Review Results

Comment

The change only bumps the package version in .SRCINFO from 270.4.3312 to 272.4.3798. No sources, checksums, build steps, install scripts, permissions, or packaging metadata were altered in the provided diff hunk. On its face this is a routine version update with no new security red flags visible in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = dropbox
 	pkgdesc = A free service that lets you bring your photos, docs, and videos anywhere and share them easily.
-	pkgver = 270.4.3312
+	pkgver = 272.4.3798
 	pkgrel = 1
 	url = https://www.dropbox.com
 	arch = x86_64

Comment

The change only updates the Dropbox upstream release tarball URL and its corresponding checksum in .SRCINFO, while keeping HTTPS, the official Dropbox host, and the existing PGP verification key intact. No new sources, scripts, permissions, or packaging behavior are introduced. This is a routine version bump with no evident security regression in the reviewed diff.

@@ -24,14 +24,14 @@ pkgbase = dropbox
 	source = terms.txt
 	source = dropbox.service
 	source = dropbox@.service
-	source = https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-270.4.3312.tar.gz
-	source = https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-270.4.3312.tar.gz.asc
+	source = https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-272.4.3798.tar.gz
+	source = https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-272.4.3798.tar.gz.asc
 	validpgpkeys = 1C61A2656FB57B7E4DE0F4C1FC918B335044912E
 	sha256sums = 9ba76205ec5838db85d822f23cfd7e2112fd2757e8031d8374709f102143c548
 	sha256sums = 1610ff57e8b20ee7a37682c3cc505da4ddc9cec2bd7234c90c0f2073657521d2
 	sha256sums = 6c67a9c8c95c08fafafd2f1d828074b13e3347b05d2e4f4bf4e62746115d7477
 	sha256sums = 98581e65a91ae1f19ed42edcdaaa52e102298b5da0d71b50089393d364474d3d
-	sha256sums = 35404957d2a15dcac998d53cbec692d5236e197493f6c009accd91ea9aa8f34c
+	sha256sums = bf0b0945ace2c02fe790189fece8a2fa9c3a9c7e9fef879eb34b01098a957a01
 	sha256sums = SKIP
 
 pkgname = dropbox

Comment

The change only bumps pkgver in PKGBUILD from 270.4.3312 to 272.4.3798. No source URLs, checksums, build steps, install scripts, permissions, or package metadata beyond the version string are altered in the provided diff. Based on this hunk alone, there is no evidence of added supply-chain risk or malicious behavior.

@@ -4,7 +4,7 @@
 # Contributor: David Manouchehri <d@32t.ca>
 
 pkgname=dropbox
-pkgver=270.4.3312
+pkgver=272.4.3798
 pkgrel=1
 pkgdesc="A free service that lets you bring your photos, docs, and videos anywhere and share them easily."
 arch=("x86_64")

Comment

The change only updates the Dropbox upstream tarball checksum and pkgver to a new release. I did not see any new sources, build steps, install scripts, or packaging logic changes that would introduce code execution or persistence risks. The package still downloads the official Dropbox release over HTTPS and verifies it with a PGP signature plus SHA256. This diff is low risk and appears to be a routine version bump.

@@ -31,7 +31,7 @@ sha256sums=('9ba76205ec5838db85d822f23cfd7e2112fd2757e8031d8374709f102143c548'
             '1610ff57e8b20ee7a37682c3cc505da4ddc9cec2bd7234c90c0f2073657521d2'
             '6c67a9c8c95c08fafafd2f1d828074b13e3347b05d2e4f4bf4e62746115d7477'
             '98581e65a91ae1f19ed42edcdaaa52e102298b5da0d71b50089393d364474d3d'
-            '35404957d2a15dcac998d53cbec692d5236e197493f6c009accd91ea9aa8f34c'
+            'bf0b0945ace2c02fe790189fece8a2fa9c3a9c7e9fef879eb34b01098a957a01'
             'SKIP')
 # The PGP key fingerprint should match the one on https://www.dropbox.com/help/desktop-web/linux-commands
 validpgpkeys=(