Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.32.17 to 1.32.18. No source URLs, checksums, build steps, dependencies, install scripts, or packaging behavior are altered in the reviewed diff. Based on this hunk alone, there is no security-relevant change to assess.

@@ -1,6 +1,6 @@
 pkgbase = gallery-dl
 	pkgdesc = Command-line program to download image-galleries and collections from several image hosting sites
-	pkgver = 1.32.17
+	pkgver = 1.32.18
 	pkgrel = 1
 	url = https://codeberg.org/mikf/gallery-dl
 	arch = any

Comment

The change is a routine upstream version bump in .SRCINFO from v1.32.17 to v1.32.18, with the corresponding source checksum updated. The source remains the official Codeberg repository over HTTPS and is still pinned to a signed tag, with no new build steps, scripts, or packaging metadata that would introduce execution or persistence risks. No security-relevant red flags are present in this diff alone.

@@ -27,8 +27,8 @@ pkgbase = gallery-dl
 	optdepends = python-psycopg: PostgreSQL support
 	optdepends = python-truststore: Support using system certificates
 	optdepends = python-jinja: Jinja template support
-	source = git+https://codeberg.org/mikf/gallery-dl.git#tag=v1.32.17?signed
+	source = git+https://codeberg.org/mikf/gallery-dl.git#tag=v1.32.18?signed
 	validpgpkeys = 3E09F5908333DD83DBDCE7375680CA389D365A88
-	sha512sums = 5d5b7d6e1a48d5e7446be9a44409fefbb325892fede43ae1ad5d3046113b1ec1696a26770b208e7f853bf974d604600253bc822acaa0b9f20a0f7b9b51d1c0b9
+	sha512sums = cf014e8ee2b4806bace151ef28de22ae7fdfa4a786a1d0e1c164c444b88e9f53e780d6f584881a3e1d518c8a4536cfaab43919556386a0038fdb461e909e58c4
 
 pkgname = gallery-dl

Comment

The change is a routine version bump in PKGBUILD from 1.32.17 to 1.32.18, with the source tag and checksum updated accordingly. The source remains pinned to a signed upstream git tag over HTTPS, and there are no new build steps, network fetches, privilege changes, or packaging behavior changes in the diff. No security-relevant issues are evident in this hunk.

@@ -2,7 +2,7 @@
 # Contributor: LLL2yu <lll2yu@protonmail.com>
 
 pkgname=gallery-dl
-pkgver=1.32.17
+pkgver=1.32.18
 pkgrel=1
 pkgdesc='Command-line program to download image-galleries and collections from several image hosting sites'
 arch=(any)

Comment

The change is a routine upstream version bump from 1.32.17 to 1.32.18 with the corresponding source checksum update. The package continues to fetch a signed git tag from the official upstream repository and uses the same PGP key verification. No new sources, build steps, install scripts, or privilege/network-related behavior were introduced in the diff reviewed, so there is no evident security regression in this change alone.

@@ -29,7 +29,7 @@ optdepends=(
 )
 source=(git+"${url}".git#tag=v"${pkgver}"?signed)
 validpgpkeys=(3E09F5908333DD83DBDCE7375680CA389D365A88) #Mike Fährmann
-sha512sums=('5d5b7d6e1a48d5e7446be9a44409fefbb325892fede43ae1ad5d3046113b1ec1696a26770b208e7f853bf974d604600253bc822acaa0b9f20a0f7b9b51d1c0b9')
+sha512sums=('cf014e8ee2b4806bace151ef28de22ae7fdfa4a786a1d0e1c164c444b88e9f53e780d6f584881a3e1d518c8a4536cfaab43919556386a0038fdb461e909e58c4')
 
 prepare() {
     # Clean out old wheels etc.