Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2. No sources, checksums, build steps, install scripts, permissions, or dependencies changed, so there is no new security-relevant behavior to assess from this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = pycharm
 	pkgdesc = The only Python IDE you need. Bundled with the official JetBrains Runtime (JBR)
 	pkgver = 2026.2.3
-	pkgrel = 1
+	pkgrel = 2
 	url = https://www.jetbrains.com/pycharm/
 	arch = x86_64
 	arch = aarch64

Comment

The change only switches JetBrains download hosts from download-cf.jetbrains.com to download.jetbrains.com for the x86_64 and aarch64 source URLs. Both are HTTPS, point to the same upstream vendor, and the pinned release tarball names and checksums are unchanged. No build logic, install scripts, or other packaging metadata is affected, so there is no evident security impact from this diff alone.

@@ -37,9 +37,9 @@ pkgbase = pycharm
 	source = ltedit.desktop
 	sha256sums = 444611514a2e2e168d20ec866af0102fbdd0472af00925847471609578b187b7
 	sha256sums = 944d01526dcc0e6d4c321873bd42d2c7885973e929f3b363c31019f642af0101
-	source_x86_64 = https://download-cf.jetbrains.com/python/pycharm-2026.2.3.tar.gz
+	source_x86_64 = https://download.jetbrains.com/python/pycharm-2026.2.3.tar.gz
 	sha256sums_x86_64 = e8e4fbe4dab44390d09f681e059a316e692cabd24b2e11ce98ff76c8120fa313
-	source_aarch64 = https://download-cf.jetbrains.com/python/pycharm-2026.2.3-aarch64.tar.gz
+	source_aarch64 = https://download.jetbrains.com/python/pycharm-2026.2.3-aarch64.tar.gz
 	sha256sums_aarch64 = c1ac6b7440f4d8946241d602220e9db9afac75f41831ca21dc5168cdf3689d0e
 
 pkgname = pycharm

Comment

The change only bumps pkgrel from 1 to 2 in PKGBUILD. No sources, build steps, install scripts, permissions, dependencies, or package metadata beyond the release number were altered. This is a routine packaging revision with no security-relevant impact visible in the provided diff.

@@ -6,7 +6,7 @@
 
 pkgname=pycharm
 pkgver=2026.2.3
-pkgrel=1
+pkgrel=2
 provides=("pycharm")
 replaces=("pycharm-professional")
 conflicts=('pycharm-professional' 'pycharm-community-edition')

Comment

The change only switches the upstream download host from `download-cf.jetbrains.com` to `download.jetbrains.com` for the PyCharm release tarballs. This remains an HTTPS source on the official JetBrains domain, with no new build-time execution, no added sources, and no packaging/script changes. I don't see any integrity or supply-chain regression in this diff alone.

@@ -29,8 +29,8 @@ depends=(
     fontconfig
 )
 source=("pycharm.desktop" "ltedit.desktop")
-source_x86_64=("https://download-cf.jetbrains.com/python/${pkgname}-${pkgver}.tar.gz")
-source_aarch64=("https://download-cf.jetbrains.com/python/${pkgname}-${pkgver}-aarch64.tar.gz")
+source_x86_64=("https://download.jetbrains.com/python/${pkgname}-${pkgver}.tar.gz")
+source_aarch64=("https://download.jetbrains.com/python/${pkgname}-${pkgver}-aarch64.tar.gz")
 sha256sums=('444611514a2e2e168d20ec866af0102fbdd0472af00925847471609578b187b7'
             '944d01526dcc0e6d4c321873bd42d2c7885973e929f3b363c31019f642af0101')
 sha256sums_x86_64=('e8e4fbe4dab44390d09f681e059a316e692cabd24b2e11ce98ff76c8120fa313')