Review Results

Comment

The only change in this diff is a version bump in .SRCINFO from 6.8.1 to 7.0.0. No build logic, sources, checksums, install scripts, or package metadata beyond pkgver changed in the provided hunk. Based on this diff alone there is no evidence of malicious behavior or integrity regression.

@@ -1,6 +1,6 @@
 pkgbase = davmail
 	pkgdesc = a POP/IMAP/SMTP/Caldav/LDAP gateway for the exchange service
-	pkgver = 6.8.1
+	pkgver = 7.0.0
 	pkgrel = 1
 	url = http://davmail.sourceforge.net/
 	install = davmail.install

Comment

The change is a straightforward version bump in .SRCINFO for davmail, updating the upstream zip and its checksum. I do note the source URL still uses http://downloads.sourceforge.net rather than HTTPS, which is a supply-chain integrity weakness because the archive fetch is not protected against MITM tampering. However, this issue already existed in the package metadata and is not newly introduced by this diff. No other suspicious sources, scripts, or packaging behavior are present in the provided hunk.

@@ -13,11 +13,11 @@ pkgbase = davmail
 	depends = java-runtime
 	optdepends = java-openjfx: Office 365 browser based authentication
 	optdepends = swt: Fix issues with the tray icon
-	source = http://downloads.sourceforge.net/davmail/davmail-6.8.1-4210.zip
+	source = http://downloads.sourceforge.net/davmail/davmail-7.0.0-4403.zip
 	source = davmail.desktop
 	source = davmail@.system_service
 	source = davmail@.user_service
-	md5sums = ffa3d03fa274c0d9db326ab3b8866aff
+	md5sums = b3a6c84c92f4e7c1b17d4554cf1a3c4b
 	md5sums = 1df37a6120d88de8df3cb735977336ba
 	md5sums = 8d373851babe1d8bb860228c8b4db702
 	md5sums = 271e9e66dfdb496d242c9a6102937c65

Comment

The change is a straightforward version bump for davmail from 6.8.1 to 7.0.0 with the corresponding SourceForge revision and checksum update. I do note the source URL still uses plain HTTP rather than HTTPS, which is a supply-chain integrity weakness, but this is pre-existing in the package and not introduced by this diff. No new build-time network fetches, scripts, or packaging logic were added in the reviewed hunk.

@@ -1,7 +1,7 @@
 # Contributor: Hy Goldsher <hyness-at-freshlegacycode-dot-org>
 # Maintainer: Hy Goldsher <hyness-at-freshlegacycode-dot-org>
 pkgname=davmail
-pkgver=6.8.1
+pkgver=7.0.0
 pkgrel=1
 pkgdesc="a POP/IMAP/SMTP/Caldav/LDAP gateway for the exchange service"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a straightforward upstream version bump for davmail, with the source still coming from the same SourceForge release URL and the checksum updated accordingly. I do note the source URL uses plain HTTP rather than HTTPS, which is a supply-chain integrity weakness in general, but this is pre-existing and not introduced by this diff. No new build-time network fetches, scripts, privilege changes, or suspicious packaging behavior are added in the reviewed hunk. Overall this looks low risk.

@@ -11,12 +11,12 @@ makedepends=('unzip')
 depends=('java-runtime')
 optdepends=('java-openjfx: Office 365 browser based authentication'
             'swt: Fix issues with the tray icon')
-_rev=4210
+_rev=4403
 source=(http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver-$_rev.zip
         $pkgname.desktop
         $pkgname@.system_service
         $pkgname@.user_service)
-md5sums=('ffa3d03fa274c0d9db326ab3b8866aff'
+md5sums=('b3a6c84c92f4e7c1b17d4554cf1a3c4b'
          '1df37a6120d88de8df3cb735977336ba'
          '8d373851babe1d8bb860228c8b4db702'
          '271e9e66dfdb496d242c9a6102937c65')