afec7036209b3223f556c1ef1ca84ada24448454ef13880ff658e84a358818ab')
+sha256sums_x86_64=('8c0a22cad4a4cda802cb5d3bb09b89779d20f68ba5e454b86485354c557356b5')
+sha256sums_aarch64=('4e65c1d449a2a9f21905135cc02418fbe434bc23705cad26dbe81ef4b3b9bd54')
 install=citrix-client.install
 
 package() {