Review Results

Comment

The change only updates .gitignore to unignore two additional repository files: bump.sh and .nvchecker.toml. This does not affect the package build, install scripts, or shipped artifacts directly, and there is no evidence in the provided diff of malicious behavior, privilege escalation, network access, or packaging integrity issues. Based on this hunk alone, the risk is minimal.

@@ -4,3 +4,5 @@
 !.SRCINFO
 !vesktop.desktop
 !vesktop.sh
+!bump.sh
+!.nvchecker.toml

Comment

The change adds an nvchecker source definition for vesktop-bin pointing to the official upstream GitHub repository over HTTPS, with a simple version prefix. There are no build, install, or execution changes, no suspicious extra sources, and no evidence of typosquatting, pinned-vs-floating VCS misuse in the package build itself, or any persistence/privilege-related behavior. This is low risk and appears to be metadata only.

@@ -0,0 +1,4 @@
+[vesktop-bin]
+source = "git"
+git = "https://github.com/Vencord/Vesktop.git"
+prefix = "v"

Comment

The new bump.sh is a simple maintainer convenience script that runs `pkgctl version upgrade` and regenerates `.SRCINFO` with `makepkg --printsrcinfo`. It does not download or execute arbitrary remote content itself, does not modify system paths, and contains no persistence, privilege escalation, or packaging-time network logic beyond the external `pkgctl` helper invocation. The only minor concern is that `pkgctl version upgrade` is an external tool whose behavior is not visible here, but in this diff it is used in the standard AUR maintenance workflow and there is no evidence of malicious behavior in the script itself.

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+pkgctl version upgrade
+makepkg --printsrcinfo > .SRCINFO