Review Results

Comment

The change only bumps pkgrel from 2 to 3 in .SRCINFO, with no source, build, install, dependency, or metadata changes beyond the release number. This is a routine packaging revision and does not introduce any new security-relevant behavior.

@@ -1,7 +1,7 @@
 pkgbase = ncurses5-compat-libs
 	pkgdesc = System V Release 4.0 curses emulation library, ABI 5
 	pkgver = 6.6
-	pkgrel = 2
+	pkgrel = 3
 	url = https://invisible-island.net/ncurses/ncurses.html
 	arch = i686
 	arch = x86_64

Comment

The change only swaps the ncurses source and signature URLs in .SRCINFO from the upstream project site (invisible-island.net) to the GNU FTP mirror, while keeping the same version, checksum, and PGP key. This does not introduce build-time execution, privilege changes, or new untrusted sources; both hosts are legitimate upstream distribution points for ncurses. The .sig extension is also consistent with a signed release artifact. No security issue is evident from this diff alone.

@@ -11,8 +11,8 @@ pkgbase = ncurses5-compat-libs
 	depends = sh
 	provides = libtinfo5
 	conflicts = libtinfo5
-	source = https://invisible-island.net/archives/ncurses/ncurses-6.6.tar.gz
-	source = https://invisible-island.net/archives/ncurses/ncurses-6.6.tar.gz.asc
+	source = https://ftp.gnu.org/pub/gnu/ncurses/ncurses-6.6.tar.gz
+	source = https://ftp.gnu.org/pub/gnu/ncurses/ncurses-6.6.tar.gz.sig
 	validpgpkeys = 19882D92DDA4C400C22C0D56CC2AF4472167BE03
 	sha256sums = 355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11
 	sha256sums = SKIP