Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 6.3.3 to 6.4.0 for the existing swift-bin package. No new sources, URLs, checksums, install scripts, permissions, or packaging logic are introduced by this diff, so there is no direct security signal in the reviewed change itself. Any risk would depend on the corresponding PKGBUILD/source update, which is outside this hunk.

@@ -1,6 +1,6 @@
 pkgbase = swift-bin
 	pkgdesc = Binary builds of the Swift programming language
-	pkgver = 6.3.3
+	pkgver = 6.4.0
 	pkgrel = 1
 	url = https://www.swift.org/
 	arch = x86_64

Comment

The change only updates the pinned upstream Swift release tarball URLs and their corresponding SHA-256 checksums in .SRCINFO, from 6.3.3/ubi9 to 6.4.0/ubi10 for x86_64 and aarch64. This is a normal version bump with no new sources, no build-time execution, no install-script changes, and no integrity regression visible in the diff. The sources remain HTTPS and are still pinned to specific release artifacts with checksums.

@@ -14,9 +14,9 @@ pkgbase = swift-bin
 	provides = swift-language
 	replaces = swift-language-bin
 	options = !strip
-	source_x86_64 = https://download.swift.org/swift-6.3.3-release/ubi9/swift-6.3.3-RELEASE/swift-6.3.3-RELEASE-ubi9.tar.gz
-	sha256sums_x86_64 = 8ba5af53510ea2e224d814b9c568825e87904328b4a8c1d73b2f7ac7fc892406
-	source_aarch64 = https://download.swift.org/swift-6.3.3-release/ubi9-aarch64/swift-6.3.3-RELEASE/swift-6.3.3-RELEASE-ubi9-aarch64.tar.gz
-	sha256sums_aarch64 = 626f52eb79f27305a5e7c2dff682112ef2f81c0ba8380fd9df7c1559533b11f7
+	source_x86_64 = https://download.swift.org/swift-6.4.0-release/ubi10/swift-6.4.0-RELEASE/swift-6.4.0-RELEASE-ubi10.tar.gz
+	sha256sums_x86_64 = 50863678e3bafd91fcbc94c0bb76610bab37c1ee01e335fc7d8616904e03e19a
+	source_aarch64 = https://download.swift.org/swift-6.4.0-release/ubi10-aarch64/swift-6.4.0-RELEASE/swift-6.4.0-RELEASE-ubi10-aarch64.tar.gz
+	sha256sums_aarch64 = 641931cd5fdd4d17e47b75b959ba21d67d0f5749cb7d14c854971b49e23bfbd2
 
 pkgname = swift-bin

Comment

The change is a straightforward version bump for a binary package: it updates the upstream Swift release URL from ubi9 to ubi10, refreshes the corresponding SHA256 checksums, and adjusts the package() copy path accordingly. The source remains HTTPS from the official Swift download site, there are no new build-time downloads, scripts, privilege changes, or suspicious packaging behaviors introduced by this diff. The only notable metadata change is the optdepends Python version update, which is consistent with the new release and not security-relevant.

@@ -4,7 +4,7 @@
 # Contributor: Frederic Bezies <fredbezies at gmail dot com>, youngunix <>
 
 pkgname=swift-bin
-pkgver=6.3.3
+pkgver=6.4.0
 pkgrel=1
 pkgdesc="Binary builds of the Swift programming language"
 arch=('x86_64' 'aarch64')

Comment

The change only updates the upstream Swift binary tarball URLs and their SHA256 checksums from UBI9 to UBI10 for both x86_64 and aarch64, and adjusts the REPL optional dependency from python39 to python312. The sources remain HTTPS on the official swift.org download host, there is no new build-time code execution, no added network fetching outside source=(), and no packaging/persistence red flags. This looks like a routine upstream version/platform refresh with integrity hashes updated accordingly.

@@ -12,14 +12,14 @@ url="https://www.swift.org/"
 license=('apache')
 depends=('util-linux-libs' 'libxml2-legacy' 'ncurses')
 makedepends=('patchelf')
-optdepends=('python39: required for REPL')
+optdepends=('python312: required for REPL')
 options=('!strip')
 provides=('swift-language')
 replaces=('swift-language-bin')
-source_x86_64=("https://download.swift.org/swift-$pkgver-release/ubi9/swift-$pkgver-RELEASE/swift-$pkgver-RELEASE-ubi9.tar.gz")
-source_aarch64=("https://download.swift.org/swift-$pkgver-release/ubi9-aarch64/swift-$pkgver-RELEASE/swift-$pkgver-RELEASE-ubi9-aarch64.tar.gz")
-sha256sums_x86_64=('8ba5af53510ea2e224d814b9c568825e87904328b4a8c1d73b2f7ac7fc892406')
-sha256sums_aarch64=('626f52eb79f27305a5e7c2dff682112ef2f81c0ba8380fd9df7c1559533b11f7')
+source_x86_64=("https://download.swift.org/swift-$pkgver-release/ubi10/swift-$pkgver-RELEASE/swift-$pkgver-RELEASE-ubi10.tar.gz")
+source_aarch64=("https://download.swift.org/swift-$pkgver-release/ubi10-aarch64/swift-$pkgver-RELEASE/swift-$pkgver-RELEASE-ubi10-aarch64.tar.gz")
+sha256sums_x86_64=('50863678e3bafd91fcbc94c0bb76610bab37c1ee01e335fc7d8616904e03e19a')
+sha256sums_aarch64=('641931cd5fdd4d17e47b75b959ba21d67d0f5749cb7d14c854971b49e23bfbd2')
 
 package() {
   find_elf_only() {

Comment

The change is a straightforward upstream version/release-channel bump from Swift 6.3.3 ubi9 to 6.4.0 ubi10, with matching source URLs and updated SHA-256 checksums for both architectures. The only code change in package() is copying from the new extracted directory name. I do not see any added build-time network access, privilege escalation, suspicious scripts, or packaging changes beyond the expected artifact update. Risk is low.

@@ -35,7 +35,7 @@ package() {
     _archsuffix="-aarch64"
   fi
   mkdir -p "${pkgdir}/usr/lib/swift"
-  cp -Ppr "${srcdir}/swift-$pkgver-RELEASE-ubi9${_archsuffix}"/usr/* "${pkgdir}/usr/lib/swift"
+  cp -Ppr "${srcdir}/swift-$pkgver-RELEASE-ubi10${_archsuffix}"/usr/* "${pkgdir}/usr/lib/swift"
 
   # Symlink the desired binaries to /usr/bin
   mkdir -p "${pkgdir}/usr/bin"