Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 3.6.15 to 3.7.16. No source URLs, checksums, build commands, install scripts, permissions, or packaging metadata changed in the reviewed hunk. On its face this is a routine upstream version update with no new security red flags visible in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = joplin-appimage
 	pkgdesc = The latest stable AppImage of Joplin - a cross-platform note taking and to-do app
-	pkgver = 3.6.15
+	pkgver = 3.7.16
 	pkgrel = 1
 	url = https://github.com/laurent22/joplin
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from Joplin 3.6.15 to 3.7.16, with the corresponding LICENSE URL and updated sha512 checksum. The sources remain HTTPS and point to the official upstream GitHub release assets/raw license path, with no new build-time execution, no added scripts, and no suspicious metadata beyond the existing AppImage packaging. The added !debug option is not inherently malicious in this context. Overall this looks like a routine maintenance update with low security risk.

@@ -8,9 +8,10 @@ pkgbase = joplin-appimage
 	depends = fuse2
 	conflicts = joplin-desktop
 	options = !strip
-	source = https://github.com/laurent22/joplin/releases/download/v3.6.15/Joplin-3.6.15.AppImage
-	source = https://github.com/laurent22/joplin/raw/v3.6.15/LICENSE
-	sha512sums = 1acf483b4d8cc1c56b277bf02c86b04fb2b466b776b458f5f086cce24031b3b7c4bdc696f9564b401dcc92c591ec0a4a2767b26ce798ff5d5323517e993feeec
+	options = !debug
+	source = https://github.com/laurent22/joplin/releases/download/v3.7.16/Joplin-3.7.16.AppImage
+	source = https://github.com/laurent22/joplin/raw/v3.7.16/LICENSE
+	sha512sums = 4c8a1ffaf2082241f8d3bc99e72b5640df1dacdf04e1dc7022ca5fd6f884d52fa778476e513990daa236921100e817c8aa8b8ba3f099956a200f65713a7db0a4
 	sha512sums = SKIP
 
 pkgname = joplin-appimage

Comment

The change is a simple version bump in PKGBUILD from 3.6.15 to 3.7.16 with no accompanying changes to source URLs, checksums, build logic, install scripts, or packaging behavior in the provided diff. On its face this does not introduce new execution paths, privilege changes, or integrity issues. I did not see any suspicious additions in the reviewed hunk.

@@ -1,7 +1,7 @@
 # Maintainer: thynkon <thynkon at protonmail dot com>
 
 pkgname=joplin-appimage
-pkgver=3.6.15
+pkgver=3.7.16
 pkgrel=1
 pkgdesc="The latest stable AppImage of Joplin - a cross-platform note taking and to-do app"
 arch=('x86_64')

Comment

The change is low risk. It only bumps the AppImage version, updates the corresponding SHA-512 checksum, and adjusts the internal desktop-file name to match the new upstream AppImage layout. The source URLs remain pinned to a specific release tag on the official GitHub repository over HTTPS, and there are no new build-time downloads, scripts, privilege changes, or packaging actions outside the normal AppImage extraction/install flow. The added !debug option is not a security concern here because the package already disables stripping and ships a prebuilt AppImage.

@@ -9,17 +9,17 @@ url="https://github.com/laurent22/joplin"
 license=('MIT')
 conflicts=('joplin-desktop')
 depends=('fuse2')
-options=(!strip)
+options=(!strip !debug)
 source=(
   ${url}/releases/download/v${pkgver}/Joplin-${pkgver}.AppImage
   ${url}/raw/v${pkgver}/LICENSE
 )
 sha512sums=(
-  1acf483b4d8cc1c56b277bf02c86b04fb2b466b776b458f5f086cce24031b3b7c4bdc696f9564b401dcc92c591ec0a4a2767b26ce798ff5d5323517e993feeec
+  4c8a1ffaf2082241f8d3bc99e72b5640df1dacdf04e1dc7022ca5fd6f884d52fa778476e513990daa236921100e817c8aa8b8ba3f099956a200f65713a7db0a4
   SKIP
 )
 _filename="Joplin-${pkgver}.AppImage"
-_squashfs_desktop_file="joplin.desktop"
+_squashfs_desktop_file="appimagekit-joplin.desktop"
 _squashfs_icon_file="joplin.png"
 _desktop_file="/usr/share/applications/joplin.desktop"
 _appimage_name=$(echo "${_filename}" | sed -E 's/-[0-9]*.[0-9]*.[0-9]*//')