Review Results

Comment

The .SRCINFO update changes the upstream source tag from the Linux release tag v6.5.1.0_Linux to v6.6.1.0_OSX while keeping the package name and Linux-oriented dependencies unchanged. That is a supply-chain integrity red flag because the source now points at a macOS-tagged release of the MEGAsync repo, which may not correspond to the intended Linux build artifacts and could indicate a packaging mistake or unintended upstream content. However, this diff is only metadata; it does not itself introduce executable code, and the source URL remains on the official GitHub repository over HTTPS. Risk is moderate due to potential wrong-source pinning, but there is no direct evidence of malicious payload in this single change.

@@ -1,6 +1,6 @@
 pkgbase = megasync
 	pkgdesc = Official MEGA desktop application for syncing with MEGA Cloud Drive
-	pkgver = 6.5.1.0
+	pkgver = 6.6.1.0
 	pkgrel = 1
 	url = https://github.com/meganz/MEGAsync/
 	arch = x86_64

Comment

The change updates the upstream MEGAsync source tag from a Linux release tag to `v6.6.1.0_OSX`, which is suspicious for an Arch Linux package. This is not a security issue by itself if the tag still points to the official upstream repo, but it is a strong integrity/metadata red flag because it suggests the package may now be building from an OS X-specific release tag rather than the intended Linux source. I did not see evidence in this diff alone of malicious code execution, network fetches, or privilege escalation, and the rest of the sources remain pinned to official GitHub repos. However, the tag mismatch could indicate an accidental or intentional source drift that should be verified against upstream release contents before trusting the build.

@@ -30,12 +30,12 @@ pkgbase = megasync
 	depends = qt5-x11extras
 	depends = sqlite
 	depends = zlib
-	source = git+https://github.com/meganz/MEGAsync.git#tag=v6.5.1.0_Linux
+	source = git+https://github.com/meganz/MEGAsync.git#tag=v6.6.1.0_OSX
 	source = meganz-sdk::git+https://github.com/meganz/sdk.git
 	source = 010-megasync-sdk-fix-cmake-dependencies-detection.patch
 	source = 020-megasync-app-fix-cmake-dependencies-detection.patch
 	source = 030-megasync-app-disable-isolated-gfx-for-disabling-freeimage-in-sdk.patch
-	sha256sums = 17d7beec0cb9560c7211db098a22b8daf81894dec110be27fd5303501f210b6b
+	sha256sums = deb2bc2033bd02a92f5409c1ed89561a1b0ba8592d2c8162d0ae89fc9014964a
 	sha256sums = SKIP
 	sha256sums = 5219537875385e9399b1a76a5775722053880cdfc0c33b5726504e020e11ad70
 	sha256sums = a5883be2d00dbacaacf78231bfeeac27f4e8a471c3256370e94fec3e55b1d171

Comment

The change is low risk overall but not entirely trivial: it updates the upstream source tag from a Linux-specific release tag to an OSX-tagged release tag, which is unusual for an Arch Linux package and could indicate the package is now tracking a different upstream artifact than intended. However, the source remains pinned to an official HTTPS GitHub repo, there is no added build-time network access, and no new install/persistence logic. The other edits are a checksum refresh and a harmless CMake warning flag change. I did not see evidence of direct malicious behavior in this diff alone, but the source tag switch merits caution because it may affect provenance and expected contents.

@@ -7,7 +7,7 @@
 # Contributor: Hexchain Tong <i at hexchain dot org>
 
 pkgname=megasync
-pkgver=6.5.1.0
+pkgver=6.6.1.0
 pkgrel=1
 pkgdesc='Official MEGA desktop application for syncing with MEGA Cloud Drive'
 arch=('x86_64')

Comment

The change is low risk overall. It updates the upstream tag from a Linux release tag to an OSX release tag while keeping the source on the official MEGA GitHub repository over HTTPS and still pinned to a specific tag, so there is no obvious supply-chain red flag from the URL itself. The checksum was updated accordingly. The only notable oddity is the tag/platform mismatch (`v${pkgver}_OSX` in a Linux PKGBUILD), which could indicate packaging the wrong upstream release artifact/source tree, but in this diff there is no evidence of injected code, network fetches at build time, privilege escalation, or persistence mechanisms. The `-Wno-dev` to `-Wno-author` flag change looks like a build-system warning tweak, not a security issue.

@@ -40,12 +40,12 @@ makedepends=(
     'cmake'
     'git'
     'qt5-tools')
-source=("git+https://github.com/meganz/MEGAsync.git#tag=v${pkgver}_Linux"
+source=("git+https://github.com/meganz/MEGAsync.git#tag=v${pkgver}_OSX"
         'meganz-sdk'::'git+https://github.com/meganz/sdk.git'
         '010-megasync-sdk-fix-cmake-dependencies-detection.patch'
         '020-megasync-app-fix-cmake-dependencies-detection.patch'
         '030-megasync-app-disable-isolated-gfx-for-disabling-freeimage-in-sdk.patch')
-sha256sums=('17d7beec0cb9560c7211db098a22b8daf81894dec110be27fd5303501f210b6b'
+sha256sums=('deb2bc2033bd02a92f5409c1ed89561a1b0ba8592d2c8162d0ae89fc9014964a'
             'SKIP'
             '5219537875385e9399b1a76a5775722053880cdfc0c33b5726504e020e11ad70'
             'a5883be2d00dbacaacf78231bfeeac27f4e8a471c3256370e94fec3e55b1d171'

Comment

The change is low risk. It only alters a CMake warning flag in build() from -Wno-dev to -Wno-author, which affects warning suppression during compilation and does not introduce new sources, network fetches, privilege changes, install-time actions, or packaging behavior. The broader PKGBUILD does switch the upstream tag from the Linux to the OSX release tag, but that is outside the provided hunk and not part of this review scope.

@@ -81,7 +81,7 @@ build() {
         -DUSE_FFMPEG:BOOL='OFF' \
         -DUSE_FREEIMAGE:BOOL='OFF' \
         -DUSE_PDFIUM:BOOL='OFF' \
-        -Wno-dev
+        -Wno-author
     cmake --build build --target MEGAsync
 }