Version #2406 of python2 · commit 31ae76c76f62 · status Reviewed
The change only bumps pkgrel in .SRCINFO from 17 to 18. No sources, build steps, dependencies, install scripts, or packaged artifacts are altered by this diff, so there is no new security risk evident from the reviewed change.
@@ -1,7 +1,7 @@
pkgbase = python2
pkgdesc = A high-level scripting language
pkgver = 2.7.18
- pkgrel = 17
+ pkgrel = 18
url = https://www.python.org/
arch = x86_64
arch = aarch64
The change only swaps one source URL in .SRCINFO from a Gentoo-hosted tarball to a mirrorservice.org URL for the same named patchset. This is a supply-chain integrity concern in principle because it changes the download origin, but the artifact name/version remain the same, the source is still HTTPS, and there is no evidence in the diff of added build-time execution, new dependencies, or packaging behavior changes. Since .SRCINFO is metadata only and the package still pins the source by checksum in the PKGBUILD context, I do not see a high-confidence security issue from this change alone.
@@ -31,7 +31,7 @@ pkgbase = python2
source = https://www.python.org/ftp/python/2.7.18/Python-2.7.18.tar.xz
source = https://www.python.org/ftp/python/2.7.18/Python-2.7.18.tar.xz.asc
source = mtime-workaround.patch
- source = https://dev.gentoo.org/~mgorny/dist/python/python-gentoo-patches-2.7.18_p16.tar.xz
+ source = https://www.mirrorservice.org/sites/www.ibiblio.org/gentoo/pub/proj/python/patchsets/2.7/python-gentoo-patches-2.7.18_p16.tar.xz
validpgpkeys = C01E1CAD5EA2C4F0B8E3571504C367C218ADD4FF
sha512sums = a7bb62b51f48ff0b6df0b18f5b0312a523e3110f49c3237936bfe56ed0e26838c0274ff5401bda6fc21bf24337477ccac49e8026c5d651e4b4cafb5eb5086f6c
sha512sums = SKIP
The change only bumps pkgrel from 17 to 18 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or package contents. No security-relevant behavior is introduced by this diff.
@@ -7,7 +7,7 @@
pkgname=python2
pkgver=2.7.18
-pkgrel=17
+pkgrel=18
_pybasever=2.7
pkgdesc="A high-level scripting language"
arch=('x86_64' 'aarch64' 'i686' 'pentium4')
The change only swaps the Gentoo patchset download from dev.gentoo.org to mirrorservice.org/ibiblio while keeping HTTPS and the same pinned tarball name/checksum. There is no new build-time code execution, no added install script, and no change to package contents beyond the source URL. The main risk is supply-chain trust in a mirror, but the archive is still integrity-checked by sha512 and the upstream Python source remains signed. Overall this looks like a low-risk mirror substitution.
@@ -23,7 +23,7 @@ conflicts=('python<3')
_gentoo_patches="python-gentoo-patches-${pkgver}_p16"
source=("https://www.python.org/ftp/python/${pkgver%rc?}/Python-${pkgver}.tar.xz"{,.asc}
mtime-workaround.patch
- "https://dev.gentoo.org/~mgorny/dist/python/$_gentoo_patches.tar.xz")
+ "https://www.mirrorservice.org/sites/www.ibiblio.org/gentoo/pub/proj/python/patchsets/2.7/$_gentoo_patches.tar.xz")
sha512sums=('a7bb62b51f48ff0b6df0b18f5b0312a523e3110f49c3237936bfe56ed0e26838c0274ff5401bda6fc21bf24337477ccac49e8026c5d651e4b4cafb5eb5086f6c'
'SKIP'
'4e761cfd57791e8b72ecdf84c2e03875bf074311130eea5b8e97409fa304fa3468dbd359a511c4e9978e686e662c58054b4174d3e73f845fa9ded2e83a3a8076'