Review Results

Comment

The change only bumps pkgver in .SRCINFO from 6.6.1.0 to 6.6.2.0. No source URLs, checksums, build steps, install scripts, permissions, or dependencies are altered in the reviewed diff. On its face this is a routine version metadata update with no security-relevant behavior change visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = megasync
 	pkgdesc = Official MEGA desktop application for syncing with MEGA Cloud Drive
-	pkgver = 6.6.1.0
+	pkgver = 6.6.2.0
 	pkgrel = 1
 	url = https://github.com/meganz/MEGAsync/
 	arch = x86_64

Comment

The change only updates the upstream MEGAsync source tag from v6.6.1.0_OSX to v6.6.2.0_Linux and refreshes the corresponding checksum in .SRCINFO. The source remains pinned to an HTTPS GitHub tag, with no new sources, scripts, or build-time network behavior introduced by this metadata-only update. No obvious integrity or persistence red flags are present in the diff itself.

@@ -30,12 +30,12 @@ pkgbase = megasync
 	depends = qt5-x11extras
 	depends = sqlite
 	depends = zlib
-	source = git+https://github.com/meganz/MEGAsync.git#tag=v6.6.1.0_OSX
+	source = git+https://github.com/meganz/MEGAsync.git#tag=v6.6.2.0_Linux
 	source = meganz-sdk::git+https://github.com/meganz/sdk.git
 	source = 010-megasync-sdk-fix-cmake-dependencies-detection.patch
 	source = 020-megasync-app-fix-cmake-dependencies-detection.patch
 	source = 030-megasync-app-disable-isolated-gfx-for-disabling-freeimage-in-sdk.patch
-	sha256sums = deb2bc2033bd02a92f5409c1ed89561a1b0ba8592d2c8162d0ae89fc9014964a
+	sha256sums = 38c77c93f124acd418f599029333b519e0ade311fc8e6e05b892855c2658be5f
 	sha256sums = SKIP
 	sha256sums = 5219537875385e9399b1a76a5775722053880cdfc0c33b5726504e020e11ad70
 	sha256sums = a5883be2d00dbacaacf78231bfeeac27f4e8a471c3256370e94fec3e55b1d171

Comment

The change is a straightforward version bump plus a source tag correction from `v${pkgver}_OSX` to `v${pkgver}_Linux`, with the corresponding checksum update. I do not see any new execution paths, network fetches outside `source=()`, privilege changes, or packaging/install-script changes. The source remains pinned to a specific upstream tag over HTTPS, and the rest of the PKGBUILD is unchanged. Low risk.

@@ -7,7 +7,7 @@
 # Contributor: Hexchain Tong <i at hexchain dot org>
 
 pkgname=megasync
-pkgver=6.6.1.0
+pkgver=6.6.2.0
 pkgrel=1
 pkgdesc='Official MEGA desktop application for syncing with MEGA Cloud Drive'
 arch=('x86_64')

Comment

The change is a straightforward upstream version bump and source tag switch from v${pkgver}_OSX to v${pkgver}_Linux, with the corresponding checksum update. The source remains an HTTPS GitHub VCS URL pinned to a tag, and there are no new build-time downloads, scripts, privilege changes, or packaging/persistence red flags in this diff. I did not find evidence of malicious behavior in the modified lines.

@@ -40,12 +40,12 @@ makedepends=(
     'cmake'
     'git'
     'qt5-tools')
-source=("git+https://github.com/meganz/MEGAsync.git#tag=v${pkgver}_OSX"
+source=("git+https://github.com/meganz/MEGAsync.git#tag=v${pkgver}_Linux"
         'meganz-sdk'::'git+https://github.com/meganz/sdk.git'
         '010-megasync-sdk-fix-cmake-dependencies-detection.patch'
         '020-megasync-app-fix-cmake-dependencies-detection.patch'
         '030-megasync-app-disable-isolated-gfx-for-disabling-freeimage-in-sdk.patch')
-sha256sums=('deb2bc2033bd02a92f5409c1ed89561a1b0ba8592d2c8162d0ae89fc9014964a'
+sha256sums=('38c77c93f124acd418f599029333b519e0ade311fc8e6e05b892855c2658be5f'
             'SKIP'
             '5219537875385e9399b1a76a5775722053880cdfc0c33b5726504e020e11ad70'
             'a5883be2d00dbacaacf78231bfeeac27f4e8a471c3256370e94fec3e55b1d171'