Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 13.0.1 to 13.1.0 for the existing yay-bin package. No source URLs, checksums, install scripts, dependencies, or build logic are altered in the reviewed diff, so there is no new supply-chain or privilege-escalation risk visible here. Based on this hunk alone, the change appears routine and low risk.

@@ -1,6 +1,6 @@
 pkgbase = yay-bin
 	pkgdesc = Yet another yogurt. Pacman wrapper and AUR helper written in go. Pre-compiled.
-	pkgver = 13.0.1
+	pkgver = 13.1.0
 	pkgrel = 1
 	url = https://github.com/Jguer/yay
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt yay-bin release tarballs, with HTTPS GitHub release URLs and updated checksums. No new sources, scripts, install hooks, or privilege-related metadata were introduced, and the package still points to the upstream project release artifacts. Based on the provided diff alone, there are no obvious supply-chain or persistence red flags.

@@ -13,11 +13,11 @@ pkgbase = yay-bin
 	optdepends = doas: privilege elevation
 	provides = yay
 	conflicts = yay
-	source_x86_64 = https://github.com/Jguer/yay/releases/download/v13.0.1/yay_13.0.1_x86_64.tar.gz
-	sha256sums_x86_64 = 1fdfcb5f7f387bc858d3a5754bdf4e4575bfbddac9560535a716d0ed7189c057
-	source_aarch64 = https://github.com/Jguer/yay/releases/download/v13.0.1/yay_13.0.1_aarch64.tar.gz
-	sha256sums_aarch64 = 75bc500c8677d6760f51117ae0a61689e9cf165bea3c4800825a5c879d030726
-	source_armv7h = https://github.com/Jguer/yay/releases/download/v13.0.1/yay_13.0.1_armv7h.tar.gz
-	sha256sums_armv7h = 9fe24f478ff6b80252fd6591061d478f0579e9118bc2522efe5328550870502f
+	source_x86_64 = https://github.com/Jguer/yay/releases/download/v13.1.0/yay_13.1.0_x86_64.tar.gz
+	sha256sums_x86_64 = 18acab0ff3aa3927eba21cd774bac52cfd6dd366dc68b0d1a12b10120190cd3c
+	source_aarch64 = https://github.com/Jguer/yay/releases/download/v13.1.0/yay_13.1.0_aarch64.tar.gz
+	sha256sums_aarch64 = be9bde82b0ae601365bf38515a4bfe60840a0b9945994cc8631a974c0492aa2c
+	source_armv7h = https://github.com/Jguer/yay/releases/download/v13.1.0/yay_13.1.0_armv7h.tar.gz
+	sha256sums_armv7h = 92b4efa177c5820ce849b7933d67cff297b1a671c3a55580a83eaf030763077d
 
 pkgname = yay-bin

Comment

The only change in this diff is a version bump from 13.0.1 to 13.1.0 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or package metadata beyond pkgver were modified. Based on the provided hunk alone, there are no new security concerns introduced by this change.

@@ -1,6 +1,6 @@
 # Maintainer: Jguer <pkgbuilds at jguer.space>
 pkgname=yay-bin
-pkgver=13.0.1
+pkgver=13.1.0
 pkgrel=1
 pkgdesc="Yet another yogurt. Pacman wrapper and AUR helper written in go. Pre-compiled."
 arch=('x86_64' 'aarch64' 'armv7h')

Comment

The change is low risk. It only updates the package version, refreshes the upstream tarball checksums, and makes locale installation dynamic by iterating over the extracted .mo files instead of a hardcoded language list. I do not see any new network fetches, privilege escalation, persistence, or other suspicious behavior in this diff. The package still downloads release artifacts over HTTPS from the official GitHub releases page and verifies them with SHA-256 checksums.

@@ -21,9 +21,9 @@ source_x86_64=("https://github.com/Jguer/yay/releases/download/v${pkgver}/${pkgn
 source_aarch64=("https://github.com/Jguer/yay/releases/download/v${pkgver}/${pkgname/-bin/}_${pkgver}_aarch64.tar.gz")
 source_armv7h=("https://github.com/Jguer/yay/releases/download/v${pkgver}/${pkgname/-bin/}_${pkgver}_armv7h.tar.gz")
 
-sha256sums_x86_64=('1fdfcb5f7f387bc858d3a5754bdf4e4575bfbddac9560535a716d0ed7189c057')
-sha256sums_aarch64=('75bc500c8677d6760f51117ae0a61689e9cf165bea3c4800825a5c879d030726')
-sha256sums_armv7h=('9fe24f478ff6b80252fd6591061d478f0579e9118bc2522efe5328550870502f')
+sha256sums_x86_64=('18acab0ff3aa3927eba21cd774bac52cfd6dd366dc68b0d1a12b10120190cd3c')
+sha256sums_aarch64=('be9bde82b0ae601365bf38515a4bfe60840a0b9945994cc8631a974c0492aa2c')
+sha256sums_armv7h=('92b4efa177c5820ce849b7933d67cff297b1a671c3a55580a83eaf030763077d')
 
 package() {
   _output="${srcdir}/${pkgname/-bin/}_${pkgver}_${CARCH}"

Comment

The change is low risk. It only alters how compiled translation files are installed: instead of a hardcoded locale list, it iterates over all .mo files present in the build output and installs them into the corresponding locale directories. There is no new network access, privilege escalation, shell execution, or installation outside $pkgdir. The only minor concern is that it now trusts the contents of the build output directory more broadly, but in this package that directory is produced by the package build itself, so this does not introduce a meaningful security issue.

@@ -35,8 +35,8 @@ package() {
   install -Dm644 "${_output}/zsh" "${pkgdir}/usr/share/zsh/site-functions/_yay"
   install -Dm644 "${_output}/fish" "${pkgdir}/usr/share/fish/vendor_completions.d/yay.fish"
 
-  LANGS="ca cs de en es eu fr_FR he id it_IT ja ko pl_PL pt_BR pt ru_RU ru sv tr uk zh_CN zh_TW"
-  for lang in ${LANGS}; do
-    install -Dm644 "${_output}/${lang}.mo" "${pkgdir}/usr/share/locale/${lang}/LC_MESSAGES/yay.mo"
+  for locale in "${_output}"/*.mo; do
+    lang="${locale##*/}"
+    install -Dm644 "${locale}" "${pkgdir}/usr/share/locale/${lang%.mo}/LC_MESSAGES/yay.mo"
   done
 }