Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the HP binary plugin package: updated pkgver, dependency floor, source URLs, and checksums. The sources remain HTTPS on the official HP domain, and the package still references the signed .run artifact plus its .asc signature. No new execution paths, install-script changes, or packaging red flags are introduced by this diff alone. Risk is low because the review scope is only metadata, though the package remains a binary plugin from upstream HP by design.

@@ -1,6 +1,6 @@
 pkgbase = hplip-plugin
 	pkgdesc = Binary plugin for HPs hplip printer driver library
-	pkgver = 3.26.4
+	pkgver = 3.26.6
 	pkgrel = 1
 	url = https://developers.hp.com/hp-linux-imaging-and-printing/binary_plugin.html
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates the plugin download URLs, checksum, and the minimum hplip dependency from 3.26.4 to 3.26.6. There are no new sources, no build-script changes, no added execution paths, and no signs of privilege escalation or persistence mechanisms in this diff. The only security-relevant aspect is that the package still fetches a vendor-supplied binary plugin over HTTPS and relies on the existing PGP/sha256 verification, which is expected for this package and unchanged in risk profile. Overall this looks safe.

@@ -10,19 +10,19 @@ pkgbase = hplip-plugin
 	arch = i686
 	license = LicenseRef-HPLIP-LICENSE
 	makedepends = python
-	depends = hplip>=3.26.4
+	depends = hplip>=3.26.6
 	options = !debug
 	backup = var/lib/hp/hplip.state
-	source = hplip-plugin-3.26.4.run::https://developers.hp.com/sites/default/files/2026-05/hplip-3.26.4-plugin.run
-	source = hplip-plugin-3.26.4.run.asc::https://developers.hp.com/sites/default/files/2026-05/hplip-3.26.4-plugin.run.asc
+	source = hplip-plugin-3.26.6.run::https://developers.hp.com/sites/default/files/2026-09/hplip-3.26.6-plugin.run
+	source = hplip-plugin-3.26.6.run.asc::https://developers.hp.com/sites/default/files/2026-09/hplip-3.26.6-plugin.run.asc
 	source = scan-plugin-spec.py
 	validpgpkeys = 82FFA7C6AA7411D934BDE173AC69536A2CF3A243
-	sha256sums = 199f78f8af7f36894d7180e9090963ce2550a75ec701f8a4ba37665a9746fdf0
+	sha256sums = bb830712bfacc4567e8714522f1359a749df344786256c8513ededf3e9455325
 	sha256sums = SKIP
 	sha256sums = c6da101f46546f2145ecc0bf9b7bbb3fb5ecb40e799274e62a7e9bc435924d25
 
 pkgname = hplip-plugin
-	depends = hplip>=3.26.4
+	depends = hplip>=3.26.6
 	depends = libgcc
 	depends = libstdc++
 	depends = glibc

Comment

The change only bumps pkgver from 3.26.4 to 3.26.6 in PKGBUILD metadata. No build logic, sources, install scripts, permissions, or package relationships were altered in the provided diff hunk. Based on this hunk alone there is no evident security impact.

@@ -4,7 +4,7 @@
 # Contributor: Ivan Shapovalov <intelfx@intelfx.name>
 
 pkgname=hplip-plugin
-pkgver=3.26.4
+pkgver=3.26.6
 pkgrel=1
 pkgdesc="Binary plugin for HPs hplip printer driver library"
 arch=(x86_64 aarch64 armv6h armv7h i686)

Comment

The change only updates the HP plugin download date from 2026-05 to 2026-09 and refreshes the expected SHA-256 for the same upstream .run installer. The source remains HTTPS on the official HP domain, there are no new build-time network fetches, no added scripts, and no packaging logic changes. I do note the package still relies on a prebuilt vendor binary, but that is pre-existing and not introduced by this diff. No new security concern is evident in this hunk.

@@ -17,11 +17,11 @@ depends=("hplip>=$pkgver")
 makedepends=(python)
 options=(!debug) # Binary package cannot produce correct debug information
 # https://developers.hp.com/hp-linux-imaging-and-printing/plugins
-_date=2026-05
+_date=2026-09
 source=("$pkgname-$pkgver.run::https://developers.hp.com/sites/default/files/$_date/hplip-$pkgver-plugin.run"
         "$pkgname-$pkgver.run.asc::https://developers.hp.com/sites/default/files/$_date/hplip-$pkgver-plugin.run.asc"
         "scan-plugin-spec.py")
-sha256sums=('199f78f8af7f36894d7180e9090963ce2550a75ec701f8a4ba37665a9746fdf0'
+sha256sums=('bb830712bfacc4567e8714522f1359a749df344786256c8513ededf3e9455325'
             'SKIP'
             'c6da101f46546f2145ecc0bf9b7bbb3fb5ecb40e799274e62a7e9bc435924d25')
 validpgpkeys=('82FFA7C6AA7411D934BDE173AC69536A2CF3A243') # HPLIP (HP Linux Imaging and Printing) <hplip@hp.com>

Comment

The change only adds the upstream installer flag `--nox11` to the existing `prepare()` extraction command. This does not introduce new network access, privilege escalation, persistence, or packaging behavior; it simply alters how the self-extracting `.run` source unpacks. The package still relies on the same downloaded upstream artifact and the same `sh ... --noexec` pattern as before, so the security posture is unchanged by this diff. No additional red flags are present in the reviewed hunk.

@@ -31,7 +31,7 @@ _user_agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gec
 DLAGENTS=("https::/usr/bin/curl --user-agent ${_user_agent// /\\ } -qgb '' -fLC - --retry 3 --retry-delay 3 -o %o %u")
 
 prepare() {
-  sh "$pkgname-$pkgver.run" --target "$srcdir/$pkgname-$pkgver" --noexec
+  sh "$pkgname-$pkgver.run" --target "$srcdir/$pkgname-$pkgver" --noexec --nox11
 }
 
 package() {