Review Results

Comment

The change only updates .SRCINFO metadata for a version bump from 1.18.4 to 2.0.0 and switches the source URLs to the upstream makemkv.com download endpoints with matching new checksums. The URLs are HTTPS and point to the project’s official site, not an obvious typosquat or untrusted mirror. No build logic, install script, or packaging behavior is changed in this diff, so there is no direct evidence of malicious code execution or persistence introduced here. Risk is low, though the package should still be reviewed alongside the corresponding PKGBUILD/source artifacts for the new release.

@@ -1,7 +1,7 @@
 pkgbase = makemkv
 	pkgdesc = DVD and Blu-ray to MKV converter
-	pkgver = 1.18.4
-	pkgrel = 3
+	pkgver = 2.0.0
+	pkgrel = 1
 	url = https://www.makemkv.com
 	install = makemkv.install
 	arch = x86_64

Comment

The change only updates .SRCINFO to point at official MakeMKV download URLs on HTTPS and refreshes the corresponding checksums for a version bump from 1.18.4 to 2.0.0. There are no new build-time commands, no added scripts, and no suspicious mirrors or non-HTTPS sources. Based on the provided diff hunk alone, this is a routine source/version update with no evident security red flags.

@@ -13,13 +13,13 @@ pkgbase = makemkv
 	depends = ffmpeg
 	depends = libavcodec.so
 	optdepends = java-runtime: bdjava https://www.makemkv.com/bdjava/
-	source = https://sourceforge.net/projects/fabiololix-os-archive/files/src/makemkv-bin-1.18.4.tar.gz
-	source = https://sourceforge.net/projects/fabiololix-os-archive/files/src/makemkv-oss-1.18.4.tar.gz
+	source = https://www.makemkv.com/download/makemkv-bin-2.0.0.tar.gz
+	source = https://www.makemkv.com/download/makemkv-oss-2.0.0.tar.gz
 	source = ffmpeg9.patch
 	source = makemkv.1
 	source = makemkvcon.1
-	sha256sums = cee56de0baa5531abed16bd862742d308d772b4ab4dae16ee865bf74f04a1608
-	sha256sums = 8590063648d42ec2a958b74573d7022f0f4c334e4e4fe7dd53b70c6e748ba453
+	sha256sums = f1265e74875a186efdfbbbec7459a64e969033515e53cbc4d805f0a374f0a124
+	sha256sums = 435316b2d219eb48c880526557addd076b5f5e6de5171424c7651f9cac95b161
 	sha256sums = d35ae9e841ac43297e17a08d8819b339c5058bbdfc150fab508a442365756929
 	sha256sums = 5573b2e4bade10d8cd258a7c235eb46f66ef8c8c97e5d5eb090c38fa0f94389b
 	sha256sums = f12c0facf2f0071a9f728b138986f0a4c2b4ff6ace2dfb2e96364e215e9fda6f

Comment

The change switches the package sources from archived SourceForge tarballs to direct upstream HTTPS downloads on the official makemkv.com domain, and updates the checksums accordingly. This is a normal upstream source refresh with no added build-time execution, no new scripts, no privilege changes, and no suspicious extra sources. The only notable risk is that the package still ships prebuilt 'bin' content as part of the upstream release, but that was already true before this change and is expected for this package. No security regression is evident in the diff provided.

@@ -4,8 +4,8 @@
 # Contributor: Olaf Bauer <hydro@freenet.de>
 
 pkgname=makemkv
-pkgver=1.18.4
-pkgrel=3
+pkgver=2.0.0
+pkgrel=1
 pkgdesc="DVD and Blu-ray to MKV converter"
 arch=(x86_64 i686 aarch64)
 url="https://www.makemkv.com"

Comment

The change switches the source tarballs from a pinned SourceForge archive mirror to the upstream makemkv.com download URLs and updates the checksums accordingly. This is not inherently suspicious: the URLs are HTTPS, point to the official upstream site, and the package still relies on fixed release tarballs rather than a floating VCS branch. I do not see any added build-time network fetches, shell execution, privilege escalation, or install-script changes in this diff. The only notable risk is the usual trust shift from a mirror to upstream, but that is expected for a package update and is mitigated by the updated SHA256 sums.

@@ -14,16 +14,14 @@ depends=(qt5-base ffmpeg libavcodec.so)
 optdepends=('java-runtime: bdjava https://www.makemkv.com/bdjava/')
 install=makemkv.install
 source=(
-    #${url}/download/${pkgname}-bin-${pkgver}.tar.gz
-    #${url}/download/${pkgname}-oss-${pkgver}.tar.gz
-    https://sourceforge.net/projects/fabiololix-os-archive/files/src/makemkv-bin-1.18.4.tar.gz
-    https://sourceforge.net/projects/fabiololix-os-archive/files/src/makemkv-oss-1.18.4.tar.gz
+    ${url}/download/${pkgname}-bin-${pkgver}.tar.gz
+    ${url}/download/${pkgname}-oss-${pkgver}.tar.gz
     ffmpeg9.patch
     makemkv.1
     makemkvcon.1
     )
-sha256sums=('cee56de0baa5531abed16bd862742d308d772b4ab4dae16ee865bf74f04a1608'
-            '8590063648d42ec2a958b74573d7022f0f4c334e4e4fe7dd53b70c6e748ba453'
+sha256sums=('f1265e74875a186efdfbbbec7459a64e969033515e53cbc4d805f0a374f0a124'
+            '435316b2d219eb48c880526557addd076b5f5e6de5171424c7651f9cac95b161'
             'd35ae9e841ac43297e17a08d8819b339c5058bbdfc150fab508a442365756929'
             '5573b2e4bade10d8cd258a7c235eb46f66ef8c8c97e5d5eb090c38fa0f94389b'
             'f12c0facf2f0071a9f728b138986f0a4c2b4ff6ace2dfb2e96364e215e9fda6f')