Review Results

Comment

The change is a straightforward version bump in .SRCINFO, updating Plex download URLs and checksums to a newer upstream release. The sources remain HTTPS and point to the official Plex download domain, with no new build logic, scripts, or packaging behavior introduced in this diff. No obvious supply-chain or privilege-escalation concerns are present in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = plex-media-server
 	pkgdesc = The back-end media server component of Plex.
-	pkgver = 1.43.4.10903
+	pkgver = 1.43.5.11029
 	pkgrel = 1
 	url = https://plex.tv/
 	install = plex-media-server.install

Comment

The change is a straightforward version bump in .SRCINFO, updating Plex download URLs and checksums for all architectures. The sources remain HTTPS and point to the official Plex download domain, with no new scripts, patches, build logic, or privilege-related artifacts introduced. I do not see any supply-chain red flags in this diff alone.

@@ -26,13 +26,13 @@ pkgbase = plex-media-server
 	sha256sums = c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557
 	sha256sums = b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad
 	sha256sums = dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631
-	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/redhat/plexmediaserver-1.43.4.10903-e5521bd8c.x86_64.rpm
-	sha256sums_x86_64 = 391598ee0e495794ad60a596eb7386435d4ce4bf5ff8e922cf1f686bee91467b
-	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/redhat/plexmediaserver-1.43.4.10903-e5521bd8c.i686.rpm
-	sha256sums_i686 = 51bb10dfedd829f6fd067e5ba62dd94e49f138f2b22dcff962b2c5eeac3fb726
-	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/debian/plexmediaserver_1.43.4.10903-e5521bd8c_armhf.deb
-	sha256sums_armv7h = 908f716cebaf053500427ff132e56b59f4a69bfda5da927e8439bbf009cb1212
-	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/debian/plexmediaserver_1.43.4.10903-e5521bd8c_arm64.deb
-	sha256sums_aarch64 = 945e86d0514f61492b5169bbeac6e91892b336f6895d78632bec017b5908e5ab
+	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.5.11029-6bf8af3f0/redhat/plexmediaserver-1.43.5.11029-6bf8af3f0.x86_64.rpm
+	sha256sums_x86_64 = 10bcea4e21088c018a11c018bb017255ba32629803314270d280b96361b283f0
+	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.5.11029-6bf8af3f0/redhat/plexmediaserver-1.43.5.11029-6bf8af3f0.i686.rpm
+	sha256sums_i686 = befc40d9979cd002528f6970d658653ca80da10572934636ff1b2aa1bf3ac7b3
+	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.5.11029-6bf8af3f0/debian/plexmediaserver_1.43.5.11029-6bf8af3f0_armhf.deb
+	sha256sums_armv7h = 02fdcf29f378de74905140df0e7671014e764fd09358f9b3e264e4c699a5cb9c
+	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.5.11029-6bf8af3f0/debian/plexmediaserver_1.43.5.11029-6bf8af3f0_arm64.deb
+	sha256sums_aarch64 = b289c218db9c4efa81effab8efb82ca9aba5576f58e95aeb7c485b07db41ec1b
 
 pkgname = plex-media-server

Comment

The change is a straightforward version bump in PKGBUILD: pkgver and the corresponding upstream checksum fragment were updated, with no new sources, build steps, install scripts, or packaging logic introduced. I do not see any added network fetches, privilege changes, persistence mechanisms, or integrity regressions in the provided diff hunk.

@@ -10,8 +10,8 @@
 # Contributor: Praekon <praekon@googlemail.com>
 
 pkgname=plex-media-server
-pkgver=1.43.4.10903
-_pkgsum=e5521bd8c
+pkgver=1.43.5.11029
+_pkgsum=6bf8af3f0
 pkgrel=1
 pkgdesc='The back-end media server component of Plex.'
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')

Comment

The change only updates architecture-specific SHA-256 checksums in PKGBUILD. There are no new sources, no build-script logic changes, no network or privilege-related additions, and no evidence of malicious behavior in the diff hunk itself. The risk is low because integrity hashes are being adjusted, but this is a normal maintenance change and does not by itself introduce a security issue.

@@ -39,10 +39,10 @@ sha256sums=('398ba7958598609453f5289b3d5f2389d2756158b340cf28e83c39d9ed60280b'
             'c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557'
             'b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad'
             'dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631')
-sha256sums_x86_64=('391598ee0e495794ad60a596eb7386435d4ce4bf5ff8e922cf1f686bee91467b')
-sha256sums_i686=('51bb10dfedd829f6fd067e5ba62dd94e49f138f2b22dcff962b2c5eeac3fb726')
-sha256sums_armv7h=('908f716cebaf053500427ff132e56b59f4a69bfda5da927e8439bbf009cb1212')
-sha256sums_aarch64=('945e86d0514f61492b5169bbeac6e91892b336f6895d78632bec017b5908e5ab')
+sha256sums_x86_64=('10bcea4e21088c018a11c018bb017255ba32629803314270d280b96361b283f0')
+sha256sums_i686=('befc40d9979cd002528f6970d658653ca80da10572934636ff1b2aa1bf3ac7b3')
+sha256sums_armv7h=('02fdcf29f378de74905140df0e7671014e764fd09358f9b3e264e4c699a5cb9c')
+sha256sums_aarch64=('b289c218db9c4efa81effab8efb82ca9aba5576f58e95aeb7c485b07db41ec1b')
 
 prepare() {
   if [[ $CARCH = armv7h ]] || [[ $CARCH = aarch64 ]]; then