Review Results

Comment

The change only updates the package metadata URL and source in .SRCINFO to point at the project's renamed upstream repository on GitHub. Both URLs remain HTTPS, there is no new build logic, no added install script behavior, and no integrity or privilege-related risk introduced by this metadata-only update. Based on the diff provided, this is low risk and appears to be a straightforward upstream rename correction.

@@ -2,7 +2,7 @@ pkgbase = gnome-shell-extension-system-monitor-next-git
 	pkgdesc = Display system information in GNOME Shell status bar (next fork)
 	pkgver = r1510.cf869fb
 	pkgrel = 1
-	url = https://github.com/mgalgs/gnome-shell-system-monitor-applet
+	url = https://github.com/mgalgs/gnome-shell-system-monitor-next-applet
 	install = gnome-shell-extension-system-monitor-next-git.install
 	arch = any
 	license = GPL-3.0-or-later

Comment

The only change is a source URL rename from one GitHub repository to another, still using HTTPS and still a Git VCS source with checksum skipped as expected for VCS packages. I do not see any added build-time execution, extra sources, or packaging/persistence behavior in this diff. The main risk is supply-chain provenance: the package now points at a different upstream repository, so trust depends on whether that repo is the intended official upstream. Based on the diff alone, there is no concrete malicious behavior, just a source origin change.

@@ -15,7 +15,7 @@ pkgbase = gnome-shell-extension-system-monitor-next-git
 	provides = gnome-shell-extension-system-monitor-git
 	conflicts = gnome-shell-system-monitor-applet-git
 	conflicts = gnome-shell-extension-system-monitor-git
-	source = git+https://github.com/mgalgs/gnome-shell-system-monitor-applet
+	source = git+https://github.com/mgalgs/gnome-shell-system-monitor-next-applet
 	sha256sums = SKIP
 
 pkgname = gnome-shell-extension-system-monitor-next-git

Comment

The change only updates a .gitignore entry from an old build output directory name to the new one. This does not affect package sources, build steps, install scripts, permissions, or runtime behavior, and introduces no security-relevant functionality. No red flags are present in this diff.

@@ -1,4 +1,4 @@
 gnome-shell-extension-system-monitor-next-git-*.pkg.tar.zst
-gnome-shell-system-monitor-applet/
+gnome-shell-system-monitor-next-applet/
 pkg/
 src/

Comment

The change is a straightforward repository rename in metadata: the upstream URL, git source, and local checkout directory name are updated to the project’s next-fork name. It still uses HTTPS, remains pinned to the existing VCS commit via pkgver, and does not introduce any new build steps, downloads, scripts, or privilege-related behavior. No security-relevant packaging regressions are visible in this diff.

@@ -6,17 +6,17 @@ pkgver=r1510.cf869fb
 pkgrel=1
 pkgdesc="Display system information in GNOME Shell status bar (next fork)"
 arch=('any')
-url="https://github.com/mgalgs/gnome-shell-system-monitor-applet"
+url="https://github.com/mgalgs/gnome-shell-system-monitor-next-applet"
 license=('GPL-3.0-or-later')
 depends=('gnome-shell>=45' 'libgtop' 'glib2')
 makedepends=('git')
 provides=("system-monitor-applet" "gnome-shell-system-monitor-applet-git" "gnome-shell-extension-system-monitor-git")
 conflicts=("gnome-shell-system-monitor-applet-git" "gnome-shell-extension-system-monitor-git")
-source=('git+https://github.com/mgalgs/gnome-shell-system-monitor-applet')
+source=('git+https://github.com/mgalgs/gnome-shell-system-monitor-next-applet')
 sha256sums=('SKIP')
 install=${pkgname}.install
 
-_reponame=gnome-shell-system-monitor-applet
+_reponame=gnome-shell-system-monitor-next-applet
 
 package() {
   cd "$srcdir/$_reponame"