Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.2.96.518 to 1.3.4.258. No source URLs, checksums, build steps, install scripts, or package metadata affecting trust boundaries changed in the provided diff. On its face this is a routine upstream version update with no direct security red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = spotify
 	pkgdesc = A proprietary music streaming service
-	pkgver = 1.2.96.518
+	pkgver = 1.3.4.258
 	pkgrel = 2
 	epoch = 1
 	url = https://www.spotify.com

Comment

The change only bumps the packaged Spotify version and updates the corresponding source/checksum entries in .SRCINFO. It does not introduce new sources, scripts, build steps, or privilege-related changes. One issue remains that the Spotify repository URLs are still plain HTTP rather than HTTPS, which is a supply-chain integrity weakness, but this was pre-existing and unchanged in this diff. No new high-risk behavior is introduced by this commit.

@@ -21,15 +21,15 @@ pkgbase = spotify
 	optdepends = zenity: Adds support for importing local files
 	optdepends = libnotify: Desktop notifications
 	options = !strip
-	source = spotify-1.2.96.518-g366879e1-x86_64.deb::http://repository.spotify.com/pool/non-free/s/spotify-client/spotify-client_1.2.96.518.g366879e1_amd64.deb
+	source = spotify-1.3.4.258-gc60b10b0946a-x86_64.deb::http://repository.spotify.com/pool/non-free/s/spotify-client/spotify-client_1.3.4.258.gc60b10b0946a_amd64.deb
 	source = spotify.sh
 	source = spotify.protocol
 	source = LICENSE
-	source = spotify-1.2.96.518-2-Release::http://repository.spotify.com/dists/testing/Release
-	source = spotify-1.2.96.518-2-Release.sig::http://repository.spotify.com/dists/testing/Release.gpg
-	source = spotify-1.2.96.518-2-x86_64-Packages::http://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages
+	source = spotify-1.3.4.258-2-Release::http://repository.spotify.com/dists/testing/Release
+	source = spotify-1.3.4.258-2-Release.sig::http://repository.spotify.com/dists/testing/Release.gpg
+	source = spotify-1.3.4.258-2-x86_64-Packages::http://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages
 	validpgpkeys = E1096BCBFF6D418796DE78515384CE82BA52C83A
-	sha512sums = 98d25bd748258ca8b8357313cd35c7188bb0b26ed2d4390b0208473aa9fa3491a095559762f8ba06ec0828d73e05ee8fb488f0f357340191da4c65dd1f93c519
+	sha512sums = ad2198da6be2f3286a661d0315c124cb94c51084fabf630e34a296f3683599f1d8067e95512c150ed04b3c86526c8a0cff9b93584b39a145befaf6c478deb883
 	sha512sums = da48b628a4ea925dd8521133ebf364b261b11aed252d264dde6605d915cdb631919ffe672c58534bcdb60869e5d87a49a60a8198780b99517123f0031e83fdb1
 	sha512sums = 999abe46766a4101e27477f5c9f69394a4bb5c097e2e048ec2c6cb93dfa1743eb436bde3768af6ba1b90eaac78ea8589d82e621f9cbe7d9ab3f41acee6e8ca20
 	sha512sums = 2e16f7c7b09e9ecefaa11ab38eb7a792c62ae6f33d95ab1ff46d68995316324d8c5287b0d9ce142d1cf15158e61f594e930260abb8155467af8bc25779960615

Comment

The change only bumps the packaged Spotify version and updates the pinned upstream commit/hash values in PKGBUILD. I do not see any new build steps, scripts, privilege changes, or additional sources introduced by this diff. One issue remains from the package itself: the source URLs are still plain HTTP rather than HTTPS, which is a supply-chain integrity risk, but that is pre-existing and not introduced by this change. Based on the reviewed hunk alone, this is low risk.

@@ -6,9 +6,9 @@
 # Contributor: Eothred <yngve.levinsen@gmail.com>
 
 pkgname=spotify
-pkgver='1.2.96.518'
+pkgver='1.3.4.258'
 epoch=1
-_commit=g366879e1
+_commit=gc60b10b0946a
 pkgrel=2
 pkgdesc='A proprietary music streaming service'
 arch=('x86_64')

Comment

The change only updates SHA-512 checksums for existing Spotify repository artifacts in PKGBUILD. No source URLs, build commands, install scripts, permissions, or package metadata were altered. I did not see any new network fetches, privilege escalation, or persistence mechanisms introduced by this diff. The security impact is limited to trusting a different set of upstream artifact hashes, which is expected when upstream packages change.

@@ -34,13 +34,13 @@ source=("${pkgname}-${pkgver}-${_commit}-x86_64.deb::http://repository.spotify.c
         "${pkgname}-${pkgver}-${pkgrel}-Release::http://repository.spotify.com/dists/testing/Release"
         "${pkgname}-${pkgver}-${pkgrel}-Release.sig::http://repository.spotify.com/dists/testing/Release.gpg"
         "${pkgname}-${pkgver}-${pkgrel}-x86_64-Packages::http://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages")
-sha512sums=('98d25bd748258ca8b8357313cd35c7188bb0b26ed2d4390b0208473aa9fa3491a095559762f8ba06ec0828d73e05ee8fb488f0f357340191da4c65dd1f93c519'
+sha512sums=('ad2198da6be2f3286a661d0315c124cb94c51084fabf630e34a296f3683599f1d8067e95512c150ed04b3c86526c8a0cff9b93584b39a145befaf6c478deb883'
             'da48b628a4ea925dd8521133ebf364b261b11aed252d264dde6605d915cdb631919ffe672c58534bcdb60869e5d87a49a60a8198780b99517123f0031e83fdb1'
             '999abe46766a4101e27477f5c9f69394a4bb5c097e2e048ec2c6cb93dfa1743eb436bde3768af6ba1b90eaac78ea8589d82e621f9cbe7d9ab3f41acee6e8ca20'
             '2e16f7c7b09e9ecefaa11ab38eb7a792c62ae6f33d95ab1ff46d68995316324d8c5287b0d9ce142d1cf15158e61f594e930260abb8155467af8bc25779960615'
-            '18f27971697835df865d63465d86d1250b20b9d1c12bbf7df1eafeef5c66bf0b3134c25b08269f72d4b7a4287151336ee3fd0f70bc46da25f13e8c91c004f710'
+            '895e1205977aa39a4c6ee98c1a674c36133e0e16903ac2627ea28a3bca432310c6dcdc8be6e3029d2c9065227db71597097fa07a4eb162296192bc1fd1af1961'
             'SKIP'
-            '1fbb6f1f104b998265faafeb62cb3aff6d7048b2e689292049fbbe867ea4071af3b73fc5a023bff8d4c1e579e5d904c78179e3650ae4740602583db8e13bde8a')
+            '267122182809ce2eea288fd21aaf33e991e6bf55e602eebf53c3b44fac32dbf28adf666f6de15c55d000565e1b6d0c69bf280e39360bb2eb7006287e006653d4')
 
 # Import key with:
 # curl -sS https://download.spotify.com/debian/pubkey_5384CE82BA52C83A.gpg | gpg --import -