Review Results

Comment

The change is limited to regenerated metadata in .SRCINFO: a pkgver bump from 8.3.4161.3 to 8.3.4171.3 and a license identifier normalization from `custom` to `LicenseRef-vivaldi`. There are no source URL changes, no new build steps, no install-script or packaging behavior changes, and no signs of network access, privilege escalation, or persistence mechanisms. Based on the provided diff, this is low risk and appears to be routine package metadata refresh.

@@ -1,12 +1,12 @@
 # Generated by makepkg 7.1.0
-# Tue Sep 15 12:14:48 UTC 2026
+# Fri Sep 25 13:11:52 UTC 2026
 pkgbase = vivaldi-snapshot
 	pkgdesc = An advanced browser made with the power user in mind. Snapshot
-	pkgver = 8.3.4161.3
+	pkgver = 8.3.4171.3
 	pkgrel = 1
 	url = https://vivaldi.com
 	arch = x86_64
-	license = custom
+	license = LicenseRef-vivaldi
 	makedepends = w3m
 	makedepends = imagemagick
 	depends = alsa-lib

Comment

The change only bumps the upstream Vivaldi snapshot RPM URL from one official HTTPS release artifact to a newer official HTTPS release artifact and updates the corresponding sha512 checksum. No new sources, scripts, patches, or build logic are introduced, and the existing patch source remains unchanged. This is a routine version refresh with no evident supply-chain or packaging red flags in the provided diff.

@@ -36,9 +36,9 @@ pkgbase = vivaldi-snapshot
 	optdepends = upower: Battery Status API support
 	options = !strip
 	options = !zipman
-	source = https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-8.3.4161.3-1.x86_64.rpm
+	source = https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-8.3.4171.3-1.x86_64.rpm
 	source = 0001-add-support-for-user-flags.patch
-	sha512sums = a74d6cafa49536349d40b9ffbf8471e11bd02fa45031abe33963f423d727fbb911f8f94892c45380c8d63186d31bb4505f8bc71e025ea18c196ffc28e0560bf9
+	sha512sums = 1c3f7e3ad0cf6ce762ad3cbb58d1496eb644f5b78d48ef43b4280e7aecfb0b9710d647ad2f2c0ea510ced329cf6cdc8b457fe2a1f05d923f3d5c4278977db873
 	sha512sums = 6b230614419416c44adf8fc2a677f8b1f1aca16949d20b7499417737001a6e9e314fc5841afaf402ad55b09910fca4c70fa7b6d38509b0546959bdbefb036726
 
 pkgname = vivaldi-snapshot

Comment

Low risk change. The diff only bumps the upstream Vivaldi snapshot version, updates the corresponding SHA-512 checksum, and changes the declared license identifier from 'custom' to 'LicenseRef-vivaldi'. The only behavioral change is removing 'head -n 5' from the license extraction pipeline, which makes the packaged license text include the full w3m dump of the bundled LICENSE.html instead of truncating it. That affects license file contents only and does not introduce code execution, network access, privilege escalation, or packaging outside $pkgdir. The source remains an HTTPS download from the official Vivaldi domain, and no new suspicious sources or install-time actions are added.

@@ -2,13 +2,13 @@
 # Contributor: TZ86
 
 pkgname=vivaldi-snapshot
-_rpmversion=8.3.4161.3-1
-pkgver=8.3.4161.3
+_rpmversion=8.3.4171.3-1
+pkgver=8.3.4171.3
 pkgrel=1
 pkgdesc='An advanced browser made with the power user in mind. Snapshot'
 url="https://vivaldi.com"
 options=(!strip !zipman)
-license=('custom')
+license=('LicenseRef-vivaldi')
 arch=('x86_64')
 depends=(
     'alsa-lib'

Comment

The change is low risk. It only updates the upstream Vivaldi snapshot version and the corresponding SHA-512 checksum for the RPM source, plus a license identifier cleanup. The removed `head -n 5` in the license extraction is not a security issue in this context; it simply writes the full dumped license text instead of truncating it. No new sources, no build-time network access, no privilege escalation, and no suspicious packaging behavior were introduced by this diff.

@@ -42,7 +42,7 @@ optdepends=(
 )
 source=("https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-${_rpmversion}.x86_64.rpm"
         '0001-add-support-for-user-flags.patch')
-sha512sums=('a74d6cafa49536349d40b9ffbf8471e11bd02fa45031abe33963f423d727fbb911f8f94892c45380c8d63186d31bb4505f8bc71e025ea18c196ffc28e0560bf9'
+sha512sums=('1c3f7e3ad0cf6ce762ad3cbb58d1496eb644f5b78d48ef43b4280e7aecfb0b9710d647ad2f2c0ea510ced329cf6cdc8b457fe2a1f05d923f3d5c4278977db873'
             '6b230614419416c44adf8fc2a677f8b1f1aca16949d20b7499417737001a6e9e314fc5841afaf402ad55b09910fca4c70fa7b6d38509b0546959bdbefb036726')
 
 package() {

Comment

The change removes `head -n 5` from the license extraction pipeline, so the packaged license text will now include the full contents of `LICENSE.html` instead of only the first five lines. This is a packaging/content change only and does not introduce code execution, network access, privilege escalation, or persistence mechanisms. No security concern is evident from this diff alone.

@@ -85,6 +85,5 @@ package() {
     # license
     install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
     w3m -dump "$pkgdir/opt/$pkgname/LICENSE.html" \
-        | head -n 5 \
         > "$pkgdir/usr/share/licenses/$pkgname/license.txt"
 }