Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.30.0 to 1.31.0. No build logic, sources, install scripts, or packaging metadata affecting execution or privileges changed in the provided diff. On its face this is a routine version update with no security-relevant indicators in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = itch-setup-bin
 	pkgdesc = Installer for the itch.io desktop app
-	pkgver = 1.30.0
+	pkgver = 1.31.0
 	pkgrel = 1
 	url = https://itch.io/
 	arch = x86_64

Comment

The change only updates the x86_64 source filename and its corresponding SHA-256 checksum in .SRCINFO. The download URL remains the official HTTPS itch.io endpoint, and there are no new build steps, scripts, or packaging behaviors introduced by this metadata-only update. No obvious supply-chain or privilege-escalation risk is present in the diff itself.

@@ -25,7 +25,7 @@ pkgbase = itch-setup-bin
 	sha256sums = d50905ab2e78d6ed3773959d6fb3c1c2fee724cf497f1c441cacb3765eac30ff
 	sha256sums = 57e1c8ad285b89f3380cd028aa51e8083a8e4327cc5763d396caf607e905efcf
 	sha256sums = 985cf842686598dd7e4e153f6fd7c9ee901fd200403893235e2974b108653bcf
-	source_x86_64 = itch-setup-2026-08-13-22-amd64::https://itch.io/app/download?platform=linux
-	sha256sums_x86_64 = 16e87c1ea4704724e9e07a950ce122990f5c5dc8db269ae342c34919aca1074b
+	source_x86_64 = itch-setup-2026-10-11-12-amd64::https://itch.io/app/download?platform=linux
+	sha256sums_x86_64 = c4fc366af936d99913b1136da290e5710d4e20163da40446eb22a83db2fb423b
 
 pkgname = itch-setup-bin

Comment

The change is a routine version bump from 1.30.0 to 1.31.0 with an updated SHA256 for the x86_64 source artifact. No new sources, scripts, build steps, permissions changes, or packaging logic were introduced in the diff. The package still downloads the upstream itch.io binary from the official domain and installs it without additional execution or privilege escalation. Based on the provided hunk alone, this appears low risk.

@@ -3,7 +3,7 @@
 # Contributor: Amos Wenger <amos@itch.io>
 
 pkgname=itch-setup-bin
-pkgver=1.30.0
+pkgver=1.31.0
 pkgrel=1
 pkgdesc="Installer for the itch.io desktop app"
 arch=(x86_64)

Comment

The change only updates the SHA-256 checksum for the x86_64 source artifact in PKGBUILD. There are no changes to source URLs, build steps, install scripts, permissions, or package contents. This is a normal integrity update and does not introduce any new execution or persistence risk based on the diff provided.

@@ -32,7 +32,7 @@ sha256sums=('94843e035f4d41a0888e872da2cd100cea04cccd8a409c4e46a8a082fb92ec5b'
             'd50905ab2e78d6ed3773959d6fb3c1c2fee724cf497f1c441cacb3765eac30ff'
             '57e1c8ad285b89f3380cd028aa51e8083a8e4327cc5763d396caf607e905efcf'
             '985cf842686598dd7e4e153f6fd7c9ee901fd200403893235e2974b108653bcf')
-sha256sums_x86_64=('16e87c1ea4704724e9e07a950ce122990f5c5dc8db269ae342c34919aca1074b')
+sha256sums_x86_64=('c4fc366af936d99913b1136da290e5710d4e20163da40446eb22a83db2fb423b')
 
 package() {
   install -Dm755 itch-setup-*-amd64 "${pkgdir}/usr/bin/itch-setup"