Review Results

Comment

The only change in this .SRCINFO hunk is a routine version bump from 1.6.7-5 to 1.6.8-1. No source URLs, checksums, build commands, install scripts, or packaging permissions are altered here, so this diff does not introduce any new security concern by itself. Any risk would depend on the corresponding PKGBUILD/source changes, which are outside the provided hunk.

@@ -1,7 +1,7 @@
 pkgbase = vesktop-bin
 	pkgdesc = A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.
-	pkgver = 1.6.7
-	pkgrel = 5
+	pkgver = 1.6.8
+	pkgrel = 1
 	url = https://vesktop.dev/
 	arch = aarch64
 	arch = x86_64

Comment

The change is a routine version bump in .SRCINFO from 1.6.7 to 1.6.8, updating the GitHub release URLs, noextract entries, and checksums for the upstream binary tarballs and icon source. The sources remain HTTPS and point to the official upstream repository/releases, with pinned release artifacts and updated hashes. No new build-time code execution, install-script behavior, privilege escalation, or suspicious metadata was introduced in this diff.

@@ -12,20 +12,21 @@ pkgbase = vesktop-bin
 	optdepends = speech-dispatcher: High-level device independent layer for speech synthesis interface
 	optdepends = libnotify: Notifications
 	optdepends = xdg-utils: Open links, files, etc
-	provides = vesktop=1.6.7
-	provides = vencord-desktop=1.6.7
+	provides = vesktop=1.6.8
+	provides = vencord-desktop=1.6.8
 	conflicts = vesktop
 	conflicts = vencord-desktop
-	noextract = vesktop-1.6.7.tar.gz
+	noextract = vesktop-1.6.8.tar.gz
+	noextract = vesktop-1.6.8-arm64.tar.gz
 	source = vesktop.sh
 	source = vesktop.desktop
-	source = https://github.com/Vencord/Vesktop/raw/refs/tags/v1.6.7/build/icon.svg
+	source = https://github.com/Vencord/Vesktop/raw/refs/tags/v1.6.8/build/icon.svg
 	sha256sums = db901fa9af0ce812f48ecba9c338162bd5b12f6586fefca2bc6b6509430ea351
 	sha256sums = 455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46
 	sha256sums = 7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f
-	source_aarch64 = vesktop-1.6.7.tar.gz::https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7-arm64.tar.gz
-	sha256sums_aarch64 = 23841d3348aa4addd7ca7301172d927feb1ad6e62b1bf288871004d65d154f7f
-	source_x86_64 = https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7.tar.gz
-	sha256sums_x86_64 = 152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66
+	source_aarch64 = https://github.com/Vencord/Vesktop/releases/download/v1.6.8/vesktop-1.6.8-arm64.tar.gz
+	sha256sums_aarch64 = 2aecdb99058ea7c2e8295feda80f72e199416bf29a27adae0f9ac4855ad737ad
+	source_x86_64 = https://github.com/Vencord/Vesktop/releases/download/v1.6.8/vesktop-1.6.8.tar.gz
+	sha256sums_x86_64 = 477dc07e9da85cf3f86b890f00cebe328d82ef62a40790bb515f18de38845a46
 
 pkgname = vesktop-bin

Comment

The only change in this hunk is a version bump from 1.6.7-5 to 1.6.8-1. No build logic, sources, install scripts, permissions, or dependency metadata are altered in the reviewed diff. Based on this hunk alone, there are no new security concerns introduced.

@@ -6,8 +6,8 @@
 pkgname=vesktop-bin
 _pkgname=vesktop
 _appname=vencord-desktop
-pkgver=1.6.7
-pkgrel=5
+pkgver=1.6.8
+pkgrel=1
 pkgdesc="A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed."
 arch=(
     'aarch64'

Comment

The change is limited to updating vesktop-bin to 1.6.8 and adjusting the architecture-specific release tarball handling/checksums. I do not see any new execution paths, network fetches at build time, privilege escalation, or suspicious install-time behavior introduced by this diff. The package still downloads release artifacts over HTTPS from the upstream GitHub release/tag URLs and verifies them with updated SHA-256 sums. The only functional change is selecting the correct archive name for aarch64 in package(), which is packaging logic rather than a security concern.

@@ -31,19 +31,19 @@ optdepends=(
     'xdg-utils: Open links, files, etc'
 )
 
-source_aarch64=("${_pkgname}-${pkgver}.tar.gz::${_ghurl}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-arm64.tar.gz")
+source_aarch64=("${_ghurl}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-arm64.tar.gz")
 source_x86_64=("${_ghurl}/releases/download/v${pkgver}/${_pkgname}-${pkgver}.tar.gz")
 source=(
     "${_pkgname}.sh"
     "${_pkgname}.desktop"
     "${_ghurl}/raw/refs/tags/v${pkgver}/build/icon.svg"
 )
-noextract=("${_pkgname}-${pkgver}.tar.gz")
+noextract=("${_pkgname}-${pkgver}.tar.gz" "${_pkgname}-${pkgver}-arm64.tar.gz")
 sha256sums=('db901fa9af0ce812f48ecba9c338162bd5b12f6586fefca2bc6b6509430ea351'
             '455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46'
             '7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f')
-sha256sums_aarch64=('23841d3348aa4addd7ca7301172d927feb1ad6e62b1bf288871004d65d154f7f')
-sha256sums_x86_64=('152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66')
+sha256sums_aarch64=('2aecdb99058ea7c2e8295feda80f72e199416bf29a27adae0f9ac4855ad737ad')
+sha256sums_x86_64=('477dc07e9da85cf3f86b890f00cebe328d82ef62a40790bb515f18de38845a46')
 
 prepare() {
     sed -i -e "

Comment

The change only adjusts the package() logic to extract the already-downloaded architecture-specific tarball by filename, matching the updated source_aarch64/source_x86_64 entries and checksums. I do not see any new network access, privilege escalation, persistence, or other security-sensitive behavior introduced by this diff. The package still installs from verified sources under $pkgdir only.

@@ -53,8 +53,11 @@ prepare() {
     " "${srcdir}/${_pkgname}.sh"
 }
 package() {
+	local archive="${_pkgname}-${pkgver}.tar.gz"
+	[[ "$CARCH" == aarch64 ]] && archive="${_pkgname}-${pkgver}-arm64.tar.gz"
+
     mkdir -p "$pkgdir/opt/${_pkgname}"
-    tar -xf "$srcdir/${_pkgname}-${pkgver}.tar.gz" -C "$pkgdir/opt/${_pkgname}" --strip-components=1 --exclude='*app-update.yml'
+    tar -xf "$archive" -C "$pkgdir/opt/${_pkgname}" --strip-components=1 --exclude='*app-update.yml'
     mkdir -p "$pkgdir/usr/bin"
     install -Dm755 "${srcdir}/${_pkgname}.sh" "${pkgdir}/usr/bin/${_pkgname}" # Start script
     install -Dm644 "icon.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/${_pkgname}.svg" # Install icons