Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 7.0.0 to 7.1.0. No sources, checksums, install scripts, dependencies, or packaging logic are altered in the reviewed hunk, so there is no new security-relevant behavior to assess from this change alone.

@@ -1,6 +1,6 @@
 pkgbase = geekbench
 	pkgdesc = A cross-platform benchmark that measures processor and memory performance
-	pkgver = 7.0.0
+	pkgver = 7.1.0
 	pkgrel = 1
 	url = https://www.geekbench.com/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the Geekbench binary package, with the checksum updated accordingly. I do note the source URL still uses plain HTTP rather than HTTPS, which is a supply-chain integrity weakness because the tarball could be MITM-tampered in transit. However, this issue already existed in the prior version and is not introduced by this diff. No new red flags appear in the reviewed change itself beyond the version/update metadata.

@@ -9,7 +9,7 @@ pkgbase = geekbench
 	depends = gcc-libs
 	conflicts = geekbench227
 	options = !strip
-	source = http://cdn.geekbench.com/Geekbench-7.0.0-Linux.tar.gz
-	sha256sums = 961a00ac0ac432ffa6874764e86c59d2e098fff65b5b398bb9381bf7fc46c81b
+	source = http://cdn.geekbench.com/Geekbench-7.1.0-Linux.tar.gz
+	sha256sums = 411b72a9c851b69e6f91d390649d419e2e625f475e3983880169651ca27a8672
 
 pkgname = geekbench

Comment

The change is a routine version bump with a matching checksum update. I do note the source URL still uses plain HTTP rather than HTTPS, which is a supply-chain integrity concern in general, but this issue already existed before this commit and is not introduced by the diff under review. No new build-time execution, packaging, or persistence behavior was added.

@@ -5,7 +5,7 @@
 # Contributor: Hurricane Pootis <hurricanepootis@protonmail.com>
 
 pkgname=geekbench
-pkgver=7.0.0
+pkgver=7.1.0
 pkgrel=1
 pkgdesc="A cross-platform benchmark that measures processor and memory performance"
 arch=('x86_64')

Comment

The change is a straightforward version bump from Geekbench 7.0.0 to 7.1.0 with an updated SHA256 for the upstream tarball. I do note the source URL still uses plain HTTP rather than HTTPS, which is a supply-chain integrity weakness because the download can be MITM-tampered before checksum verification. However, this issue already existed in the prior PKGBUILD and is not introduced by this diff. No new build-time execution, extra sources, or packaging/persistence behavior was added in the reviewed hunk.

@@ -15,7 +15,7 @@ license=("custom")
 conflicts=("geekbench227")
 source=("http://cdn.geekbench.com/Geekbench-${pkgver}-Linux.tar.gz")
 options=('!strip')
-sha256sums=('961a00ac0ac432ffa6874764e86c59d2e098fff65b5b398bb9381bf7fc46c81b')
+sha256sums=('411b72a9c851b69e6f91d390649d419e2e625f475e3983880169651ca27a8672')
 
 package() {
     local dest="$pkgdir/opt/${pkgname}"