Review Results

Comment

The .SRCINFO update is a routine version bump from snapd 2.76.2 to 2.77.1 and removes an old patch entry that is no longer needed. The source remains an HTTPS GitHub release artifact, with no new build-time network fetches, scripts, privilege changes, or suspicious metadata introduced by this diff. Based on the provided change alone, I do not see a security issue.

@@ -1,7 +1,7 @@
 pkgbase = snapd
 	pkgdesc = Service and tools for management of snap packages.
-	pkgver = 2.76.2
-	pkgrel = 2
+	pkgver = 2.77.1
+	pkgrel = 1
 	url = https://github.com/snapcore/snapd
 	install = snapd.install
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates pkgver/pkgrel and replaces the old vendor tarball source with the new upstream GitHub release tarball over HTTPS. The removed patch source is consistent with the package no longer needing that patch at the new version. No suspicious URLs, no build-time network additions, no privilege/persistence mechanisms, and no integrity red flags are introduced by this metadata-only update.

@@ -31,9 +31,7 @@ pkgbase = snapd
 	options = !strip
 	options = emptydirs
 	options = !lto
-	source = snapd-2.76.2.tar.xz::https://github.com/snapcore/snapd/releases/download/2.76.2/snapd_2.76.2.vendor.tar.xz
-	source = 0001-tests-fix-json-error-assertions-for-Go-1.27-17472.patch
-	sha256sums = 873fedb8525057c2b276003c2f90c2e5f7b541ec1bb409a6f489c51b5c72af2b
-	sha256sums = 0a091ec38ffbe653db698a96ae3486233746711da138e2e5793cff97b523f3f2
+	source = snapd-2.77.1.tar.xz::https://github.com/snapcore/snapd/releases/download/2.77.1/snapd_2.77.1.vendor.tar.xz
+	sha256sums = 10c824694cd9c9954ba7a826d245458d8fa1006d49937fe480dc9f36b57b1efc
 
 pkgname = snapd

Comment

The change is a routine version bump from 2.76.2 to 2.77.1 with pkgrel reset and the old patch source removed. The remaining source is still fetched over HTTPS from the official snapcore GitHub release URL, and there are no new build-time downloads, shell-eval patterns, privilege escalation, or packaging/install-script changes in this diff. I did not see any integrity regression introduced by this hunk alone; the removed patch simply means the upstream tarball now presumably incorporates that fix. Overall this looks low risk.

@@ -8,8 +8,8 @@ pkgdesc="Service and tools for management of snap packages."
 depends=('squashfs-tools' 'libseccomp' 'libsystemd' 'libcap' 'apparmor')
 optdepends=('bash-completion: bash completion support'
             'xdg-desktop-portal: desktop integration')
-pkgver=2.76.2
-pkgrel=2
+pkgver=2.77.1
+pkgrel=1
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')
 url="https://github.com/snapcore/snapd"
 license=('GPL3')

Comment

The change updates snapd to a new upstream release and removes a patch that was only needed for the previous version's test suite. The remaining source is still fetched over HTTPS from the official GitHub release URL, and there are no new build-time downloads, shell-eval patterns, privilege escalation, or packaging changes that would affect runtime behavior. The removed patch appears to be a benign test fix, so dropping it with the version bump is expected. Overall this looks low risk.

@@ -19,11 +19,9 @@ options=('!strip' 'emptydirs' '!lto')
 install=snapd.install
 source=(
     "$pkgname-$pkgver.tar.xz::https://github.com/snapcore/${pkgname}/releases/download/${pkgver}/${pkgname}_${pkgver}.vendor.tar.xz"
-    "0001-tests-fix-json-error-assertions-for-Go-1.27-17472.patch"
 )
 
-sha256sums=('873fedb8525057c2b276003c2f90c2e5f7b541ec1bb409a6f489c51b5c72af2b'
-           '0a091ec38ffbe653db698a96ae3486233746711da138e2e5793cff97b523f3f2')
+sha256sums=('10c824694cd9c9954ba7a826d245458d8fa1006d49937fe480dc9f36b57b1efc')
 
 
 prepare() {