Review Results

Comment

The only change in this diff is a version bump in .SRCINFO from 1.24.1 to 1.25.0. No source URLs, build steps, install scripts, permissions, or package metadata beyond pkgver are altered, so there is no new security concern visible in this change alone. I did not see any evidence of added network access, privilege escalation, or integrity issues in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = mailspring-bin
 	pkgdesc = A beautiful, fast and fully open source mail client.
-	pkgver = 1.24.1
+	pkgver = 1.25.0
 	pkgrel = 1
 	url = https://getmailspring.com/
 	arch = aarch64

Comment

The change is a straightforward version bump in .SRCINFO for the binary package, updating the provided version and the official GitHub release URLs/checksums from 1.24.1 to 1.25.0. The sources remain HTTPS and point to the upstream Foundry376/Mailspring release assets, with no new scripts, install hooks, or build-time execution introduced in this diff. No security red flags are evident from the metadata-only update.

@@ -10,13 +10,13 @@ pkgbase = mailspring-bin
 	depends = krb5
 	depends = db5.3
 	depends = tidy
-	provides = mailspring=1.24.1
+	provides = mailspring=1.25.0
 	conflicts = mailspring
 	source = mailspring.sh
 	sha256sums = a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d
-	source_aarch64 = mailspring-1.24.1-aarch64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.24.1/mailspring-1.24.1-0.1.aarch64.rpm
-	sha256sums_aarch64 = 98af5f40f4c0d854fdaa8bdc1057a9a8b55a5f3dc98b8dc8c3fb41c09eeca3c2
-	source_x86_64 = mailspring-1.24.1-x86_64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.24.1/mailspring-1.24.1-0.1.x86_64.rpm
-	sha256sums_x86_64 = f6836f553942a7c31c3fbe0382022e4f7e38496830268c2e3b0b4a6879fe147f
+	source_aarch64 = mailspring-1.25.0-aarch64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.25.0/mailspring-1.25.0-0.1.aarch64.rpm
+	sha256sums_aarch64 = 666dfe7a1089ed4d6ab6d5c06af669835664b1fb0c5b0719e2b0a7598143d690
+	source_x86_64 = mailspring-1.25.0-x86_64.rpm::https://github.com/Foundry376/Mailspring/releases/download/1.25.0/mailspring-1.25.0-0.1.x86_64.rpm
+	sha256sums_x86_64 = 7a03f4d0db99e67601ff00a5ff45d84ef1f1f7404ef646b679d3307396256a03
 
 pkgname = mailspring-bin

Comment

The change only bumps pkgver from 1.24.1 to 1.25.0 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic are modified in the provided diff hunk, so there is no new security concern visible here. I did not inspect unrelated parts of the package beyond the requested hunk.

@@ -1,7 +1,7 @@
 # Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
 pkgname=mailspring-bin
 _pkgname=Mailspring
-pkgver=1.24.1
+pkgver=1.25.0
 _electronversion=44
 pkgrel=1
 pkgdesc="A beautiful, fast and fully open source mail client."

Comment

The change is a straightforward version bump in PKGBUILD plus updated SHA-256 checksums for the upstream RPM artifacts. Source URLs remain HTTPS and pinned to a release tag/version, and there are no new build-time commands, install-script changes, or packaging behavior changes in this diff. I do not see any added supply-chain or privilege-escalation risk in the reviewed hunk.

@@ -24,8 +24,8 @@ source=("${pkgname%-bin}.sh")
 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::${_ghurl}/releases/download/${pkgver}/${pkgname%-bin}-${pkgver}-0.1.aarch64.rpm")
 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::${_ghurl}/releases/download/${pkgver}/${pkgname%-bin}-${pkgver}-0.1.x86_64.rpm")
 sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
-sha256sums_aarch64=('98af5f40f4c0d854fdaa8bdc1057a9a8b55a5f3dc98b8dc8c3fb41c09eeca3c2')
-sha256sums_x86_64=('f6836f553942a7c31c3fbe0382022e4f7e38496830268c2e3b0b4a6879fe147f')
+sha256sums_aarch64=('666dfe7a1089ed4d6ab6d5c06af669835664b1fb0c5b0719e2b0a7598143d690')
+sha256sums_x86_64=('7a03f4d0db99e67601ff00a5ff45d84ef1f1f7404ef646b679d3307396256a03')
 _get_app_dir() {
     find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
 }