Review Results

Comment

The change is a straightforward version bump in .SRCINFO for Oracle's VirtualBox Extension Pack from 7.2.18 to 7.2.20, with the source URL, noextract filename, dependency pin, and checksum updated consistently. The source remains on the official HTTPS Oracle download host, and there are no new build-time commands, scripts, or privilege-related changes in this diff. No security red flags are introduced by the metadata update itself.

@@ -1,15 +1,15 @@
 pkgbase = virtualbox-ext-oracle
 	pkgdesc = Oracle VM VirtualBox Extension Pack
-	pkgver = 7.2.18
+	pkgver = 7.2.20
 	pkgrel = 1
 	url = https://www.virtualbox.org/
 	arch = x86_64
 	license = custom:PUEL
-	depends = virtualbox=7.2.18
+	depends = virtualbox=7.2.20
 	optdepends = rdesktop: client to connect vm via RDP
-	noextract = Oracle_VirtualBox_Extension_Pack-7.2.18.vbox-extpack
+	noextract = Oracle_VirtualBox_Extension_Pack-7.2.20.vbox-extpack
 	options = !strip
-	source = https://download.virtualbox.org/virtualbox/7.2.18/Oracle_VirtualBox_Extension_Pack-7.2.18.vbox-extpack
-	sha256sums = e06834239947db06cc077d464bbb15d6441917ca03573e518506344dc28b64b9
+	source = https://download.virtualbox.org/virtualbox/7.2.20/Oracle_VirtualBox_Extension_Pack-7.2.20.vbox-extpack
+	sha256sums = 0a050da993f2e3cf2e4e9cda2fa8667e44a2b25479b27abd41af6812c1e43591
 
 pkgname = virtualbox-ext-oracle

Comment

The change is a straightforward version bump of the VirtualBox Extension Pack from 7.2.18 to 7.2.20, with the source URL still using HTTPS on the official Oracle download host and the checksum updated accordingly. No new build steps, scripts, patches, binaries, or privilege-related packaging changes were introduced. Based on the diff provided, there are no obvious security red flags in this change.

@@ -2,7 +2,7 @@
 # Maintainer: Christian Hesse <mail@eworm.de>
 
 pkgname=virtualbox-ext-oracle
-pkgver=7.2.18
+pkgver=7.2.20
 _filever="${pkgver}"
 pkgrel=1
 pkgdesc='Oracle VM VirtualBox Extension Pack'

Comment

The change only updates the SHA-256 checksum for the upstream Oracle VirtualBox Extension Pack source URL. The source remains HTTPS on the official VirtualBox download host, there are no new build steps, no added scripts, and no packaging behavior changes. This is a routine integrity hash refresh and does not introduce an obvious security risk in the PKGBUILD diff reviewed.

@@ -14,7 +14,7 @@ optdepends=('rdesktop: client to connect vm via RDP')
 options=('!strip')
 source=("https://download.virtualbox.org/virtualbox/${_filever}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
 noextract=("Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
-sha256sums=('e06834239947db06cc077d464bbb15d6441917ca03573e518506344dc28b64b9')
+sha256sums=('0a050da993f2e3cf2e4e9cda2fa8667e44a2b25479b27abd41af6812c1e43591')
 
 prepare() {
   mkdir Oracle_VirtualBox_Extension_Pack/