Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 3.39.12 to 3.39.13. No sources, checksums, build steps, install scripts, or packaging metadata were altered, so there is no new security-relevant behavior introduced by this diff alone. Based on the provided hunk, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = ngrok
 	pkgdesc = A tunneling, reverse proxy for developing and understanding networked, HTTP services
-	pkgver = 3.39.12
+	pkgver = 3.39.13
 	pkgrel = 1
 	url = https://ngrok.com
 	arch = i686

Comment

The change only bumps ngrok’s prebuilt upstream binary URLs and their SHA256 checksums in .SRCINFO from 3.39.12 to 3.39.13. The sources remain HTTPS on the vendor’s bin.equinox.io host, and there are no new build-time commands, install-script changes, or additional artifacts introduced by this diff. While this package ships prebuilt binaries (so trust is inherently tied to upstream), this specific metadata update does not add any new security red flags beyond the existing package design.

@@ -12,13 +12,13 @@ pkgbase = ngrok
 	options = !strip
 	source = TERMS-OF-SERVICE.txt
 	sha256sums = d1fce3c7e78d5f7e5307238ee5f371b7a10911aeb249e3358e945eaa8cf2f1b2
-	source_i686 = https://bin.equinox.io/a/eVGus2j8dTf/ngrok-v3-3.39.12-linux-386.tar.gz
-	sha256sums_i686 = 246619ebc52e7acb2232ac04a120642dc00889af97886a76735c902c30b63252
-	source_x86_64 = https://bin.equinox.io/a/rG6QSVno1F/ngrok-v3-3.39.12-linux-amd64.tar.gz
-	sha256sums_x86_64 = 01f79749bc75273a0c634c59eec4e6235c3ab7266d5bc6a02cbac6c7fe6472b0
-	source_armv7h = https://bin.equinox.io/a/gVcEdAfwaka/ngrok-v3-3.39.12-linux-arm.tar.gz
-	sha256sums_armv7h = 7c8ac825d31da1005d634f9130fd7512a2f4ab2d13b63eee0ed12dc6a16e727d
-	source_aarch64 = https://bin.equinox.io/a/mZKpd326i7W/ngrok-v3-3.39.12-linux-arm64.tar.gz
-	sha256sums_aarch64 = 98adbac487844e00223b23c96f6831dd3f6210b2b046b78e78a7bd34bc0ac734
+	source_i686 = https://bin.equinox.io/a/9xC1dNA3u6H/ngrok-v3-3.39.13-linux-386.tar.gz
+	sha256sums_i686 = dac9a594acd0d642495b108d1eb065b53140311adbff284ae4afa33e4838214c
+	source_x86_64 = https://bin.equinox.io/a/h2cqbjsNLj7/ngrok-v3-3.39.13-linux-amd64.tar.gz
+	sha256sums_x86_64 = 233e0647849913e6404150c1e9c5e4f31c1368aefee330958d038d7afecb8f2e
+	source_armv7h = https://bin.equinox.io/a/8wmNQK9f5ah/ngrok-v3-3.39.13-linux-arm.tar.gz
+	sha256sums_armv7h = 55d7127100d4eb211d6249a53c1f01bb353241e2be3ff0b97b304f2e9cf4d521
+	source_aarch64 = https://bin.equinox.io/a/j83dYTwHiq9/ngrok-v3-3.39.13-linux-arm64.tar.gz
+	sha256sums_aarch64 = fb41ee8f251969f6e399ef03122f791ae537155dfd9ac4c0baf108aca95c17d7
 
 pkgname = ngrok

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver and replaces the upstream release tarball URLs and checksums for all architectures. The sources remain HTTPS on the official ngrok/equinox distribution domain, there are no new build-time commands, no added scripts, and no packaging/persistence changes. I did not find any integrity or execution red flags in this diff.

@@ -4,7 +4,7 @@
 # Contributor: Peter Sutton (foxxy) <foxxy@foxdogstudios.com>
 
 pkgname=ngrok
-pkgver=3.39.12
+pkgver=3.39.13
 pkgrel=1
 pkgdesc='A tunneling, reverse proxy for developing and understanding networked, HTTP services'
 url='https://ngrok.com'

Comment

The change is a straightforward version bump of prebuilt ngrok release tarballs from 3.39.12 to 3.39.13, with matching per-arch SHA256 updates. The sources remain HTTPS on the vendor’s distribution host, there are no new build-time commands, no added scripts/units, and no packaging logic changes beyond the artifact URLs and checksums. I don’t see evidence of a supply-chain or privilege-escalation issue in this diff alone.

@@ -12,15 +12,15 @@ license=('LicenseRef-custom')
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')
 optdepends=('bash-completion: Bash completion support')
 source=("TERMS-OF-SERVICE.txt")
-source_x86_64=("https://bin.equinox.io/a/rG6QSVno1F/ngrok-v3-3.39.12-linux-amd64.tar.gz")
-source_i686=("https://bin.equinox.io/a/eVGus2j8dTf/ngrok-v3-3.39.12-linux-386.tar.gz")
-source_armv7h=("https://bin.equinox.io/a/gVcEdAfwaka/ngrok-v3-3.39.12-linux-arm.tar.gz")
-source_aarch64=("https://bin.equinox.io/a/mZKpd326i7W/ngrok-v3-3.39.12-linux-arm64.tar.gz")
+source_x86_64=("https://bin.equinox.io/a/h2cqbjsNLj7/ngrok-v3-3.39.13-linux-amd64.tar.gz")
+source_i686=("https://bin.equinox.io/a/9xC1dNA3u6H/ngrok-v3-3.39.13-linux-386.tar.gz")
+source_armv7h=("https://bin.equinox.io/a/8wmNQK9f5ah/ngrok-v3-3.39.13-linux-arm.tar.gz")
+source_aarch64=("https://bin.equinox.io/a/j83dYTwHiq9/ngrok-v3-3.39.13-linux-arm64.tar.gz")
 sha256sums=('d1fce3c7e78d5f7e5307238ee5f371b7a10911aeb249e3358e945eaa8cf2f1b2')
-sha256sums_i686=('246619ebc52e7acb2232ac04a120642dc00889af97886a76735c902c30b63252')
-sha256sums_x86_64=('01f79749bc75273a0c634c59eec4e6235c3ab7266d5bc6a02cbac6c7fe6472b0')
-sha256sums_armv7h=('7c8ac825d31da1005d634f9130fd7512a2f4ab2d13b63eee0ed12dc6a16e727d')
-sha256sums_aarch64=('98adbac487844e00223b23c96f6831dd3f6210b2b046b78e78a7bd34bc0ac734')
+sha256sums_i686=('dac9a594acd0d642495b108d1eb065b53140311adbff284ae4afa33e4838214c')
+sha256sums_x86_64=('233e0647849913e6404150c1e9c5e4f31c1368aefee330958d038d7afecb8f2e')
+sha256sums_armv7h=('55d7127100d4eb211d6249a53c1f01bb353241e2be3ff0b97b304f2e9cf4d521')
+sha256sums_aarch64=('fb41ee8f251969f6e399ef03122f791ae537155dfd9ac4c0baf108aca95c17d7')
 
 # In order to make Ngrok's built-in updater happy, we need to avoid modifying the binary
 options=(!strip)