Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 1.6.1 to 1.6.2, updating the source tarball URL, checksum, and the package dependency on backintime-cli to the matching version. No new sources, scripts, install actions, permissions changes, or other suspicious metadata were introduced. The source remains an HTTPS GitHub release tarball and the diff does not suggest any integrity or persistence risk.

@@ -1,23 +1,23 @@
 pkgbase = backintime
-	pkgver = 1.6.1
-	pkgrel = 4
+	pkgver = 1.6.2
+	pkgrel = 1
 	url = https://github.com/bit-team/backintime
 	arch = any
 	license = GPL-1.0-or-later
 	makedepends = asciidoctor
 	makedepends = man-db
 	makedepends = python-pyfakefs
-	source = backintime-1.6.1.tar.gz::https://github.com/bit-team/backintime/archive/refs/tags/v1.6.1.tar.gz
+	source = backintime-1.6.2.tar.gz::https://github.com/bit-team/backintime/archive/refs/tags/v1.6.2.tar.gz
 	source = backintime-backup-job.service
 	source = backintime-backup-job.timer
-	sha256sums = 3d959a902403f11d87865982a38d65d82292af3d54a5c93a710a91175922cfc4
+	sha256sums = 2ca5305492c818a6756839ba9fee4f450467d3359b13b7e456005f3b820178fa
 	sha256sums = bd775a9e1e865323874ad737e61853df873c29c902bb988806fc3943645fb44d
 	sha256sums = 5f9346be71d16786cb547362fe35755c8af59095e985c27d28ac14dfe791b7c8
 
 pkgname = backintime
 	pkgdesc = Simple backup system inspired from the Flyback Project and TimeVault. Qt6 GUI version.
 	install = backintime.install
-	depends = backintime-cli=1.6.1
+	depends = backintime-cli=1.6.2
 	depends = polkit
 	depends = python-pyqt6
 	depends = python-secretstorage

Comment

The change is a routine version bump from 1.6.1 to 1.6.2 with pkgrel reset and an updated source checksum for the upstream GitHub release tarball. No new sources, scripts, build steps, or packaging behaviors were introduced, and the existing PKGBUILD already uses HTTPS and a pinned release tarball. I see no added supply-chain, persistence, or privilege-escalation risk in this diff.

@@ -3,8 +3,8 @@
 
 pkgname=(backintime backintime-cli)
 _pkgname="backintime"
-pkgver=1.6.1
-pkgrel=4
+pkgver=1.6.2
+pkgrel=1
 arch=(any)
 url="https://github.com/bit-team/backintime"
 license=(GPL-1.0-or-later)

Comment

The change is a straightforward upstream version bump from 1.6.1 to 1.6.2 with an updated source tarball checksum. The source remains the official GitHub release tarball over HTTPS, and there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in the diff. The only other modification is the expected checksum refresh for the new release, so I see no security red flags in this hunk.

@@ -12,7 +12,7 @@ makedepends=(asciidoctor man-db python-pyfakefs)
 #checkdepends=(openssh python-dbus rsync systemd python-pyfakefs oxygen-icons python-pylint)
 source=("$_pkgname-$pkgver.tar.gz::https://github.com/bit-team/$_pkgname/archive/refs/tags/v$pkgver.tar.gz"
 backintime-backup-job.{service,timer})
-sha256sums=('3d959a902403f11d87865982a38d65d82292af3d54a5c93a710a91175922cfc4'
+sha256sums=('2ca5305492c818a6756839ba9fee4f450467d3359b13b7e456005f3b820178fa'
             'bd775a9e1e865323874ad737e61853df873c29c902bb988806fc3943645fb44d'
             '5f9346be71d16786cb547362fe35755c8af59095e985c27d28ac14dfe791b7c8')