Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.97.59 to 1.98.60. No sources, checksums, install scripts, build commands, dependencies, or packaging behavior are altered in the provided diff, so there is no new security concern visible here. This appears to be a routine upstream version update in a binary package metadata file.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.97.59
+	pkgver = 1.98.60
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a routine version bump in .SRCINFO for the Brave binary package. The source URLs remain HTTPS and point to the official Brave GitHub release assets, with updated checksums for the new release artifacts. No new sources, scripts, install hooks, or packaging behavior are introduced by this diff, and there are no signs of privilege escalation or persistence mechanisms in the changed metadata alone.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.97.59
+	provides = brave=1.98.60
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.97.59-x86_64.zip
-	noextract = brave-bin-1.97.59-aarch64.zip
+	noextract = brave-bin-1.98.60-x86_64.zip
+	noextract = brave-bin-1.98.60-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.97.59-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.97.59/brave-browser-1.97.59-linux-amd64.zip
-	sha256sums_x86_64 = 32979198ff09c4c656b0b060d929a44cdd6af167b2a141a77c2b7f36fd59e661
-	source_aarch64 = brave-bin-1.97.59-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.97.59/brave-browser-1.97.59-linux-arm64.zip
-	sha256sums_aarch64 = c772ebb7ed5f091e115cebbc21e866ec84e2d7d0c5d24dc455c5cdba95dc7fd6
+	source_x86_64 = brave-bin-1.98.60-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.60/brave-browser-1.98.60-linux-amd64.zip
+	sha256sums_x86_64 = 0e49b5f84597fbbefdc8d791900d170d4f3792dc5d38056f6a3e35100706cdc7
+	source_aarch64 = brave-bin-1.98.60-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.60/brave-browser-1.98.60-linux-arm64.zip
+	sha256sums_aarch64 = f93bd3513ff0aae174edb5523002a9cb5e4923633d66a766c10db4dc30eab7df
 
 pkgname = brave-bin

Comment

The change is a routine version bump for a binary package, updating pkgver and the corresponding upstream archive checksums. The source URLs remain HTTPS GitHub release downloads, there are no new build steps, scripts, or packaging logic changes, and no signs of added network fetches or privilege-related behavior. Risk is low because the only security-relevant aspect is trust in the new upstream binary release, which is expected for a -bin package and is covered by the updated checksums.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.97.59
+pkgver=1.98.60
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

The change only updates brave-bin to a new upstream release and refreshes the expected SHA-256 checksums for the architecture-specific release archives. No new build logic, scripts, network behavior, privilege changes, or packaging paths were introduced in the diff. The source URLs remain pinned to the Brave GitHub release for the exact version, and the package still only installs the downloaded binary payload plus existing desktop/icon/license files. Based on the provided hunk, this looks like a routine version bump with integrity hash updates.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('32979198ff09c4c656b0b060d929a44cdd6af167b2a141a77c2b7f36fd59e661')
-sha256sums_aarch64=('c772ebb7ed5f091e115cebbc21e866ec84e2d7d0c5d24dc455c5cdba95dc7fd6')
+sha256sums_x86_64=('0e49b5f84597fbbefdc8d791900d170d4f3792dc5d38056f6a3e35100706cdc7')
+sha256sums_aarch64=('f93bd3513ff0aae174edb5523002a9cb5e4923633d66a766c10db4dc30eab7df')
 
 prepare() {
 	mkdir -p brave