Review Results

Comment

The change only bumps pkgver in .SRCINFO from 2.77.1 to 2.78. No build logic, sources, checksums, install scripts, or package metadata beyond the version number are altered in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = snapd
 	pkgdesc = Service and tools for management of snap packages.
-	pkgver = 2.77.1
+	pkgver = 2.78
 	pkgrel = 1
 	url = https://github.com/snapcore/snapd
 	install = snapd.install

Comment

The change only updates the vendored upstream source tarball reference from snapd 2.77.1 to 2.78 and refreshes the corresponding SHA-256 checksum. The source is fetched over HTTPS from the official GitHub releases page, and the versioned release asset is pinned by exact release number rather than a floating branch or tag. No new build-time commands, install scripts, permissions changes, or additional sources are introduced in this .SRCINFO-only diff. Based on the provided hunk, this is a routine version bump with no evident supply-chain or privilege-escalation risk.

@@ -31,7 +31,7 @@ pkgbase = snapd
 	options = !strip
 	options = emptydirs
 	options = !lto
-	source = snapd-2.77.1.tar.xz::https://github.com/snapcore/snapd/releases/download/2.77.1/snapd_2.77.1.vendor.tar.xz
-	sha256sums = 10c824694cd9c9954ba7a826d245458d8fa1006d49937fe480dc9f36b57b1efc
+	source = snapd-2.78.tar.xz::https://github.com/snapcore/snapd/releases/download/2.78/snapd_2.78.vendor.tar.xz
+	sha256sums = 197d5e5870ae7f3681276cea37339d5ee528ddfaf47f53509f858fdad46e4aed
 
 pkgname = snapd

Comment

The change is a routine version bump in PKGBUILD from snapd 2.77.1 to 2.78, with the source URL still pointing to the official GitHub releases page over HTTPS and the checksum updated accordingly. No new build steps, scripts, dependencies, or packaging behavior were introduced in the diff, so there is no evident supply-chain or privilege-escalation risk in this change itself.

@@ -8,7 +8,7 @@ pkgdesc="Service and tools for management of snap packages."
 depends=('squashfs-tools' 'libseccomp' 'libsystemd' 'libcap' 'apparmor')
 optdepends=('bash-completion: bash completion support'
             'xdg-desktop-portal: desktop integration')
-pkgver=2.77.1
+pkgver=2.78
 pkgrel=1
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')
 url="https://github.com/snapcore/snapd"

Comment

The change is a routine version bump of the upstream snapd source tarball and corresponding checksum update. The source remains an HTTPS GitHub release artifact from the official upstream project, with no new build steps, scripts, patches, or packaging logic introduced. I do not see any supply-chain red flags in this diff alone.

@@ -21,7 +21,7 @@ source=(
     "$pkgname-$pkgver.tar.xz::https://github.com/snapcore/${pkgname}/releases/download/${pkgver}/${pkgname}_${pkgver}.vendor.tar.xz"
 )
 
-sha256sums=('10c824694cd9c9954ba7a826d245458d8fa1006d49937fe480dc9f36b57b1efc')
+sha256sums=('197d5e5870ae7f3681276cea37339d5ee528ddfaf47f53509f858fdad46e4aed')
 
 
 prepare() {