Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 4.8.0 to 4.8.1, with the source URL updated to the corresponding Codeberg release tarball over HTTPS. No new sources, scripts, build steps, privileges, or packaging behavior are introduced in this diff. The only minor concern is that .SRCINFO records an MD5 checksum rather than a stronger hash, but that is a pre-existing packaging hygiene issue rather than a new security regression in this change.

@@ -1,12 +1,12 @@
 pkgbase = aurget
 	pkgdesc = A simple, Pacman-like AUR helper
-	pkgver = 4.8.0
+	pkgver = 4.8.1
 	pkgrel = 1
 	url = https://codeberg.org/pbrisbin/aurget
 	arch = any
 	license = GPL
 	optdepends = customizepkg: for auto-customizing packages
-	source = https://codeberg.org/pbrisbin/aurget/releases/download/v4.8.0/aurget-4.8.0.tar.gz
-	md5sums = 09fd696cf16faf72375ed26a1104c90e
+	source = https://codeberg.org/pbrisbin/aurget/releases/download/v4.8.1/aurget-4.8.1.tar.gz
+	md5sums = 8b0a77943d3c51b2b88ce5f7ad02edc7
 
 pkgname = aurget

Comment

The change is a version bump in PKGBUILD from 4.8.0 to 4.8.1 with no other modifications. There are no new sources, build steps, install scripts, permissions changes, or packaging logic introduced in the reviewed hunk, so this appears low risk.

@@ -2,7 +2,7 @@
 # shellcheck disable=SC2154
 # Author: Patrick Brisbin <pbrisbin@gmail.com>
 pkgname=aurget
-pkgver=4.8.0
+pkgver=4.8.1
 pkgrel=1
 pkgdesc="A simple, Pacman-like AUR helper"
 arch=('any')

Comment

The change is a straightforward version bump from 4.8.0 to 4.8.1 with the source checksum updated accordingly. No new sources, build steps, install scripts, privilege-related changes, or packaging behavior changes are introduced in the reviewed diff. Based on the provided hunk, there are no obvious supply-chain or persistence concerns.

@@ -16,4 +16,4 @@ package() {
 
   make PREFIX=/usr DESTDIR="$pkgdir" install
 }
-md5sums=('09fd696cf16faf72375ed26a1104c90e')
+md5sums=('8b0a77943d3c51b2b88ce5f7ad02edc7')