Review Results

Comment

The only change in .SRCINFO is a version bump from 4.0.7 to 4.1.0. No source URLs, checksums, dependencies, install scripts, or build logic are changed in this diff, so there is no new security concern visible from the provided change alone. This appears to be a routine package update metadata change.

@@ -1,6 +1,6 @@
 pkgbase = patool
 	pkgdesc = portable command line archive file manager
-	pkgver = 4.0.7
+	pkgver = 4.1.0
 	pkgrel = 1
 	url = https://wummel.github.io/patool/
 	arch = any

Comment

The change is a straightforward version bump in .SRCINFO from patool 4.0.7 to 4.1.0, with the source URL and SHA256 updated accordingly. The source remains an HTTPS GitHub release tarball from the upstream project, and there are no new build-time commands, scripts, patches, binaries, or privilege-related changes in this diff. Based on the provided hunk alone, I see no security red flags.

@@ -15,7 +15,7 @@ pkgbase = patool
 	optdepends = 7zip: extracting various not natively supported formats (upstream suggested)
 	optdepends = unarchiver: extracting various not natively supported formats
 	optdepends = unrar: extracting RAR files
-	source = https://github.com/wummel/patool/releases/download/4.0.7/patool-4.0.7.tar.gz
-	sha256sums = 08dcb019997f55aa730a873185aeddbb397e2be757157769721942784cb4a97f
+	source = https://github.com/wummel/patool/releases/download/4.1.0/patool-4.1.0.tar.gz
+	sha256sums = 54c669b2af0f5e46d59a53f02ca4f83d53b3a7a25d50e97778582da7cea65daf
 
 pkgname = patool

Comment

The change is a straightforward version bump from patool 4.0.7 to 4.1.0 with the corresponding source tarball checksum update. The source is fetched over HTTPS from the project's GitHub releases page, there are no added build-time downloads, scripts, patches, or packaging changes, and no new persistence or privilege-related behavior is introduced in this diff. Based on the provided hunk, this appears low risk.

@@ -3,7 +3,7 @@
 # Contributor: Daniel Larsson <znixen@live.se>
 
 pkgname=patool
-pkgver=4.0.7
+pkgver=4.1.0
 pkgrel=1
 pkgdesc="portable command line archive file manager"
 arch=('any')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub release asset for the same package/version, with no new build steps, scripts, or network-fetching logic introduced. I did not find any security-relevant behavior change in this diff hunk.

@@ -16,7 +16,7 @@ optdepends=("lz4: extracting LZ4 archives"
     "unarchiver: extracting various not natively supported formats"
     "unrar: extracting RAR files")
 source=(https://github.com/wummel/${pkgname}/releases/download/${pkgver}/${pkgname}-${pkgver}.tar.gz)
-sha256sums=('08dcb019997f55aa730a873185aeddbb397e2be757157769721942784cb4a97f')
+sha256sums=('54c669b2af0f5e46d59a53f02ca4f83d53b3a7a25d50e97778582da7cea65daf')
 
 
 build() {