Review Results

Comment

The only change in this diff is a pkgrel bump from 1 to 2 in .SRCINFO. This is metadata-only and does not alter sources, build steps, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by this change.

@@ -1,7 +1,7 @@
 pkgbase = pamac-aur
 	pkgdesc = A Gtk frontend, Package Manager based on libalpm with AUR and Appstream support
 	pkgver = 11.7.5
-	pkgrel = 1
+	pkgrel = 2
 	url = https://github.com/manjaro/pamac
 	install = pamac.install
 	arch = i686

Comment

The change only updates the pinned upstream source archive and matching checksum for pamac from 11.7.5-1 to 11.7.5-2, along with the provided version metadata. The source remains an HTTPS GitHub archive from the upstream Manjaro/pamac repository, and there are no new build-time commands, install scripts, or privilege-related changes in this diff. This looks like a routine version bump with integrity data updated accordingly.

@@ -31,16 +31,16 @@ pkgbase = pamac-aur
 	depends = git
 	optdepends = polkit-gnome: needed for authentification in Cinnamon, Gnome
 	optdepends = lxsession: needed for authentification in Xfce, LXDE etc.
-	provides = pamac=11.7.5-1
+	provides = pamac=11.7.5-2
 	provides = pamac-cli=11.7.4-2
 	conflicts = pamac
 	conflicts = pamac-tray-appindicator
 	conflicts = pamac-cli
 	options = !emptydirs
 	options = !strip
-	source = pamac-11.7.5-1.zip::https://github.com/manjaro/pamac/archive/f94121cf99a4b1e10eb5ccd83098a08ba029c40e.zip
+	source = pamac-11.7.5-2.zip::https://github.com/manjaro/pamac/archive/363e794fef4f9f6a0e54757fd12155cf27e02cc3.zip
 	source = pamac-cli-11.7.4-2.zip::https://github.com/manjaro/pamac-cli/archive/1ce8a93aeeae71244ecec6d257daae5eea3f3fc4.zip
-	sha256sums = bb89537abb93b7a8d474c21ba09159b1d57d0cfe20b8173529f4e0f288a22ad5
+	sha256sums = 46d6d26847a336ae737f4cca2a4a465fba24b5180c726df351f018e8a3343bce
 	sha256sums = e826479979fcc7818385bb146eb1e9f946bb5543489d9a2b671a2ce45ca31a8d
 
 pkgname = pamac-aur

Comment

The change only bumps pkgrel and updates the pinned upstream commit and corresponding source checksum for the main pamac archive. The source URLs remain HTTPS and point to the official Manjaro GitHub repositories, with the VCS-like archive fetches still pinned to specific commits rather than floating branches. I did not find any new build-time network fetches, shell execution, privilege escalation, or packaging/install-script changes. No additional suspicious sources or artifacts were introduced by this diff. Overall this looks like a routine upstream revision/update with no security red flags in the reviewed hunk.

@@ -5,14 +5,14 @@ ENABLE_FAKE_GNOME_SOFTWARE=0
 
 pkgname=pamac-aur
 pkgver=11.7.5
-pkgrel=1
+pkgrel=2
 _pkgfixver=$pkgver
 _pkgfixvercli=11.7.4
 _pkgrelcli=2
 
-_commit='f94121cf99a4b1e10eb5ccd83098a08ba029c40e'
+_commit='363e794fef4f9f6a0e54757fd12155cf27e02cc3'
 _commitcli='1ce8a93aeeae71244ecec6d257daae5eea3f3fc4'
-sha256sums=('bb89537abb93b7a8d474c21ba09159b1d57d0cfe20b8173529f4e0f288a22ad5'
+sha256sums=('46d6d26847a336ae737f4cca2a4a465fba24b5180c726df351f018e8a3343bce'
             'e826479979fcc7818385bb146eb1e9f946bb5543489d9a2b671a2ce45ca31a8d')
 
 pkgdesc="A Gtk frontend, Package Manager based on libalpm with AUR and Appstream support"