Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 12.0.3 to 12.0.4. No sources, checksums, build steps, install scripts, permissions, or dependencies are altered, so there is no new security-relevant behavior visible in this change. Based on the provided hunk alone, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = downgrade
 	pkgdesc = Bash script for downgrading one or more packages to a version in your cache or the A.L.A.
-	pkgver = 12.0.3
+	pkgver = 12.0.4
 	pkgrel = 1
 	url = https://github.com/archlinux-downgrade/downgrade
 	arch = any

Comment

The change is a straightforward version bump in .SRCINFO from downgrade 12.0.3 to 12.0.4, with the source URL and sha256 checksum updated accordingly. The source remains an HTTPS GitHub release tarball from the upstream project, and there are no new build steps, scripts, or packaging metadata changes that would introduce execution, persistence, or integrity risks. Based on the provided diff alone, this appears low risk.

@@ -9,7 +9,7 @@ pkgbase = downgrade
 	depends = fzf
 	optdepends = sudo: for installation via sudo
 	backup = etc/xdg/downgrade/downgrade.conf
-	source = https://github.com/archlinux-downgrade/downgrade/releases/download/v12.0.3/downgrade-12.0.3.tar.gz
-	sha256sums = 94591a763d95242b8f19543bc4b6b3101922d8544c3f4e157b2fa60a50089067
+	source = https://github.com/archlinux-downgrade/downgrade/releases/download/v12.0.4/downgrade-12.0.4.tar.gz
+	sha256sums = 6049701f233ecbc39a1b0b4c7921c1433dda12a1545b55f6264f60867abf84ba
 
 pkgname = downgrade

Comment

The change is a simple version bump in PKGBUILD from 12.0.3 to 12.0.4 with no other modifications. There are no new sources, build steps, install scripts, permissions changes, or other security-relevant alterations in the provided diff hunk. Based on this diff alone, I see no evidence of supply-chain risk or malicious behavior.

@@ -2,7 +2,7 @@
 # shellcheck disable=SC2154
 # Author: Patrick Brisbin <pbrisbin@gmail.com>
 pkgname=downgrade
-pkgver=12.0.3
+pkgver=12.0.4
 pkgrel=1
 pkgdesc="Bash script for downgrading one or more packages to a version in your cache or the A.L.A."
 arch=('any')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. I checked the surrounding PKGBUILD context: the source is an HTTPS GitHub release URL pinned to the package version, there are no added build-time downloads, scripts, privilege escalation, or packaging changes. This is a routine integrity update with no security red flags in the diff itself.

@@ -18,4 +18,4 @@ package() {
 
   make DESTDIR="$pkgdir" PREFIX=/usr install
 }
-sha256sums=('94591a763d95242b8f19543bc4b6b3101922d8544c3f4e157b2fa60a50089067')
+sha256sums=('6049701f233ecbc39a1b0b4c7921c1433dda12a1545b55f6264f60867abf84ba')