Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the Oracle VirtualBox Extension Pack: source URL remains on the official HTTPS VirtualBox download host, the checksum is updated, and the dependency/noextract entries are kept in sync with the new version. No new build logic, scripts, patches, or privilege-related artifacts are introduced by this diff. Based on the provided hunk alone, there are no obvious security concerns.

@@ -1,15 +1,15 @@
 pkgbase = virtualbox-ext-oracle
 	pkgdesc = Oracle VM VirtualBox Extension Pack
-	pkgver = 7.2.20
+	pkgver = 7.2.22
 	pkgrel = 1
 	url = https://www.virtualbox.org/
 	arch = x86_64
 	license = custom:PUEL
-	depends = virtualbox=7.2.20
+	depends = virtualbox=7.2.22
 	optdepends = rdesktop: client to connect vm via RDP
-	noextract = Oracle_VirtualBox_Extension_Pack-7.2.20.vbox-extpack
+	noextract = Oracle_VirtualBox_Extension_Pack-7.2.22.vbox-extpack
 	options = !strip
-	source = https://download.virtualbox.org/virtualbox/7.2.20/Oracle_VirtualBox_Extension_Pack-7.2.20.vbox-extpack
-	sha256sums = 0a050da993f2e3cf2e4e9cda2fa8667e44a2b25479b27abd41af6812c1e43591
+	source = https://download.virtualbox.org/virtualbox/7.2.22/Oracle_VirtualBox_Extension_Pack-7.2.22.vbox-extpack
+	sha256sums = cd5fb32cac59157dc361c90be68ccef1404831aac48ec8377569620afbc9d207
 
 pkgname = virtualbox-ext-oracle

Comment

This is a routine version bump of the VirtualBox Extension Pack from 7.2.20 to 7.2.22, with the source URL still using HTTPS from the official VirtualBox download host and the checksum updated accordingly. No new build steps, scripts, network fetches outside source(), privilege changes, or packaging red flags are introduced by this diff. The change appears low risk and consistent with a normal upstream release update.

@@ -2,7 +2,7 @@
 # Maintainer: Christian Hesse <mail@eworm.de>
 
 pkgname=virtualbox-ext-oracle
-pkgver=7.2.20
+pkgver=7.2.22
 _filever="${pkgver}"
 pkgrel=1
 pkgdesc='Oracle VM VirtualBox Extension Pack'

Comment

The change only updates the SHA-256 checksum for the upstream Oracle VirtualBox Extension Pack download URL. The source remains the official HTTPS VirtualBox download endpoint, there are no new build steps, scripts, or packaging changes, and no evidence of added network access or privilege-sensitive behavior. This is a routine integrity update consistent with a new upstream release artifact, with no security red flags in the diff itself.

@@ -14,7 +14,7 @@ optdepends=('rdesktop: client to connect vm via RDP')
 options=('!strip')
 source=("https://download.virtualbox.org/virtualbox/${_filever}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
 noextract=("Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
-sha256sums=('0a050da993f2e3cf2e4e9cda2fa8667e44a2b25479b27abd41af6812c1e43591')
+sha256sums=('cd5fb32cac59157dc361c90be68ccef1404831aac48ec8377569620afbc9d207')
 
 prepare() {
   mkdir Oracle_VirtualBox_Extension_Pack/