Review Results

Comment

The change is a routine upstream version bump in .SRCINFO: it updates the Android Studio tarball URL from one official Google HTTPS release artifact to the next, and refreshes the corresponding BLAKE2 checksum. No new build logic, scripts, privileges, or network behavior are introduced beyond the existing source download. I don’t see any supply-chain red flags in this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = android-studio
 	pkgdesc = The official Android IDE (Stable branch)
-	pkgver = 2026.2.1.8
-	pkgrel = 2
+	pkgver = 2026.2.2.8
+	pkgrel = 1
 	url = https://developer.android.com/
 	arch = x86_64
 	license = Apache-2.0

Comment

The change is a straightforward upstream version bump for the Android Studio tarball and corresponding checksum update in .SRCINFO. The source remains an HTTPS download from Google’s official Android Studio distribution path, with no new build-time code execution, no added sources, and no packaging-script changes. I don’t see any integrity or persistence red flags in this diff alone.

@@ -19,10 +19,10 @@ pkgbase = android-studio
 	optdepends = ncurses5-compat-libs: native debugger support
 	optdepends = vulkan-icd-loader: Vulkan acceleration for Gemini local models
 	options = !strip
-	source = https://dl.google.com/dl/android/studio/ide-zips/2026.2.1.8/android-studio-rabbit1-linux.tar.gz
+	source = https://dl.google.com/dl/android/studio/ide-zips/2026.2.2.8/android-studio-rabbit2-linux.tar.gz
 	source = android-studio.desktop
 	source = license.html
-	b2sums = d88c7f178a23235c10d26a87366ea53c20a50c75a6d9e57664bb6ead305262463b2f0a89d5666f89067e12f0e9dbc3d96c4fa3b9bea1ad7a564e3b2a02597911
+	b2sums = 5be11c433e591e36148fbcb11dea123760fd25e6ed629bbf212e65eed69b786897a432bce74133bad7870577a83be3b246dd43a91331b22bb4037ae05fae67e1
 	b2sums = 0b978b7fdbcd277cf432080572b141a760ad169984c9cb09f11c6f3ca0be807483545685c86853329bc4622bf516c7a668148bd25ada906fa7289bb9a7c7ccf8
 	b2sums = 43b288fb81656cd72826a52620e41fbd0daa65d37246cb5b7dbff9c326022eabf18344513517b16134b557d6ae86535f44f863ebd06d6fe0410f92117c1a8c67
 

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/_vername updated to the new Android Studio release and the corresponding b2sum refreshed. The source remains the official Google HTTPS download URL, there are no new build-time commands, no added scripts, and no packaging/persistence changes. I do not see any security-relevant regression in this diff.

@@ -10,9 +10,9 @@
 # Maintainer: Kordian Bruck <k@bruck.me>
 
 pkgname=android-studio
-pkgver=2026.2.1.8
-_vername="rabbit1"
-pkgrel=2
+pkgver=2026.2.2.8
+_vername="rabbit2"
+pkgrel=1
 pkgdesc="The official Android IDE (Stable branch)"
 arch=('x86_64')
 url="https://developer.android.com/"

Comment

The change is a routine upstream version bump for Android Studio: it updates the download URL components from 2026.2.1.8/rabbit1 to 2026.2.2.8/rabbit2 and refreshes the B2 checksum accordingly. The source remains an HTTPS Google-hosted tarball, there are no new build steps, no added scripts, and no packaging behavior changes. I don’t see any supply-chain or privilege-escalation concern in this diff alone.

@@ -29,7 +29,7 @@ options=('!strip')
 source=("https://dl.google.com/dl/android/studio/ide-zips/$pkgver/android-studio-$_vername-linux.tar.gz"
         "$pkgname.desktop"
         "license.html")
-b2sums=('d88c7f178a23235c10d26a87366ea53c20a50c75a6d9e57664bb6ead305262463b2f0a89d5666f89067e12f0e9dbc3d96c4fa3b9bea1ad7a564e3b2a02597911'
+b2sums=('5be11c433e591e36148fbcb11dea123760fd25e6ed629bbf212e65eed69b786897a432bce74133bad7870577a83be3b246dd43a91331b22bb4037ae05fae67e1'
         '0b978b7fdbcd277cf432080572b141a760ad169984c9cb09f11c6f3ca0be807483545685c86853329bc4622bf516c7a668148bd25ada906fa7289bb9a7c7ccf8'
         '43b288fb81656cd72826a52620e41fbd0daa65d37246cb5b7dbff9c326022eabf18344513517b16134b557d6ae86535f44f863ebd06d6fe0410f92117c1a8c67')