Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.1.17 to 1.1.18. No build logic, sources, checksums, install scripts, or package metadata beyond the version string are altered in the reviewed hunk. I do note the package URL remains HTTP in the unchanged context, but that is not introduced by this diff and therefore does not affect the verdict for this change alone.

@@ -1,6 +1,6 @@
 pkgbase = ventoy-bin
 	pkgdesc = A new bootable USB solution
-	pkgver = 1.1.17
+	pkgver = 1.1.18
 	pkgrel = 1
 	url = http://www.ventoy.net
 	install = ventoy.install

Comment

The change is a straightforward version bump in .SRCINFO from Ventoy 1.1.17 to 1.1.18, with the corresponding upstream release tarball URL and checksum updated. The source remains the official GitHub release asset over HTTPS, and there are no new build steps, scripts, or privilege-related changes in this diff. No security red flags are introduced by this metadata-only update.

@@ -22,7 +22,7 @@ pkgbase = ventoy-bin
 	optdepends = xfsprogs: XFS partition support
 	provides = ventoy
 	conflicts = ventoy
-	source = https://github.com/ventoy/Ventoy/releases/download/v1.1.17/ventoy-1.1.17-linux.tar.gz
+	source = https://github.com/ventoy/Ventoy/releases/download/v1.1.18/ventoy-1.1.18-linux.tar.gz
 	source = ventoy
 	source = ventoygui
 	source = ventoyweb

Comment

The change is a straightforward version bump in .SRCINFO from Ventoy 1.1.17 to 1.1.18, with the corresponding upstream release tarball URL and checksum updated. The source remains an HTTPS GitHub release asset from the official Ventoy project, and there are no new build steps, scripts, or privilege-related artifacts introduced by this diff. Based on the provided hunk alone, I do not see a security issue.

@@ -31,7 +31,7 @@ pkgbase = ventoy-bin
 	source = ventoy-extend-persistent
 	source = ventoy.desktop
 	source = sanitize.patch
-	sha256sums = 7fb4ed08cef6a6b4d39dd19260d8c80291a78dfdf9af7d461571e23cbbc43805
+	sha256sums = d86ff9de63d94c8b8f1f6b14d23c55af4b88e8207bf2893890892a6a97b1ad54
 	sha256sums = 1ad5d314e02b84127a5a59f3871eb1d28617218cad07cde3eeddcac391473000
 	sha256sums = 0215dbaf2095f5eeb2d40d9731268ed724790565e1dcaad67ffa4af80b5d8330
 	sha256sums = c3d4463a878a89d96e5f0bc4e1a43e48f27af5965bd4c977567695d7cf91fe5f

Comment

The only change in this commit is a pkgver/sha256sum bump for ventoy 1.1.18. I reviewed the accompanying PKGBUILD and the referenced sanitize.patch for context: the package still downloads the official GitHub release tarball over HTTPS, uses pinned release artifacts with checksums, and the patch only removes some runtime checks/logging and adjusts paths. No new build-time network access, privilege escalation, suspicious install script behavior, or additional sources were introduced by this diff. The version bump itself does not add a security concern beyond the existing package baseline.

@@ -3,7 +3,7 @@
 # Contributor: KokaKiwi <kokakiwi+aur@kokakiwi.net>
 
 pkgname=ventoy-bin
-pkgver=1.1.17
+pkgver=1.1.18
 pkgrel=1
 pkgdesc="A new bootable USB solution"
 arch=('aarch64' 'i686' 'x86_64')

Comment

The change only bumps ventoy-bin from 1.1.17 to 1.1.18 and updates the tarball checksum accordingly. The source remains the official Ventoy GitHub release URL over HTTPS, there are no new build-time downloads, no added scripts, and no changes to install-time behavior or permissions. I did not find any new supply-chain or persistence red flags in this diff.

@@ -37,7 +37,7 @@ source=("https://github.com/ventoy/Ventoy/releases/download/v${pkgver}/${pkgname
         "${pkgname%-bin}-extend-persistent"
         "${pkgname%-bin}.desktop"
         'sanitize.patch')
-sha256sums=('7fb4ed08cef6a6b4d39dd19260d8c80291a78dfdf9af7d461571e23cbbc43805'
+sha256sums=('d86ff9de63d94c8b8f1f6b14d23c55af4b88e8207bf2893890892a6a97b1ad54'
             '1ad5d314e02b84127a5a59f3871eb1d28617218cad07cde3eeddcac391473000'
             '0215dbaf2095f5eeb2d40d9731268ed724790565e1dcaad67ffa4af80b5d8330'
             'c3d4463a878a89d96e5f0bc4e1a43e48f27af5965bd4c977567695d7cf91fe5f'