Review Results

Comment

The change is a routine version bump in .SRCINFO for the NVIDIA beta package: pkgver/provides/dependency pins and the upstream installer URL/checksums were updated accordingly. I do note the source URL still uses HTTP rather than HTTPS, which is a supply-chain integrity concern in general, but this is pre-existing in the package and not introduced by this diff. No new suspicious sources, scripts, or packaging behaviors are added here.

@@ -1,23 +1,23 @@
 pkgbase = nvidia-beta
 	pkgdesc = NVIDIA kernel module (beta version)
-	pkgver = 610.57.04
+	pkgver = 615.71.09
 	pkgrel = 1
 	url = https://www.nvidia.com/
 	arch = x86_64
 	license = LicenseRef-Custom
 	makedepends = dkms
 	makedepends = linux-headers
-	provides = nvidia=610.57.04
-	provides = nvidia-beta=610.57.04
+	provides = nvidia=615.71.09
+	provides = nvidia-beta=615.71.09
 	provides = NVIDIA-MODULE
 	conflicts = nvidia
 	options = !strip
-	source = http://us.download.nvidia.com/XFree86/Linux-x86_64/610.57.04/NVIDIA-Linux-x86_64-610.57.04-no-compat32.run
+	source = http://us.download.nvidia.com/XFree86/Linux-x86_64/615.71.09/NVIDIA-Linux-x86_64-615.71.09-no-compat32.run
 	source = 110-nvidia-change-dkms-conf.patch
-	sha256sums = 83619d878211aadf4c7e1c5de3d2a865c9936fb2dfa5c1b4c3aabccc20c3f283
-	sha256sums = 03bb209054fba81aea3b16f4dc241b83612f2bb2267435e9f9e33b40966a79d7
+	sha256sums = e5545862c291f3991a91ee40dd9c7a71cccc69247a193d5e5b891bfd964ac104
+	sha256sums = 5a94430787c3e75c896af0a2af616491ec71ea60cc999f90fb5f17d9f0fe07ac
 
 pkgname = nvidia-beta
 	depends = libglvnd
 	depends = linux
-	depends = nvidia-utils-beta=610.57.04
+	depends = nvidia-utils-beta=615.71.09

Comment

The change is limited to updating the hardcoded DKMS package version in a patch from 610.57.04 to 615.71.09. This does not introduce new commands, network access, privilege changes, persistence, or packaging behavior; it only tracks a newer NVIDIA driver release. Based on the provided hunk alone, there is no evident security issue.

@@ -3,7 +3,7 @@
 @@ -1,12 +1,21 @@
  PACKAGE_NAME="nvidia"
 -PACKAGE_VERSION="__VERSION_STRING"
-+PACKAGE_VERSION="610.57.04"
++PACKAGE_VERSION="615.71.09"
  AUTOINSTALL="yes"
  
  # By default, DKMS will add KERNELRELEASE to the make command line; however,

Comment

The change is a straightforward version bump of the NVIDIA beta package from 610.57.04 to 615.71.09, with corresponding checksum updates for the upstream .run installer and the existing patch. The source remains the official NVIDIA download URL over HTTP in the PKGBUILD, which is a pre-existing integrity concern, but this diff does not introduce new suspicious sources, build-time network access, privilege escalation, or packaging behavior changes. No additional code paths or scripts were modified beyond the version/checksum metadata.

@@ -4,7 +4,7 @@
 # Contributor: Dan Vratil
 
 pkgname=nvidia-beta
-pkgver=610.57.04
+pkgver=615.71.09
 pkgrel=1
 pkgdesc="NVIDIA kernel module (beta version)"
 arch=('x86_64')

Comment

The change is a straightforward version bump of the NVIDIA beta driver and checksum refresh. The PKGBUILD still downloads the official upstream release over HTTP from NVIDIA’s domain, but that was already present in the package and the new hashes pin the exact tarball contents. The accompanying patch only adjusts dkms.conf to use the new version and module list; it does not introduce new network access, privilege escalation, persistence, or packaging writes outside $pkgdir. No additional red flags are visible in this diff alone.

@@ -19,8 +19,8 @@ options=('!strip')
 _pkg="NVIDIA-Linux-${CARCH}-${pkgver}-no-compat32"
 source=("http://us.download.nvidia.com/XFree86/Linux-${CARCH}/${pkgver}/${_pkg}.run"
         '110-nvidia-change-dkms-conf.patch')
-sha256sums=('83619d878211aadf4c7e1c5de3d2a865c9936fb2dfa5c1b4c3aabccc20c3f283'
-            '03bb209054fba81aea3b16f4dc241b83612f2bb2267435e9f9e33b40966a79d7')
+sha256sums=('e5545862c291f3991a91ee40dd9c7a71cccc69247a193d5e5b891bfd964ac104'
+            '5a94430787c3e75c896af0a2af616491ec71ea60cc999f90fb5f17d9f0fe07ac')
 
 prepare() {
     # extract the source file