Review Results

Comment

The change only bumps android-ndk from r29 to r30 and updates the corresponding checksums for the upstream Google-hosted zip and the helper script. The source remains HTTPS on the official developer.android.com / dl.google.com domains, with no new build-time network access, no added scripts, and no packaging logic changes. I don’t see any integrity or persistence red flags in this diff alone.

@@ -5,8 +5,8 @@
 # Contributor: frownlee <florez.brownlee@gmail.com>
 
 pkgname=android-ndk
-pkgver=r29
-pkgrel=3
+pkgver=r30
+pkgrel=1
 pkgdesc='Android C/C++ developer kit'
 arch=('x86_64')
 url='https://developer.android.com/ndk/'

Comment

The change is a straightforward version bump from r29 to r30 with updated checksums for the upstream Google-hosted zip and accompanying script. I do not see any new sources, build-time network access, privilege escalation, install-script changes, or packaging logic changes. The only security-relevant effect is that integrity hashes were updated to match the new upstream release artifact, which is expected for a package update.

@@ -30,11 +30,11 @@ source=("$pkgname.sh"
 source_x86_64=("https://dl.google.com/android/repository/$pkgname-$pkgver-linux.zip")
 # SHA1 sums are kept to follow upstream releases https://github.com/android-ndk/ndk/issues/673
 sha1sums=('38c46b7b1a1c54a0845d027a8eaf37ed0447d3b2'
-          '16ec24701b7b22fd2ffaec85bee867b68ae08f8f')
-sha1sums_x86_64=('87e2bb7e9be5d6a1c6cdf5ec40dd4e0c6d07c30b')
+          'dd75606f8d8e062813c10f72521d90ab5a261d1e')
+sha1sums_x86_64=('5107f898313790e449e87eee2183d9a20602dee9')
 sha256sums=('2050ff500443f6cfa4567c02248cb3ec6ccbc67ce81b32d8dda79383c5103db2'
-            'a55858ecc309963d081775b919754589a672fb59c207f920cc1d082aaf4e3237')
-sha256sums_x86_64=('4abbbcdc842f3d4879206e9695d52709603e52dd68d3c1fff04b3b5e7a308ecf')
+            '966d15d98d85f46f4850faa0ff2a630c03ddc9e398683d3d6170564e4fc4f32b')
+sha256sums_x86_64=('753611f410d002cfcd3f3dc2ef49aad532089d3180b436c060a90bf0fcb64df2')
 
 package() {
   # Extract full version from source.properties for versioned symlink

Comment

The change is a formatting/minification-only edit to package.xml: it removes unused XML namespace declarations and collapses whitespace, while preserving the same Android SDK license text and repository structure. There are no added sources, scripts, commands, or packaging behaviors, so I see no security impact from this diff alone.

@@ -1,6 +1,4 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<ns2:repository xmlns:ns2="http://schemas.android.com/repository/android/common/02" xmlns:ns3="http://schemas.android.com/repository/android/common/01" xmlns:ns4="http://schemas.android.com/repository/android/generic/01" xmlns:ns5="http://schemas.android.com/repository/android/generic/02" xmlns:ns6="http://schemas.android.com/sdk/android/repo/repository2/01" xmlns:ns7="http://schemas.android.com/sdk/android/repo/repository2/02" xmlns:ns8="http://schemas.android.com/sdk/android/repo/repository2/03" xmlns:ns9="http://schemas.android.com/sdk/android/repo/addon2/01" xmlns:ns10="http://schemas.android.com/sdk/android/repo/addon2/02" xmlns:ns11="http://schemas.android.com/sdk/android/repo/addon2/03" xmlns:ns12="http://schemas.android.com/sdk/android/repo/sys-img2/04" xmlns:ns13="http://schemas.android.com/sdk/android/repo/sys-img2/03" xmlns:ns14="http://schemas.android.com/sdk/android/repo/sys-img2/02" xmlns:ns15="http://schemas.android.com/sdk/android/repo/sys-img2/01">
-    <license id="android-sdk-license" type="text">Terms and Conditions
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?><ns2:repository xmlns:ns2="http://schemas.android.com/repository/android/common/01" xmlns:ns3="http://schemas.android.com/repository/android/generic/01" xmlns:ns4="http://schemas.android.com/sdk/android/repo/addon2/01" xmlns:ns5="http://schemas.android.com/sdk/android/repo/repository2/01" xmlns:ns6="http://schemas.android.com/sdk/android/repo/sys-img2/01"><license id="android-sdk-license" type="text">Terms and Conditions
 
 This is the Android Software Development Kit License Agreement
 

Comment

The change is a straightforward metadata update in package.xml, replacing the listed NDK localPackage entry from 29.0.14206865 to 30.0.16248370 and compacting the XML onto one line. There are no added scripts, downloads, privilege changes, or packaging logic. The only notable aspect is that the XML namespace prefix for xsi:type changes from ns5 to ns3, but this appears to be an artifact of serialization rather than a functional change. No security-relevant behavior is introduced by this diff.

@@ -140,15 +138,4 @@ This is the Android Software Development Kit License Agreement
 14.7 The License Agreement, and your relationship with Google under the License Agreement, shall be governed by the laws of the State of California without regard to its conflict of laws provisions. You and Google agree to submit to the exclusive jurisdiction of the courts located within the county of Santa Clara, California to resolve any legal matter arising from the License Agreement. Notwithstanding this, you agree that Google shall still be allowed to apply for injunctive remedies (or an equivalent type of urgent legal relief) in any jurisdiction.
 
 
-January 16, 2019</license>
-    <localPackage path="ndk;29.0.14206865" obsolete="false">
-        <type-details xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ns5:genericDetailsType"/>
-        <revision>
-            <major>29</major>
-            <minor>0</minor>
-            <micro>14206865</micro>
-        </revision>
-        <display-name>NDK (Side by side) 29.0.14206865</display-name>
-        <uses-license ref="android-sdk-license"/>
-    </localPackage>
-</ns2:repository>
+January 16, 2019</license><localPackage path="ndk;30.0.16248370" obsolete="false"><type-details xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ns3:genericDetailsType"/><revision><major>30</major><minor>0</minor><micro>16248370</micro></revision><display-name>NDK (Side by side) 30.0.16248370</display-name><uses-license ref="android-sdk-license"/></localPackage></ns2:repository>
\ No newline at end of file