Review Results

Comment

The only change is a metadata-only bump of pkgrel and a dramatic epoch increase from 1 to 25688693. In Arch packaging, epoch is used to force version ordering; setting it to an absurdly large value can pin this package above future legitimate upstream versions and make downgrades/updates harder, which is a supply-chain integrity concern. There is no direct code execution or payload change in this diff, but the epoch manipulation is suspicious and could be used to prevent users from receiving newer fixes from the normal package stream.

@@ -1,8 +1,8 @@
 pkgbase = vmware-workstation
 	pkgdesc = The industry standard for running multiple operating systems as virtual machines on a single Linux PC.
 	pkgver = 26H1u1
-	pkgrel = 2
-	epoch = 1
+	pkgrel = 3
+	epoch = 25688693
 	url = https://www.vmware.com/products/workstation-for-linux.html
 	install = vmware-workstation.install
 	arch = x86_64

Comment

This change only alters package metadata: it bumps pkgrel and changes epoch from a small fixed value to the upstream build number. I do not see any code execution, source, install-script, or packaging-path changes. The epoch change is unusual and can affect version ordering, but by itself it is not a security issue in this diff. No integrity or persistence concerns are introduced here.

@@ -18,8 +18,8 @@ pkgname=vmware-workstation
 pkgver=26H1u1
 _buildver=25688693
 _pkgver=${pkgver}_${_buildver}
-pkgrel=2
-epoch=1
+pkgrel=3
+epoch=${_buildver}
 pkgdesc='The industry standard for running multiple operating systems as virtual machines on a single Linux PC.'
 arch=(x86_64)
 url='https://www.vmware.com/products/workstation-for-linux.html'