Review Results

Comment

Risk is low. The change only updates package metadata in .SRCINFO to a new upstream VMware Workstation release (26H1u1), resets pkgrel, and refreshes the pinned archive.org bundle checksum. The only dependency change is removal of vmware-keymaps from .SRCINFO, which is consistent with the PKGBUILD’s existing optional toggle to drop that dependency. No new build-time code, install-script behavior, network fetches, privilege escalation, or suspicious sources were introduced by this diff.

@@ -1,7 +1,7 @@
 pkgbase = vmware-workstation
 	pkgdesc = The industry standard for running multiple operating systems as virtual machines on a single Linux PC.
-	pkgver = 26H1
-	pkgrel = 3
+	pkgver = 26H1u1
+	pkgrel = 1
 	url = https://www.vmware.com/products/workstation-for-linux.html
 	install = vmware-workstation.install
 	arch = x86_64

Comment

The change only removes an opt-in runtime dependency entry from .SRCINFO: `vmware-keymaps` is no longer listed as a depends. This does not introduce any new code execution, network access, privilege escalation, or packaging integrity risk. At most it affects dependency metadata and may alter installation behavior, but the diff itself is benign from a security perspective.

@@ -21,7 +21,6 @@ pkgbase = vmware-workstation
 	depends = libxml2-legacy
 	depends = gtk3
 	depends = gcr
-	depends = vmware-keymaps
 	optdepends = linux-headers: build modules against Arch kernel
 	provides = vmware-ovftool
 	conflicts = vmware-modules-dkms

Comment

Risk is low. The change only bumps the bundled VMware Workstation upstream release from 26H1 to 26H1u1 and updates the corresponding SHA-256 in .SRCINFO. The source remains an HTTPS archive.org URL, there are no new build-time commands, no new external hosts, and no packaging/install-script changes in this diff. The only other metadata change is removal of the vmware-keymaps dependency from .SRCINFO, but the PKGBUILD still conditionally adds it by default, so this appears to be a metadata sync issue rather than a security regression.

@@ -33,7 +32,7 @@ pkgbase = vmware-workstation
 	options = !debug
 	backup = etc/vmware/config
 	backup = etc/conf.d/vmware
-	source = VMware-Workstation-Full-26H1-25388281.x86_64.bundle::https://archive.org/download/VMware-Workstation-Full-26H1-25388281.x86_64/VMware-Workstation-Full-26H1-25388281.x86_64.bundle
+	source = VMware-Workstation-Full-26H1u1-25688693.x86_64.bundle::https://archive.org/download/VMware-Workstation-Full-26H1u1-25688693.x86_64/VMware-Workstation-Full-26H1u1-25688693.x86_64.bundle
 	source = https://packages-prod.broadcom.com/tools/frozen/linux/linux.iso
 	source = https://packages-prod.broadcom.com/tools/frozen/linux/linuxPreGlibc25.iso
 	source = https://packages-prod.broadcom.com/tools/frozen/netware/netware.iso

Comment

The change is a routine metadata refresh in .SRCINFO: it bumps the package version from 26H1 to 26H1u1, updates the bundled VMware installer filename/source URL to the corresponding upstream release, and refreshes the checksum for that source. The remaining sources still use HTTPS and there are no new build-time downloads, scripts, privilege changes, or suspicious dependencies introduced by this diff. I do note the removal of the vmware-keymaps dependency, but that is a packaging metadata change rather than a security issue in this context. Overall this looks low risk.

@@ -60,7 +59,7 @@ pkgbase = vmware-workstation
 	source = https://packages-prod.broadcom.com/tools/frozen/darwin/darwinPre15.iso
 	source = unlocker.py
 	source = efi-patches.txt
-	sha256sums = 3f6d2501e654dbc7701a8290ff6ffcfba6c5444cd5f35f4933cd08c9499f6d84
+	sha256sums = da823c853cc7e57be7b9b070c8aed20fe9d75fd519ae6f175ab1dafc7283002e
 	sha256sums = 4e66b286b743d9cf788c487295b1dec3c6071d657674f650aadc23e8900758ff
 	sha256sums = aef8f747bd9a6e84d139c57b8c1f8e87c83a9b9df69cd09602030190fec21973
 	sha256sums = 2c89993d811f5d90f7b0e2a286e9339907055e51ecb16f25509e5c4517326487

Comment

The change only bumps the upstream VMware Workstation version from 26H1 build 25388281 to 26H1u1 build 25688693 and resets pkgrel from 3 to 1. No build logic, sources, install scripts, permissions, or system integration files are modified in this hunk. Based on the provided diff alone, there are no new security red flags such as added network fetches, privilege escalation, persistence, or integrity bypasses.

@@ -15,10 +15,10 @@
 
 #PKGEXT=.pkg.tar
 pkgname=vmware-workstation
-pkgver=26H1
-_buildver=25388281
+pkgver=26H1u1
+_buildver=25688693
 _pkgver=${pkgver}_${_buildver}
-pkgrel=3
+pkgrel=1
 pkgdesc='The industry standard for running multiple operating systems as virtual machines on a single Linux PC.'
 arch=(x86_64)
 url='https://www.vmware.com/products/workstation-for-linux.html'

Comment

The only change in this diff is an updated sha256 checksum for the first source entry, corresponding to a new VMware Workstation bundle version (pkgver/_buildver also changed in the same PKGBUILD revision). The source URLs remain HTTPS and point to Broadcom/Archive.org, and there are no new build-time downloads, scripts, privilege changes, or packaging behavior changes in this hunk. On its face this is a routine integrity update rather than a security regression.

@@ -88,7 +88,7 @@ source=(
   'vmmon.patch'
   'vmnet.patch'
 )
-sha256sums=('3f6d2501e654dbc7701a8290ff6ffcfba6c5444cd5f35f4933cd08c9499f6d84'
+sha256sums=('da823c853cc7e57be7b9b070c8aed20fe9d75fd519ae6f175ab1dafc7283002e'
             '4e66b286b743d9cf788c487295b1dec3c6071d657674f650aadc23e8900758ff'
             'aef8f747bd9a6e84d139c57b8c1f8e87c83a9b9df69cd09602030190fec21973'
             '2c89993d811f5d90f7b0e2a286e9339907055e51ecb16f25509e5c4517326487'