Review Results

Comment

The change only bumps the package version in .SRCINFO from r29 to r30 and resets pkgrel from 3 to 1. No source URLs, checksums, build steps, install scripts, or packaging logic are changed in the provided diff hunk. On its face this is a routine metadata update with no direct security impact. I did not see any indicators of supply-chain risk in the reviewed hunk itself.

@@ -1,7 +1,7 @@
 pkgbase = android-ndk
 	pkgdesc = Android C/C++ developer kit
-	pkgver = r29
-	pkgrel = 3
+	pkgver = r30
+	pkgrel = 1
 	url = https://developer.android.com/ndk/
 	install = android-ndk.install
 	arch = x86_64

Comment

The change only updates the pinned upstream Android NDK release from r29 to r30 and refreshes the corresponding checksums in .SRCINFO. The source remains the official Google HTTPS download URL, with no new build-time code execution, no added scripts, and no suspicious extra sources or privilege-related changes. This is a routine version bump with integrity metadata updates only.

@@ -26,11 +26,11 @@ pkgbase = android-ndk
 	source = android-ndk.sh
 	source = package.xml
 	sha1sums = 38c46b7b1a1c54a0845d027a8eaf37ed0447d3b2
-	sha1sums = 16ec24701b7b22fd2ffaec85bee867b68ae08f8f
+	sha1sums = dd75606f8d8e062813c10f72521d90ab5a261d1e
 	sha256sums = 2050ff500443f6cfa4567c02248cb3ec6ccbc67ce81b32d8dda79383c5103db2
-	sha256sums = a55858ecc309963d081775b919754589a672fb59c207f920cc1d082aaf4e3237
-	source_x86_64 = https://dl.google.com/android/repository/android-ndk-r29-linux.zip
-	sha1sums_x86_64 = 87e2bb7e9be5d6a1c6cdf5ec40dd4e0c6d07c30b
-	sha256sums_x86_64 = 4abbbcdc842f3d4879206e9695d52709603e52dd68d3c1fff04b3b5e7a308ecf
+	sha256sums = 966d15d98d85f46f4850faa0ff2a630c03ddc9e398683d3d6170564e4fc4f32b
+	source_x86_64 = https://dl.google.com/android/repository/android-ndk-r30-linux.zip
+	sha1sums_x86_64 = 5107f898313790e449e87eee2183d9a20602dee9
+	sha256sums_x86_64 = 753611f410d002cfcd3f3dc2ef49aad532089d3180b436c060a90bf0fcb64df2
 
 pkgname = android-ndk