Review Results

Comment

The change is a routine version bump in .SRCINFO for the NVIDIA beta package: pkgver/provides/dependency pins and source/checksums are updated consistently to 615.78.08. No new build steps, scripts, privileges, or additional sources are introduced. One pre-existing concern remains that the upstream NVIDIA installer is fetched over plain HTTP rather than HTTPS, but this issue is unchanged by this diff and therefore does not increase risk for this specific change. Overall this diff appears low risk.

@@ -1,23 +1,23 @@
 pkgbase = nvidia-beta
 	pkgdesc = NVIDIA kernel module (beta version)
-	pkgver = 615.71.09
+	pkgver = 615.78.08
 	pkgrel = 1
 	url = https://www.nvidia.com/
 	arch = x86_64
 	license = LicenseRef-Custom
 	makedepends = dkms
 	makedepends = linux-headers
-	provides = nvidia=615.71.09
-	provides = nvidia-beta=615.71.09
+	provides = nvidia=615.78.08
+	provides = nvidia-beta=615.78.08
 	provides = NVIDIA-MODULE
 	conflicts = nvidia
 	options = !strip
-	source = http://us.download.nvidia.com/XFree86/Linux-x86_64/615.71.09/NVIDIA-Linux-x86_64-615.71.09-no-compat32.run
+	source = http://us.download.nvidia.com/XFree86/Linux-x86_64/615.78.08/NVIDIA-Linux-x86_64-615.78.08-no-compat32.run
 	source = 110-nvidia-change-dkms-conf.patch
-	sha256sums = e5545862c291f3991a91ee40dd9c7a71cccc69247a193d5e5b891bfd964ac104
-	sha256sums = 5a94430787c3e75c896af0a2af616491ec71ea60cc999f90fb5f17d9f0fe07ac
+	sha256sums = e9d5167f4ca67f58b2b3447584b1e4273218d5088aba210d3aef2a407e522892
+	sha256sums = 673dc16f8b2e962c8f2081fa57b4a4b2774f783205e6eb20120f3d0d1a42317e
 
 pkgname = nvidia-beta
 	depends = libglvnd
 	depends = linux
-	depends = nvidia-utils-beta=615.71.09
+	depends = nvidia-utils-beta=615.78.08

Comment

This change only updates the NVIDIA DKMS package version string in a patch from 615.71.09 to 615.78.08. It does not introduce new code paths, network access, privilege changes, persistence mechanisms, or packaging behavior changes. The patch remains a straightforward version bump for an existing DKMS configuration adjustment, with no security-relevant red flags visible in the provided hunk.

@@ -3,7 +3,7 @@
 @@ -1,12 +1,21 @@
  PACKAGE_NAME="nvidia"
 -PACKAGE_VERSION="__VERSION_STRING"
-+PACKAGE_VERSION="615.71.09"
++PACKAGE_VERSION="615.78.08"
  AUTOINSTALL="yes"
  
  # By default, DKMS will add KERNELRELEASE to the make command line; however,

Comment

The only change in this diff is a version bump of the NVIDIA beta driver from 615.71.09 to 615.78.08, along with the corresponding SHA-256 updates for the upstream .run installer and an existing patch. The package still sources the installer from NVIDIA over HTTP rather than HTTPS, which is a pre-existing integrity concern, but this commit does not introduce new attack surface, new commands, or packaging behavior changes. No evidence here of malicious code, persistence, privilege escalation, or build-time network fetching beyond the already-declared upstream installer. Risk is low because the change is a routine version/hash refresh only.

@@ -4,7 +4,7 @@
 # Contributor: Dan Vratil
 
 pkgname=nvidia-beta
-pkgver=615.71.09
+pkgver=615.78.08
 pkgrel=1
 pkgdesc="NVIDIA kernel module (beta version)"
 arch=('x86_64')

Comment

Risk is low. The change only updates the NVIDIA upstream release tarball checksum and the checksum for a local DKMS patch to match the new version. The PKGBUILD still sources the vendor .run from NVIDIA over HTTP (a pre-existing issue in this package, but not introduced by this diff), and the patch content itself is not suspicious: it hardcodes the new version, adjusts DKMS module declarations, and changes the build parallelism to nproc. There are no new network fetches, privilege escalations, persistence mechanisms, or packaging writes outside $pkgdir in the reviewed change.

@@ -19,8 +19,8 @@ options=('!strip')
 _pkg="NVIDIA-Linux-${CARCH}-${pkgver}-no-compat32"
 source=("http://us.download.nvidia.com/XFree86/Linux-${CARCH}/${pkgver}/${_pkg}.run"
         '110-nvidia-change-dkms-conf.patch')
-sha256sums=('e5545862c291f3991a91ee40dd9c7a71cccc69247a193d5e5b891bfd964ac104'
-            '5a94430787c3e75c896af0a2af616491ec71ea60cc999f90fb5f17d9f0fe07ac')
+sha256sums=('e9d5167f4ca67f58b2b3447584b1e4273218d5088aba210d3aef2a407e522892'
+            '673dc16f8b2e962c8f2081fa57b4a4b2774f783205e6eb20120f3d0d1a42317e')
 
 prepare() {
     # extract the source file