Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.43.5.11029 to 1.43.5.11079. No source URLs, checksums, build logic, install scripts, permissions, or packaging metadata beyond the version string are altered. Based on the provided diff, there is no security-relevant behavior change to assess.

@@ -1,6 +1,6 @@
 pkgbase = plex-media-server-plexpass
 	pkgdesc = The back-end media server component of Plex.
-	pkgver = 1.43.5.11029
+	pkgver = 1.43.5.11079
 	pkgrel = 1
 	url = https://plex.tv/
 	install = plex-media-server.install

Comment

The change is a straightforward version bump in .SRCINFO, updating Plex download URLs and checksums for all architectures. The sources remain HTTPS on the official Plex domain, there are no new build-time commands, no added scripts, and no packaging/persistence changes visible in this diff. Based on the provided hunk alone, this is low risk.

@@ -27,13 +27,13 @@ pkgbase = plex-media-server-plexpass
 	sha256sums = c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557
 	sha256sums = b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad
 	sha256sums = 7bb97271eb2dc5d1dcb95f9763f505970d234df17f1b8d79b467b9020257915a
-	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.5.11029-6bf8af3f0/redhat/plexmediaserver-1.43.5.11029-6bf8af3f0.x86_64.rpm
-	sha256sums_x86_64 = 10bcea4e21088c018a11c018bb017255ba32629803314270d280b96361b283f0
-	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.5.11029-6bf8af3f0/redhat/plexmediaserver-1.43.5.11029-6bf8af3f0.i686.rpm
-	sha256sums_i686 = befc40d9979cd002528f6970d658653ca80da10572934636ff1b2aa1bf3ac7b3
-	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.5.11029-6bf8af3f0/debian/plexmediaserver_1.43.5.11029-6bf8af3f0_armhf.deb
-	sha256sums_armv7h = 02fdcf29f378de74905140df0e7671014e764fd09358f9b3e264e4c699a5cb9c
-	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.5.11029-6bf8af3f0/debian/plexmediaserver_1.43.5.11029-6bf8af3f0_arm64.deb
-	sha256sums_aarch64 = b289c218db9c4efa81effab8efb82ca9aba5576f58e95aeb7c485b07db41ec1b
+	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.5.11079-b3b13e506/redhat/plexmediaserver-1.43.5.11079-b3b13e506.x86_64.rpm
+	sha256sums_x86_64 = 3c1939e0225b2a4774a2eda7102f90d2af3caf8a470cc91730e21670865b4562
+	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.5.11079-b3b13e506/redhat/plexmediaserver-1.43.5.11079-b3b13e506.i686.rpm
+	sha256sums_i686 = 4a6b5fe0f9b0e4a1e361984218918210eaf7812ce10c559195e5d28ffe373fbc
+	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.5.11079-b3b13e506/debian/plexmediaserver_1.43.5.11079-b3b13e506_armhf.deb
+	sha256sums_armv7h = 73d1cbca351c47db93d75f996c9ea91257ae04da1d0a3c2dd37ad826f7c87747
+	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.5.11079-b3b13e506/debian/plexmediaserver_1.43.5.11079-b3b13e506_arm64.deb
+	sha256sums_aarch64 = 8af36b17f886e344140a8b47e4e2ef653f31c786d2eaa7387442f5b606200717
 
 pkgname = plex-media-server-plexpass

Comment

The change is a routine version bump for Plex Pass binaries: pkgver, package checksum prefix, and per-architecture SHA256 sums are updated. I do not see any new sources, build-time network access, script execution, privilege escalation, or packaging behavior changes in the reviewed hunk. Risk is low, though as with any binary package the trust boundary remains upstream release integrity rather than this diff itself.

@@ -13,8 +13,8 @@
 # Based on the plex-media-server package by Maxime Gauduin.
 
 pkgname=plex-media-server-plexpass
-pkgver=1.43.5.11029
-_pkgsum=6bf8af3f0
+pkgver=1.43.5.11079
+_pkgsum=b3b13e506
 pkgrel=1
 pkgdesc='The back-end media server component of Plex.'
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')

Comment

The change only bumps the Plex Pass package version and updates the corresponding source checksums for each architecture. I did not find any new sources, build-time network access, scripts, or packaging logic changes. The diff is limited to integrity metadata for a new upstream release, so there is no evident security issue in this change itself.

@@ -43,10 +43,10 @@ sha256sums=('b7f2fb1cbedde54a79a1794ec9f35f8bdeb033a4c5453ec77944ca7fe77cd9b7'
             'c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557'
             'b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad'
             '7bb97271eb2dc5d1dcb95f9763f505970d234df17f1b8d79b467b9020257915a')
-sha256sums_x86_64=('10bcea4e21088c018a11c018bb017255ba32629803314270d280b96361b283f0')
-sha256sums_i686=('befc40d9979cd002528f6970d658653ca80da10572934636ff1b2aa1bf3ac7b3')
-sha256sums_armv7h=('02fdcf29f378de74905140df0e7671014e764fd09358f9b3e264e4c699a5cb9c')
-sha256sums_aarch64=('b289c218db9c4efa81effab8efb82ca9aba5576f58e95aeb7c485b07db41ec1b')
+sha256sums_x86_64=('3c1939e0225b2a4774a2eda7102f90d2af3caf8a470cc91730e21670865b4562')
+sha256sums_i686=('4a6b5fe0f9b0e4a1e361984218918210eaf7812ce10c559195e5d28ffe373fbc')
+sha256sums_armv7h=('73d1cbca351c47db93d75f996c9ea91257ae04da1d0a3c2dd37ad826f7c87747')
+sha256sums_aarch64=('8af36b17f886e344140a8b47e4e2ef653f31c786d2eaa7387442f5b606200717')
 
 prepare() {
   if [[ $CARCH = armv7h ]] || [[ $CARCH = aarch64 ]]; then