Review Results

Comment

The change only bumps pkgrel from 2 to 3 in PKGBUILD with no source, build, install, dependency, or script changes. This is a packaging revision-only update and does not introduce new attack surface or integrity concerns in the reviewed hunk.

@@ -7,7 +7,7 @@
 pkgname=ncurses5-compat-libs
 _pkgname=ncurses
 pkgver=6.6
-pkgrel=2
+pkgrel=3
 pkgdesc='System V Release 4.0 curses emulation library, ABI 5'
 arch=(i686 x86_64)
 url='https://invisible-island.net/ncurses/ncurses.html'

Comment

The change only switches the upstream tarball mirror from invisible-island.net to ftp.gnu.org and changes the detached signature file from .asc to .sig, while keeping the same pinned version and PGP key verification. I do not see any new build-time execution, privilege escalation, or integrity regression in this diff. The package still verifies the source with a checksum and a trusted maintainer key, and the source remains HTTPS. Minor supply-chain concern: the new mirror is less clearly the canonical ncurses release location than the project site, but this does not introduce a concrete security issue in the package itself.

@@ -15,7 +15,7 @@ license=(MIT)
 depends=(glibc gcc-libs sh)
 provides=(libtinfo5)
 conflicts=(libtinfo5)
-source=(https://invisible-island.net/archives/ncurses/ncurses-$pkgver.tar.gz{,.asc})
+source=(https://ftp.gnu.org/pub/gnu/ncurses/ncurses-$pkgver.tar.gz{,.sig})
 sha256sums=('355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11'
             'SKIP')
 validpgpkeys=('19882D92DDA4C400C22C0D56CC2AF4472167BE03')  # Thomas Dickey