Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the Oracle VirtualBox Extension Pack, updating the package version, dependency pin, noextract filename, source URL, and checksum to match the new upstream release. The source remains on the official HTTPS Oracle download host, there are no new build-time commands, scripts, or privilege-related changes, and no suspicious metadata such as added replaces/conflicts or extra sources. Based on the diff provided, this appears low risk.

@@ -1,15 +1,15 @@
 pkgbase = virtualbox-ext-oracle
 	pkgdesc = Oracle VM VirtualBox Extension Pack
-	pkgver = 7.2.16
+	pkgver = 7.2.18
 	pkgrel = 1
 	url = https://www.virtualbox.org/
 	arch = x86_64
 	license = custom:PUEL
-	depends = virtualbox=7.2.16
+	depends = virtualbox=7.2.18
 	optdepends = rdesktop: client to connect vm via RDP
-	noextract = Oracle_VirtualBox_Extension_Pack-7.2.16.vbox-extpack
+	noextract = Oracle_VirtualBox_Extension_Pack-7.2.18.vbox-extpack
 	options = !strip
-	source = https://download.virtualbox.org/virtualbox/7.2.16/Oracle_VirtualBox_Extension_Pack-7.2.16.vbox-extpack
-	sha256sums = d1e268cfa05223fd651703043af09f39dfb90da259ce9ec093d9d9b022f19689
+	source = https://download.virtualbox.org/virtualbox/7.2.18/Oracle_VirtualBox_Extension_Pack-7.2.18.vbox-extpack
+	sha256sums = e06834239947db06cc077d464bbb15d6441917ca03573e518506344dc28b64b9
 
 pkgname = virtualbox-ext-oracle

Comment

The change is a routine version bump in PKGBUILD from 7.2.16 to 7.2.18, with the corresponding source checksum updated. The source remains the official Oracle VirtualBox download over HTTPS, there are no new build steps, no added scripts, no network-at-build behavior, and no packaging/persistence red flags introduced by this diff. Risk is minimal.

@@ -2,7 +2,7 @@
 # Maintainer: Christian Hesse <mail@eworm.de>
 
 pkgname=virtualbox-ext-oracle
-pkgver=7.2.16
+pkgver=7.2.18
 _filever="${pkgver}"
 pkgrel=1
 pkgdesc='Oracle VM VirtualBox Extension Pack'

Comment

The change only updates the SHA-256 checksum for the Oracle VirtualBox Extension Pack source URL, which remains an HTTPS download from the official VirtualBox domain. No build logic, install scripts, permissions, or additional sources were introduced. This is a routine integrity update and does not add new security risk on its own.

@@ -14,7 +14,7 @@ optdepends=('rdesktop: client to connect vm via RDP')
 options=('!strip')
 source=("https://download.virtualbox.org/virtualbox/${_filever}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
 noextract=("Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
-sha256sums=('d1e268cfa05223fd651703043af09f39dfb90da259ce9ec093d9d9b022f19689')
+sha256sums=('e06834239947db06cc077d464bbb15d6441917ca03573e518506344dc28b64b9')
 
 prepare() {
   mkdir Oracle_VirtualBox_Extension_Pack/