Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 26.10.1 to 26.10.3. No source URLs, checksums, build steps, dependencies, install scripts, or packaging permissions were altered in the reviewed hunk. On its face this is a routine metadata update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.1
+	pkgver = 26.10.3
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO from qownnotes 26.10.1 to 26.10.3, with the source URL updated accordingly. No new sources, scripts, build steps, permissions, or packaging metadata were introduced, and the URL remains an HTTPS release tarball from the official upstream GitHub project. Based on the provided diff alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.1/qownnotes-26.10.1.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.3/qownnotes-26.10.3.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward upstream version bump for qownnotes, updating the release tag and matching source tarball checksum. The source remains an HTTPS GitHub release URL, pinned to a specific release version, with no new build-time network access, scripts, patches, or packaging logic changes. I do not see any supply-chain or privilege-related red flags in this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.1
-tag="1463955fdbec65c5e4bcd75a557b761d16d60294"
+pkgver=26.10.3
+tag="cb5250b5bbbdbb2ea4677a59e0d76f0807f82abd"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub release asset for the package version, with no new build steps, scripts, or privilege-related changes. I did not find any added network fetches, embedded binaries, install hooks, or other supply-chain red flags in this diff hunk. Risk is therefore minimal.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('ed0d1e712e7a9734d0ef91e48c5872d90b8b8a62b8de2a6d12a008f111f79699')
+sha256sums=('d2b78eb017e4f501c14572890952175bb6903a1f93cb96c0fc59b833e6ed4772')
 
 prepare() {
     cd "${pkgname}-${pkgver}"