Review Results

Comment

The only change in this diff is a pkgrel bump in .SRCINFO from 4 to 5. This is metadata-only and does not alter sources, build steps, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by this change.

@@ -1,7 +1,7 @@
 pkgbase = vesktop-bin
 	pkgdesc = A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.
 	pkgver = 1.6.7
-	pkgrel = 4
+	pkgrel = 5
 	url = https://vesktop.dev/
 	arch = aarch64
 	arch = x86_64

Comment

The change is limited to .SRCINFO metadata and appears to correct source integrity metadata rather than introduce new behavior. The icon source is moved from the upstream repo's moving main branch to a pinned v1.6.7 tag, which is safer and improves reproducibility. The aarch64 checksum is updated to match the referenced release artifact. No new build-time execution, privilege escalation, persistence, or suspicious external sources are introduced in this diff.

@@ -19,12 +19,12 @@ pkgbase = vesktop-bin
 	noextract = vesktop-1.6.7.tar.gz
 	source = vesktop.sh
 	source = vesktop.desktop
-	source = https://raw.githubusercontent.com/Vencord/Vesktop/refs/heads/main/build/icon.svg
+	source = https://github.com/Vencord/Vesktop/raw/refs/tags/v1.6.7/build/icon.svg
 	sha256sums = db901fa9af0ce812f48ecba9c338162bd5b12f6586fefca2bc6b6509430ea351
 	sha256sums = 455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46
 	sha256sums = 7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f
 	source_aarch64 = vesktop-1.6.7.tar.gz::https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7-arm64.tar.gz
-	sha256sums_aarch64 = 152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66
+	sha256sums_aarch64 = 23841d3348aa4addd7ca7301172d927feb1ad6e62b1bf288871004d65d154f7f
 	source_x86_64 = https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7.tar.gz
 	sha256sums_x86_64 = 152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66
 

Comment

This change only bumps pkgrel from 4 to 5 in PKGBUILD without altering sources, build steps, dependencies, install scripts, or packaged artifacts. No security-relevant behavior changes are introduced by the diff shown.

@@ -7,7 +7,7 @@ pkgname=vesktop-bin
 _pkgname=vesktop
 _appname=vencord-desktop
 pkgver=1.6.7
-pkgrel=4
+pkgrel=5
 pkgdesc="A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed."
 arch=(
     'aarch64'

Comment

The change is low risk and improves source integrity: it replaces a floating GitHub raw URL from the main branch with a version-pinned tag URL for the icon asset. That reduces supply-chain risk by avoiding an unpinned moving target. The checksum update for aarch64 is consistent with the source change. No new build-time network access, execution, privilege escalation, or packaging red flags are introduced by this diff.

@@ -36,13 +36,13 @@ source_x86_64=("${_ghurl}/releases/download/v${pkgver}/${_pkgname}-${pkgver}.tar
 source=(
     "${_pkgname}.sh"
     "${_pkgname}.desktop"
-    "https://raw.githubusercontent.com/Vencord/Vesktop/refs/heads/main/build/icon.svg"
+    "${_ghurl}/raw/refs/tags/v${pkgver}/build/icon.svg"
 )
 noextract=("${_pkgname}-${pkgver}.tar.gz")
 sha256sums=('db901fa9af0ce812f48ecba9c338162bd5b12f6586fefca2bc6b6509430ea351'
             '455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46'
             '7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f')
-sha256sums_aarch64=('152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66')
+sha256sums_aarch64=('23841d3348aa4addd7ca7301172d927feb1ad6e62b1bf288871004d65d154f7f')
 sha256sums_x86_64=('152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66')
 
 prepare() {