Review Results

Comment

The change only bumps pkgrel from 18 to 19 in .SRCINFO for python2, with no source, build, install-script, dependency, or packaging logic changes. This is a metadata-only rebuild marker and does not introduce any new attack surface or integrity concern in the reviewed diff.

@@ -1,7 +1,7 @@
 pkgbase = python2
 	pkgdesc = A high-level scripting language
 	pkgver = 2.7.18
-	pkgrel = 18
+	pkgrel = 19
 	url = https://www.python.org/
 	arch = x86_64
 	arch = aarch64

Comment

The change only swaps one source URL for the same Gentoo patchset tarball from a different mirror (mirrorservice.org -> distfiles.gentoo.org). The filename, version, and checksum metadata remain unchanged, and the new URL is HTTPS and points to an official Gentoo distfiles host rather than an untrusted location. No build logic, install scripts, or package contents are altered. This is a low-risk source mirror update with no evident security impact.

@@ -31,7 +31,7 @@ pkgbase = python2
 	source = https://www.python.org/ftp/python/2.7.18/Python-2.7.18.tar.xz
 	source = https://www.python.org/ftp/python/2.7.18/Python-2.7.18.tar.xz.asc
 	source = mtime-workaround.patch
-	source = https://www.mirrorservice.org/sites/www.ibiblio.org/gentoo/pub/proj/python/patchsets/2.7/python-gentoo-patches-2.7.18_p16.tar.xz
+	source = https://distfiles.gentoo.org/distfiles/2d/python-gentoo-patches-2.7.18_p16.tar.xz
 	validpgpkeys = C01E1CAD5EA2C4F0B8E3571504C367C218ADD4FF
 	sha512sums = a7bb62b51f48ff0b6df0b18f5b0312a523e3110f49c3237936bfe56ed0e26838c0274ff5401bda6fc21bf24337477ccac49e8026c5d651e4b4cafb5eb5086f6c
 	sha512sums = SKIP

Comment

The change only bumps pkgrel from 18 to 19 in PKGBUILD without altering sources, build steps, dependencies, install scripts, or package contents. No security-relevant behavior is introduced by this diff hunk.

@@ -7,7 +7,7 @@
 
 pkgname=python2
 pkgver=2.7.18
-pkgrel=18
+pkgrel=19
 _pybasever=2.7
 pkgdesc="A high-level scripting language"
 arch=('x86_64' 'aarch64' 'i686' 'pentium4')

Comment

The change only switches the Gentoo patchset download from one HTTPS mirror to another official Gentoo distfiles host, with no change to the patch contents, build logic, or install behavior. The Python upstream tarball remains pinned and verified, and there are no new execution, privilege, or persistence concerns introduced by this diff. Low risk.

@@ -23,7 +23,7 @@ conflicts=('python<3')
 _gentoo_patches="python-gentoo-patches-${pkgver}_p16"
 source=("https://www.python.org/ftp/python/${pkgver%rc?}/Python-${pkgver}.tar.xz"{,.asc}
         mtime-workaround.patch
-        "https://www.mirrorservice.org/sites/www.ibiblio.org/gentoo/pub/proj/python/patchsets/2.7/$_gentoo_patches.tar.xz")
+        "https://distfiles.gentoo.org/distfiles/2d/$_gentoo_patches.tar.xz")
 sha512sums=('a7bb62b51f48ff0b6df0b18f5b0312a523e3110f49c3237936bfe56ed0e26838c0274ff5401bda6fc21bf24337477ccac49e8026c5d651e4b4cafb5eb5086f6c'
             'SKIP'
             '4e761cfd57791e8b72ecdf84c2e03875bf074311130eea5b8e97409fa304fa3468dbd359a511c4e9978e686e662c58054b4174d3e73f845fa9ded2e83a3a8076'