Version #2387 of qt5-doc · commit b879bc780f86 · status Reviewed
The only change in this .SRCINFO diff is a pkgrel bump from 2 to 3. No sources, checksums, build steps, install scripts, or package contents are altered, so there is no new security-relevant behavior introduced by this change. This appears to be a metadata-only rebuild/release increment.
@@ -1,6 +1,6 @@
pkgbase = qt5-doc
pkgver = 5.15.19
- pkgrel = 2
+ pkgrel = 3
url = https://www.qt.io
arch = any
groups = qt5
The change only bumps pkgrel from 2 to 3 in PKGBUILD. No sources, build steps, install scripts, dependencies, permissions, or packaging behavior changed. This is a metadata-only rebuild with no security impact visible in the provided diff.
@@ -6,7 +6,7 @@ pkgbase=qt5-doc
pkgname=(qt5-doc qt5-examples)
_basever=5.15.19
pkgver=$_basever
-pkgrel=2
+pkgrel=3
arch=('any')
url='https://www.qt.io'
license=('GPL3' 'LGPL3' 'FDL' 'custom')
The change is a small hardening tweak to the existing download logic: it now rejects non-HTTPS mirror URLs before re-downloading the Qt tarball and adds `--` to the curl invocation. This reduces the chance of fetching from an insecure or malformed URL and does not introduce new execution paths, privilege changes, or packaging side effects. The package still downloads a source tarball at build time, but that behavior pre-existed this diff and is constrained by checksum verification afterward. No obvious security regression is introduced by this hunk.
@@ -26,8 +26,11 @@ prepare() {
curl -fsSL -o "$_qt_tarball" "$_url"
if [ "$(head -c5 "$_qt_tarball")" = '<?xml' ]; then
_url=$(grep -oE '<url location="[^"]+" priority="[0-9]+">[^<]+</url>' "$_qt_tarball" | head -n1 | sed -E 's/^<url[^>]*>//; s@</url>$@@')
- test -n "$_url"
- curl -fsSL -o "$_qt_tarball" "$_url"
+ case "$_url" in
+ https://*) ;;
+ *) echo "prepare(): mirror URL '$_url' doesn't look like a real https URL" >&2; return 1 ;;
+ esac
+ curl -fsSL -o "$_qt_tarball" -- "$_url"
fi
echo "$_qt_sha256 $_qt_tarball" | sha256sum -c -
bsdtar -xf "$_qt_tarball"