Review Results

Comment

The change is a straightforward version bump in .SRCINFO for an AUR binary package. It updates the package version, dependency on the matching system electron version, and the GitHub release URLs/checksums for the upstream Mailspring RPMs. The sources remain HTTPS and point to the official upstream release artifacts, with no new build-time code execution, install-script changes, or suspicious extra sources introduced in this diff. Risk is low.

@@ -1,22 +1,22 @@
 pkgbase = mailspring-bin
-	pkgdesc = A beautiful, fast and fully open source mail client.(Prebuilt version.Use system-wide electron)
-	pkgver = 1.23.0
-	pkgrel = 2
+	pkgdesc = A beautiful, fast and fully open source mail client.
+	pkgver = 1.24.1
+	pkgrel = 1
 	url = https://getmailspring.com/
 	arch = aarch64
 	arch = x86_64
 	license = GPL-3.0-only
-	depends = electron41
+	depends = electron44
 	depends = krb5
 	depends = db5.3
 	depends = tidy
-	provides = mailspring=1.23.0
+	provides = mailspring=1.24.1
 	conflicts = mailspring
 	source = mailspring.sh
 	sha256sums = a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d
-	source_aarch64 = mailspring-1.23.0-aarch64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.23.0/mailspring-1.23.0-0.1.aarch64.rpm
-	sha256sums_aarch64 = f5241eb2064537c5e177ef2b56fe3ba909ec1312ea7f7717d027c142aa084bcc
-	source_x86_64 = mailspring-1.23.0-x86_64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.23.0/mailspring-1.23.0-0.1.x86_64.rpm
-	sha256sums_x86_64 = b99be331fb4144b7556edb8e11cd854464cd3e8f3716527171da7c3c8fbb16ba
+	source_aarch64 = mailspring-1.24.1-aarch64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.24.1/mailspring-1.24.1-0.1.aarch64.rpm
+	sha256sums_aarch64 = 98af5f40f4c0d854fdaa8bdc1057a9a8b55a5f3dc98b8dc8c3fb41c09eeca3c2
+	source_x86_64 = mailspring-1.24.1-x86_64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.24.1/mailspring-1.24.1-0.1.x86_64.rpm
+	sha256sums_x86_64 = f6836f553942a7c31c3fbe0382022e4f7e38496830268c2e3b0b4a6879fe147f
 
 pkgname = mailspring-bin

Comment

The change is low risk. It only bumps the packaged Mailspring version and Electron dependency, refreshes the SHA256 checksums for the upstream RPMs, and slightly changes the resource copy command from globbing to copying the directory contents with a trailing dot. That copy change is benign and still stays within $pkgdir. No new network fetches, privilege changes, install-script behavior, or suspicious sources were introduced by this diff.

@@ -1,10 +1,10 @@
 # Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
 pkgname=mailspring-bin
 _pkgname=Mailspring
-pkgver=1.23.0
-_electronversion=41
-pkgrel=2
-pkgdesc="A beautiful, fast and fully open source mail client.(Prebuilt version.Use system-wide electron)"
+pkgver=1.24.1
+_electronversion=44
+pkgrel=1
+pkgdesc="A beautiful, fast and fully open source mail client."
 arch=(
     'aarch64'
     'x86_64'

Comment

The change only updates the pinned SHA-256 checksums for the prebuilt RPM sources on aarch64 and x86_64. The source URLs remain HTTPS and point to the upstream GitHub release assets, with no new build-time downloads, scripts, or packaging logic changes. This is a normal integrity-pin refresh and does not introduce an obvious security issue in the reviewed hunk.

@@ -24,8 +24,8 @@ source=("${pkgname%-bin}.sh")
 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::${_ghurl}/releases/download/${pkgver}/${pkgname%-bin}-${pkgver}-0.1.aarch64.rpm")
 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::${_ghurl}/releases/download/${pkgver}/${pkgname%-bin}-${pkgver}-0.1.x86_64.rpm")
 sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
-sha256sums_aarch64=('f5241eb2064537c5e177ef2b56fe3ba909ec1312ea7f7717d027c142aa084bcc')
-sha256sums_x86_64=('b99be331fb4144b7556edb8e11cd854464cd3e8f3716527171da7c3c8fbb16ba')
+sha256sums_aarch64=('98af5f40f4c0d854fdaa8bdc1057a9a8b55a5f3dc98b8dc8c3fb41c09eeca3c2')
+sha256sums_x86_64=('f6836f553942a7c31c3fbe0382022e4f7e38496830268c2e3b0b4a6879fe147f')
 _get_app_dir() {
     find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
 }

Comment

The only code change in the reviewed hunk is switching the resource copy from `cp -a "${_app_dir}/resources/"* ...` to `cp -a "${_app_dir}/resources/." ...`. This is a packaging fix that preserves hidden files and avoids glob edge cases; it does not introduce new execution, network access, privilege escalation, or persistence behavior. The rest of the PKGBUILD diff is version/checksum metadata unrelated to this hunk and shows no suspicious packaging actions in the changed line itself.

@@ -68,7 +68,7 @@ package() {
     install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
     install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
 	local _app_dir=$(_get_app_dir)
-	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
+	cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
     install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
     find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
         _extension="${_i##*.}"

Comment

The change is a no-op formatting-only edit in PKGBUILD: it only adds a trailing newline at end of file and does not alter sources, build steps, package contents, permissions, or install-time behavior. No security-relevant impact is evident from this diff.

@@ -77,4 +77,4 @@ package() {
         install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
     done
     install -Dm644 "${srcdir}/usr/share/metainfo/${pkgname%-bin}.metainfo.xml" -t "${pkgdir}/usr/share/metainfo"
-}
\ No newline at end of file
+}