Review Results

Comment

The change only bumps the Dropbox upstream version in .SRCINFO and updates the corresponding source URL/checksum. The source remains HTTPS on the official Dropbox domain, and the package continues to verify the tarball with a pinned PGP key. No new build steps, scripts, or privilege-related artifacts are introduced by this diff. Risk is low and limited to the normal trust in the upstream binary release.

@@ -1,6 +1,6 @@
 pkgbase = dropbox
 	pkgdesc = A free service that lets you bring your photos, docs, and videos anywhere and share them easily.
-	pkgver = 264.4.3421
+	pkgver = 270.4.3312
 	pkgrel = 1
 	url = https://www.dropbox.com
 	arch = x86_64

Comment

The change only updates the pinned Dropbox upstream release tarball and its checksum in .SRCINFO, with the signature file and valid PGP key unchanged. This is a routine version bump for a prebuilt upstream binary package, and there are no new sources, scripts, install hooks, or packaging behaviors introduced in the diff. No security red flags are evident from this change alone.

@@ -24,14 +24,14 @@ pkgbase = dropbox
 	source = terms.txt
 	source = dropbox.service
 	source = dropbox@.service
-	source = https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-264.4.3421.tar.gz
-	source = https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-264.4.3421.tar.gz.asc
+	source = https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-270.4.3312.tar.gz
+	source = https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-270.4.3312.tar.gz.asc
 	validpgpkeys = 1C61A2656FB57B7E4DE0F4C1FC918B335044912E
 	sha256sums = 9ba76205ec5838db85d822f23cfd7e2112fd2757e8031d8374709f102143c548
 	sha256sums = 1610ff57e8b20ee7a37682c3cc505da4ddc9cec2bd7234c90c0f2073657521d2
 	sha256sums = 6c67a9c8c95c08fafafd2f1d828074b13e3347b05d2e4f4bf4e62746115d7477
 	sha256sums = 98581e65a91ae1f19ed42edcdaaa52e102298b5da0d71b50089393d364474d3d
-	sha256sums = 4aa06821de43b5e1cf4f27f83cb5f0bca82d01107c758091d7895f0d723f5411
+	sha256sums = 35404957d2a15dcac998d53cbec692d5236e197493f6c009accd91ea9aa8f34c
 	sha256sums = SKIP
 
 pkgname = dropbox

Comment

The change is a straightforward version bump of the Dropbox upstream tarball plus its corresponding checksum update. I do not see any new sources, build-time network fetches, script execution, privilege escalation, or packaging changes beyond the version/hash refresh. The package still relies on Dropbox's signed release tarball and existing PGP verification. No security-relevant behavior is introduced by this diff alone.

@@ -4,7 +4,7 @@
 # Contributor: David Manouchehri <d@32t.ca>
 
 pkgname=dropbox
-pkgver=264.4.3421
+pkgver=270.4.3312
 pkgrel=1
 pkgdesc="A free service that lets you bring your photos, docs, and videos anywhere and share them easily."
 arch=("x86_64")

Comment

The change only updates the sha256 checksum for one source artifact in PKGBUILD. This is a supply-chain integrity change, but by itself it does not introduce new code execution, network access, privilege escalation, or packaging behavior. I would want to verify the new checksum corresponds to the same upstream Dropbox tarball/release artifact, but based on the diff alone there is no direct security issue evident.

@@ -31,7 +31,7 @@ sha256sums=('9ba76205ec5838db85d822f23cfd7e2112fd2757e8031d8374709f102143c548'
             '1610ff57e8b20ee7a37682c3cc505da4ddc9cec2bd7234c90c0f2073657521d2'
             '6c67a9c8c95c08fafafd2f1d828074b13e3347b05d2e4f4bf4e62746115d7477'
             '98581e65a91ae1f19ed42edcdaaa52e102298b5da0d71b50089393d364474d3d'
-            '4aa06821de43b5e1cf4f27f83cb5f0bca82d01107c758091d7895f0d723f5411'
+            '35404957d2a15dcac998d53cbec692d5236e197493f6c009accd91ea9aa8f34c'
             'SKIP')
 # The PGP key fingerprint should match the one on https://www.dropbox.com/help/desktop-web/linux-commands
 validpgpkeys=(