Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 20.5.8 to 21. No sources, build logic, install scripts, dependencies, or packaging behavior are changed here, so there is no direct security impact in the reviewed diff. I did not see any indication of malicious content in this hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = aurutils
 	pkgdesc = helper tools for the arch user repository
-	pkgver = 20.5.8
+	pkgver = 21
 	pkgrel = 1
 	url = https://github.com/AladW/aurutils
 	install = aurutils.install

Comment

The change only adds a runtime dependency on `trurl` in .SRCINFO. This is a metadata-only update with no evidence of malicious behavior, privilege escalation, network access, or packaging integrity issues in the diff provided. No security concerns are apparent from this change alone.

@@ -13,6 +13,7 @@ pkgbase = aurutils
 	depends = perl
 	depends = perl-json-xs
 	depends = bash
+	depends = trurl
 	optdepends = bash-completion: bash completion
 	optdepends = zsh: zsh completion
 	optdepends = devtools: aur-chroot

Comment

The change only updates the upstream release tarball URL and its SHA-256 checksum in .SRCINFO, moving from aurutils 20.5.8 to 21. The source remains an HTTPS GitHub release archive from the official upstream repository, with a pinned tag and a matching checksum. No new build steps, scripts, binaries, or privilege-related artifacts are introduced by this diff. Based on the provided hunk alone, this is a routine version bump with no evident security impact.

@@ -22,7 +23,7 @@ pkgbase = aurutils
 	optdepends = git-delta: view-delta example script
 	optdepends = python-srcinfo: sync-rebuild example script
 	optdepends = expect: non-interactive usage
-	source = aurutils-20.5.8.tar.gz::https://github.com/AladW/aurutils/archive/refs/tags/20.5.8.tar.gz
-	sha256sums = 9a425508e59db73b1ae4644d15fc3c09e3cbd85788295455bd2d13fb6ceccee5
+	source = aurutils-21.tar.gz::https://github.com/AladW/aurutils/archive/refs/tags/21.tar.gz
+	sha256sums = 39d169f6139dd5ab26be00b903716aca24387b655e28b2c13d47f2ccaae4b072
 
 pkgname = aurutils

Comment

The change is limited to a version bump and checksum update, plus adding a new runtime dependency on `trurl`. The source remains the official GitHub release tarball over HTTPS, and there are no new build-time downloads, scripts, or privilege-related changes in the PKGBUILD diff. I did not see any suspicious packaging behavior introduced by this hunk alone. The only note is that the new dependency should be validated against upstream usage, but that is not inherently malicious from this diff.

@@ -3,7 +3,7 @@
 # Co-Maintainer: zoorat <zoorat [at] protonmail [dot] com>
 
 pkgname=aurutils
-pkgver=20.5.8
+pkgver=21
 pkgrel=1
 pkgdesc='helper tools for the arch user repository'
 url='https://github.com/AladW/aurutils'

Comment

The change is low risk. It only updates the upstream release tarball checksum for a new version and adds a new runtime dependency on `trurl`. I did not find any suspicious build-time network fetches, shell execution, privilege escalation, or install-script changes in the reviewed hunk. The `.install` script remains unchanged and only prints upgrade notices. The main security-relevant effect is the new dependency, but `trurl` is a normal URL parsing utility and there is no evidence here of typosquatting, pinned-VCS issues, or malicious packaging behavior.

@@ -12,8 +12,8 @@ license=('ISC')
 source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/$pkgver.tar.gz")
 changelog=aurutils.changelog
 install=aurutils.install
-sha256sums=('9a425508e59db73b1ae4644d15fc3c09e3cbd85788295455bd2d13fb6ceccee5')
-depends=('git' 'pacutils' 'curl' 'perl' 'perl-json-xs' 'bash')
+sha256sums=('39d169f6139dd5ab26be00b903716aca24387b655e28b2c13d47f2ccaae4b072')
+depends=('git' 'pacutils' 'curl' 'perl' 'perl-json-xs' 'bash' 'trurl')
 optdepends=('bash-completion: bash completion'
             'zsh: zsh completion'
             'devtools: aur-chroot'

Comment

The change only updates the changelog text and does not affect build scripts, sources, install hooks, or packaged artifacts. No security-relevant behavior is introduced by this diff. Risk is therefore minimal.

@@ -1,10 +1,43 @@
+## 21
+
+* `aur-sync`
+  + pass additional arguments through to aur-chroot (#1265)
+
+* `aur-build`
+  + move local repository sync to `build--sync` (#1183)
+    - implement file-based locking (`makepkg` implementation)
+    - implement `pactrans` upgrade
+  + add `--pool` (#1213)
+  + pass additional arguments through to aur-chroot (#1265)
+
+* `aur-fetch`
+  + support mixed url and pkgbase names (#1104)
+  + add trurl(1) as dependency
+
+* `aur-view`
+  + limit orderfile to local git-diff calls (#1241)
+
+* `perl`
+  + add `Depends::tsort` (#1224)
+  + add `AUR::Exception` (#1266)
+  + enable `--dump-options` in Perl scripts (#1263)
+
+* `tests`
+  + add `depends.t` with fixture auto-discovery (#1253)
+
 ## 20.5
 
 * `aur-build`
   + do not define `LOGDEST` explicitly
+  + revert error on partially built package group
 
 * `aur-chroot`
   + preserve `LOGDEST` and `SRCDEST` by default (#1196)
+  + preserve `SRCPKGDEST`, `MAKEFLAGS` and `PACKAGER` (#1200)
+
+* `aur-graph`
+  + detect sections on keywords (#1228)
+  + don't use `delete` as a function (#1250)
 
 * `aur-repo`
   + avoid empty output with `-q -u` (#1215)

Comment

The change only adds a changelog entry noting that the `aur-build--sync` helper was re-added. This is documentation-only and does not alter package build logic, install scripts, sources, permissions, or runtime behavior. No security-relevant code paths are introduced by this diff.

@@ -172,6 +205,7 @@
 
 * `aur-build`
   + propagate `--pacman-conf` to local repository upgrade
+  + re-add `aur-build--sync` helper
 
 ## 18.4