Review Results

Comment

The change is a straightforward version bump in .SRCINFO, updating the source tarball URL and matching SHA-256 checksum from upstream GitHub release v1.1.2.0 to v1.1.3.0. No new sources, scripts, build steps, permissions, or install-time behavior are introduced in this diff. Based on the provided hunk alone, there are no security red flags.

@@ -1,13 +1,13 @@
 pkgbase = openapv
 	pkgdesc = The reference implementation of the APV codec
-	pkgver = 1.1.2.0
+	pkgver = 1.1.3.0
 	pkgrel = 1
 	url = https://github.com/AcademySoftwareFoundation/openapv/
 	arch = x86_64
 	license = BSD-3-Clause
 	makedepends = cmake
 	depends = glibc
-	source = https://github.com/AcademySoftwareFoundation/openapv/archive/v1.1.2.0/openapv-1.1.2.0.tar.gz
-	sha256sums = 970f65255896c906b22d7c9f9850deeee03fecf001415804848a03b6d1bbe41a
+	source = https://github.com/AcademySoftwareFoundation/openapv/archive/v1.1.3.0/openapv-1.1.3.0.tar.gz
+	sha256sums = 38f841ce44e80c40b682a5323b4f3ebc6e339b6071965bc1c705a17d46ab2fc8
 
 pkgname = openapv

Comment

The change is a version bump in PKGBUILD from 1.1.2.0 to 1.1.3.0 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or packaging logic introduced in the reviewed hunk, so this appears low risk from a security perspective.

@@ -1,7 +1,7 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=openapv
-pkgver=1.1.2.0
+pkgver=1.1.3.0
 pkgrel=1
 pkgdesc='The reference implementation of the APV codec'
 arch=('x86_64')

Comment

The change is a straightforward version bump from 1.1.2.0 to 1.1.3.0 with an updated SHA-256 for the upstream GitHub release tarball. The source remains an HTTPS URL on the official upstream repository, there are no new build steps, no added scripts, no network fetches outside source=(), and no packaging/persistence red flags in the diff. Based on the provided hunk, this looks low risk.

@@ -10,7 +10,7 @@ license=('BSD-3-Clause')
 depends=('glibc')
 makedepends=('cmake')
 source=("https://github.com/AcademySoftwareFoundation/openapv/archive/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
-sha256sums=('970f65255896c906b22d7c9f9850deeee03fecf001415804848a03b6d1bbe41a')
+sha256sums=('38f841ce44e80c40b682a5323b4f3ebc6e339b6071965bc1c705a17d46ab2fc8')
 
 build() {
     CFLAGS+=' -ffat-lto-objects'