Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.4.9 to 1.5.0. No build logic, sources, checksums, install scripts, or permissions are altered in the reviewed hunk, so there is no direct security impact visible here. Risk is minimal.

@@ -1,6 +1,6 @@
 pkgbase = rustdesk-bin
 	pkgdesc = Yet another remote desktop software, written in Rust. Works out of the box, no configuration required.
-	pkgver = 1.4.9
+	pkgver = 1.5.0
 	pkgrel = 1
 	url = https://github.com/rustdesk/rustdesk
 	install = rustdesk-bin.install

Comment

The change only updates the pinned upstream release artifacts in .SRCINFO from RustDesk 1.4.9 to 1.5.0, with corresponding SHA-256 checksums. The sources remain HTTPS GitHub release URLs, there are no new build-time fetches, scripts, or privilege-related changes, and .SRCINFO is metadata only. No security red flags are evident in this diff alone.

@@ -24,9 +24,9 @@ pkgbase = rustdesk-bin
 	options = !strip
 	options = !lto
 	options = !debug
-	source_x86_64 = rustdesk-1.4.9-1-x86_64.pkg.tar.zst::https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0-x86_64.pkg.tar.zst
-	sha256sums_x86_64 = 679760e1a1f1b930529069edfaec219afa16b5efe44c1bc593cede0e65576c11
-	source_aarch64 = rustdesk-1.4.9-1-aarch64.rpm::https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.aarch64.rpm
-	sha256sums_aarch64 = 3e523df7ceb6f3804b047a3cac797354c4bf46ec19f2d7ff5e198787003cb092
+	source_x86_64 = rustdesk-1.5.0-1-x86_64.pkg.tar.zst::https://github.com/rustdesk/rustdesk/releases/download/1.5.0/rustdesk-1.5.0-0-x86_64.pkg.tar.zst
+	sha256sums_x86_64 = e920621899aeaa18c6e7e23b2b565615e7dc957dc987494795ca7a94c3108d7d
+	source_aarch64 = rustdesk-1.5.0-1-aarch64.rpm::https://github.com/rustdesk/rustdesk/releases/download/1.5.0/rustdesk-1.5.0-0.aarch64.rpm
+	sha256sums_aarch64 = 1b436234e51ca59bfd3beba6ba81096be13a22a7e2f8b94bd45218b8c77e5e13
 
 pkgname = rustdesk-bin

Comment

The change only bumps rustdesk-bin from 1.4.9 to 1.5.0 and updates the expected SHA-256 checksums for the upstream release artifacts. The source URLs remain HTTPS and point to the official GitHub release assets for rustdesk, with no new build-time code execution, no added scripts, and no packaging logic changes. This is a routine version/checksum update with low security risk.

@@ -6,7 +6,7 @@
 
 pkgbase=rustdesk-bin
 pkgname=(rustdesk-bin)
-pkgver=1.4.9
+pkgver=1.5.0
 pkgrel=1
 pkgdesc="Yet another remote desktop software, written in Rust. Works out of the box, no configuration required."
 url="https://github.com/rustdesk/rustdesk"

Comment

The change only bumps the packaged upstream release from 1.4.9 to 1.5.0 and updates the SHA-256 checksums for the prebuilt upstream artifacts. The source URLs remain HTTPS and point to the official rustdesk GitHub releases, with no new build-time downloads, scripts, or packaging logic changes. Since this is a binary package, the main trust boundary is the upstream release artifact itself; this diff does not introduce additional supply-chain risk beyond that inherent model.

@@ -33,8 +33,8 @@ optdepends=(
 options=('!strip' '!lto' '!debug')
 source_x86_64=("${pkgbase%-bin}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst::$url/releases/download/${pkgver/_/-}/rustdesk-${pkgver/_/-}-0-x86_64.pkg.tar.zst")
 source_aarch64=("${pkgbase%-bin}-${pkgver}-${pkgrel}-aarch64.rpm::$url/releases/download/${pkgver/_/-}/rustdesk-${pkgver/_/-}-0.aarch64.rpm")
-sha256sums_x86_64=('679760e1a1f1b930529069edfaec219afa16b5efe44c1bc593cede0e65576c11')
-sha256sums_aarch64=('3e523df7ceb6f3804b047a3cac797354c4bf46ec19f2d7ff5e198787003cb092')
+sha256sums_x86_64=('e920621899aeaa18c6e7e23b2b565615e7dc957dc987494795ca7a94c3108d7d')
+sha256sums_aarch64=('1b436234e51ca59bfd3beba6ba81096be13a22a7e2f8b94bd45218b8c77e5e13')
 
 install=$pkgname.install