Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 18 to 19. There are no source URL, checksum, dependency, install-script, or packaging-behavior changes visible here, so this diff does not introduce an obvious security risk by itself. Any security concerns would depend on the accompanying PKGBUILD/source changes, which are outside the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = stockfish
 	pkgdesc = A strong UCI chess engine
-	pkgver = 18
+	pkgver = 19
 	pkgrel = 1
 	epoch = 1
 	url = https://stockfishchess.org/

Comment

The change is a straightforward version bump in .SRCINFO from Stockfish 18 to 19 and updates the corresponding upstream GitHub archive and NNUE network source/checksums. The source URLs remain HTTPS and point to the official Stockfish project and its test network host; there are no new build-time downloads, scripts, privilege changes, or suspicious mirrors introduced in this diff. No security red flags are evident from the metadata-only update.

@@ -11,11 +11,9 @@ pkgbase = stockfish
 	license = GPL-3.0
 	depends = glibc
 	depends = gcc-libs
-	source = stockfish-18.zip::https://github.com/official-stockfish/Stockfish/archive/sf_18.zip
-	source = https://tests.stockfishchess.org/api/nn/nn-c288c895ea92.nnue
-	source = https://tests.stockfishchess.org/api/nn/nn-37f18f62d772.nnue
-	sha512sums = 1a0b36fc70146aefccc45a1647d04a5ac409df811a527fc7f679bb966271b5fd3348d3c9ecb3277ffcacda2dd760b6f06dbba677aa10b0553c445237e5ee544f
-	sha512sums = 9568d21d7b229ec9c8ee97363e94560858f3f44f4c6647ec11770f617b4a3b03cbcfa445c407f52a6104f281d43e19e0f461cc13c875218b543860ebc8411622
-	sha512sums = bf4d01f8cbff94dbff484636dd0351cd66f37eeaea7b7dbe16a3bfe231ae78cfabdeed040b789b64049c6063ef0dca21e4a4f332b99e49a52993e8595e372839
+	source = stockfish-19.zip::https://github.com/official-stockfish/Stockfish/archive/sf_19.zip
+	source = https://tests.stockfishchess.org/api/nn/nn-1a298aa575a0.nnue
+	sha512sums = 49e073b15cf56d1aab7e2e23d883e5d1737b3176441051ca42c2214f8b606b919b95c7a7ca47051e133c02a49d77f68ebb072398a1ed18b8f7a27fcb1773a2d0
+	sha512sums = 136a0f9725da7b692894a080d03d61bbfc67dcabf2f869b008891dbf042dfacb74c75df12a48bb9a9c736ce3accd670a55afae5ee40f090a0b86558e459c70bb
 
 pkgname = stockfish

Comment

The change only bumps pkgver from 18 to 19 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or dependency changes are introduced in the reviewed hunk. Based on this diff alone, there are no security-relevant red flags.

@@ -11,7 +11,7 @@
 # Contributor: HurricanePootis
 
 pkgname=stockfish
-pkgver=18
+pkgver=19
 pkgrel=1
 epoch=1
 pkgdesc="A strong UCI chess engine"

Comment

Low-risk packaging update. The change only bumps Stockfish from 18 to 19 and replaces two neural-network source downloads with a single upstream-hosted NNUE file, with updated SHA-512 checksums. The source URLs remain HTTPS and point to official upstream domains, there is no build-time network access beyond declared sources, and the prepare() step only creates a symlink inside the build tree. No privilege escalation, persistence, or suspicious packaging behavior is introduced by this diff.

@@ -19,19 +19,14 @@ arch=('x86_64' 'i686' 'armv7h' 'aarch64')
 url="https://stockfishchess.org/"
 license=('GPL-3.0')
 depends=('glibc' 'gcc-libs')
-# Check EvalFileDefaultName{Big,Small} in src/evaluate.h and change accordingly
-_net_name_big=('c288c895ea92')
-_net_name_small=('37f18f62d772')
+_net_name="nn-1a298aa575a0.nnue" # From EvalFileDefaultName in src/evaluate.h
 source=("$pkgname-$pkgver.zip::https://github.com/official-stockfish/Stockfish/archive/sf_$pkgver.zip"
-        "https://tests.stockfishchess.org/api/nn/nn-${_net_name_big}.nnue"
-        "https://tests.stockfishchess.org/api/nn/nn-${_net_name_small}.nnue")
-sha512sums=('1a0b36fc70146aefccc45a1647d04a5ac409df811a527fc7f679bb966271b5fd3348d3c9ecb3277ffcacda2dd760b6f06dbba677aa10b0553c445237e5ee544f'
-            '9568d21d7b229ec9c8ee97363e94560858f3f44f4c6647ec11770f617b4a3b03cbcfa445c407f52a6104f281d43e19e0f461cc13c875218b543860ebc8411622'
-            'bf4d01f8cbff94dbff484636dd0351cd66f37eeaea7b7dbe16a3bfe231ae78cfabdeed040b789b64049c6063ef0dca21e4a4f332b99e49a52993e8595e372839')
+        "https://tests.stockfishchess.org/api/nn/${_net_name}")
+sha512sums=('49e073b15cf56d1aab7e2e23d883e5d1737b3176441051ca42c2214f8b606b919b95c7a7ca47051e133c02a49d77f68ebb072398a1ed18b8f7a27fcb1773a2d0'
+            '136a0f9725da7b692894a080d03d61bbfc67dcabf2f869b008891dbf042dfacb74c75df12a48bb9a9c736ce3accd670a55afae5ee40f090a0b86558e459c70bb')
 
 prepare() {
-  ln -sf "${srcdir}/nn-${_net_name_big}.nnue" "Stockfish-sf_${pkgver}/src"
-  ln -sf "${srcdir}/nn-${_net_name_small}.nnue" "Stockfish-sf_${pkgver}/src"
+  ln -sf "${srcdir}/${_net_name}" "Stockfish-sf_${pkgver}/src"
 }
 
 build() {