Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 3.2.33_52892 to 3.2.34_53644. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries changed in the provided diff. Based on this hunk alone, there is no evident security impact.

@@ -1,6 +1,6 @@
 pkgbase = linuxqq
 	pkgdesc = New Linux QQ based on Electron
-	pkgver = 3.2.33_52892
+	pkgver = 3.2.34_53644
 	pkgrel = 1
 	epoch = 5
 	url = https://im.qq.com/linuxqq

Comment

The change only updates the packaged upstream binary URLs and their SHA-512 checksums to a newer LinuxQQ release. The sources remain HTTPS on the official qqdl.gtimg.cn domain, and the integrity hashes are updated accordingly. No new build-time execution, install-script behavior, privilege changes, or packaging metadata red flags are introduced by this .SRCINFO-only diff. Risk is low, though the package still relies on prebuilt upstream .deb artifacts as before.

@@ -21,11 +21,11 @@ pkgbase = linuxqq
 	options = !debug
 	source = linuxqq.sh
 	sha512sums = bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7
-	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/1763096b/linuxqq_3.2.33-52892_amd64.deb
-	sha512sums_x86_64 = 8b12141690c38708508627817f40188d23da5e357164a0cdd6395530b9abad88d06da44c36ff85262872eb8bf2995c184c391048f63a004be81284a444ebb53e
-	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/1763096b/linuxqq_3.2.33-52892_arm64.deb
-	sha512sums_aarch64 = 27636f05d56ef2cc21bd5ae45375648cfe2d6ce1ebb7418a8ae0318ae7d61aab44482d276a29552dce374420dbbd9ee66653406e0ddcac0a5f87211a320ea6fc
-	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/1763096b/linuxqq_3.2.33-52892_loongarch64.deb
-	sha512sums_loong64 = dc7cec63e6ec10acfa0e973157d80f28ff46418f51f20626e35103057e68a1bc82f355c267abc2b1dee0a57893814496d13e32085e56afbcbc6e1419b39cbd17
+	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_amd64.deb
+	sha512sums_x86_64 = 774e45cd7238dc51b31c02ee494f9f86e773c487a90851790a806f776e130af125110045844e90dd68d0b073dc53bdd4d1c6d8fb7225b8f214fc0e35d1a20e32
+	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_arm64.deb
+	sha512sums_aarch64 = fa1424d41f934798a8f20b6cad8749f1eb99f29957501b3578449ade06fe105387e038e98cafb1bcc57d4d35010d771312ca0de7b14e62da0765cd29b005a5d1
+	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_loongarch64.deb
+	sha512sums_loong64 = c3fa5c8cc426a3dfc35e26c1f1e138d018c5541beb84b2deae647be05e66aed8cb80a349a694672ff303884f5947508ded5af0b6b4a9e733a24eec9060d2cbf3
 
 pkgname = linuxqq

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver, the upstream download path, the md5 prefix, and the per-architecture SHA-512 checksums to match the new release. I do not see any new code execution, install-script changes, privilege escalation, or integrity regressions in the diff. The source remains an HTTPS download from the same upstream host, and the package still relies on checksum verification for the fetched .deb artifacts. Risk is low.

@@ -2,7 +2,7 @@
 # Contributor: Integral <integral@member.fsf.org>
 
 pkgname=linuxqq
-pkgver=3.2.33_52892
+pkgver=3.2.34_53644
 pkgrel=1
 epoch=5
 pkgdesc="New Linux QQ based on Electron"

Comment

The change is a routine version bump of upstream QQNT beta binaries from 9.9.35 to 9.9.36, with corresponding updated SHA-512 checksums and md5 path prefix. Source URLs remain HTTPS and point to the same upstream domain, and there are no new build-time commands, install-script changes, privilege escalations, or packaging logic changes in this diff. The main residual risk is that this package ships prebuilt upstream .deb binaries, but that concern already existed before this change and is not introduced by the diff itself.

@@ -12,16 +12,16 @@ license=('LicenseRef-QQ')
 conflicts=("${pkgname}-nt-bwrap")
 depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
 optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
-_md5_prefix=1763096b
+_md5_prefix=9ee04bef
 _src_prefix="${pkgname}_${pkgver/_/-}"
-source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
-source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
-source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
+source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
+source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
+source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
 source=("${pkgname}.sh")
 sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
-sha512sums_x86_64=('8b12141690c38708508627817f40188d23da5e357164a0cdd6395530b9abad88d06da44c36ff85262872eb8bf2995c184c391048f63a004be81284a444ebb53e')
-sha512sums_aarch64=('27636f05d56ef2cc21bd5ae45375648cfe2d6ce1ebb7418a8ae0318ae7d61aab44482d276a29552dce374420dbbd9ee66653406e0ddcac0a5f87211a320ea6fc')
-sha512sums_loong64=('dc7cec63e6ec10acfa0e973157d80f28ff46418f51f20626e35103057e68a1bc82f355c267abc2b1dee0a57893814496d13e32085e56afbcbc6e1419b39cbd17')
+sha512sums_x86_64=('774e45cd7238dc51b31c02ee494f9f86e773c487a90851790a806f776e130af125110045844e90dd68d0b073dc53bdd4d1c6d8fb7225b8f214fc0e35d1a20e32')
+sha512sums_aarch64=('fa1424d41f934798a8f20b6cad8749f1eb99f29957501b3578449ade06fe105387e038e98cafb1bcc57d4d35010d771312ca0de7b14e62da0765cd29b005a5d1')
+sha512sums_loong64=('c3fa5c8cc426a3dfc35e26c1f1e138d018c5541beb84b2deae647be05e66aed8cb80a349a694672ff303884f5947508ded5af0b6b4a9e733a24eec9060d2cbf3')
 options=('!strip' '!debug')
 
 package() {