Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.1.0-2 to 2.2.0-1. No sources, checksums, build steps, install scripts, or metadata affecting trust boundaries were changed in the provided diff. On its face this is a routine package update with no security-relevant indicators in the reviewed hunk.

@@ -1,7 +1,7 @@
 pkgbase = paru
 	pkgdesc = Feature packed AUR helper
-	pkgver = 2.1.0
-	pkgrel = 2
+	pkgver = 2.2.0
+	pkgrel = 1
 	url = https://github.com/morganamilo/paru
 	arch = i686
 	arch = pentium4

Comment

The change is a straightforward version bump in .SRCINFO: it updates the upstream tarball URL and checksum, and tightens the pacman dependency to >=7.1 while dropping the explicit libalpm.so versioned dependency. The source remains an HTTPS GitHub release archive from the upstream project, with a pinned checksum. No new scripts, patches, binaries, or build-time network behavior are introduced by this metadata-only change. I do not see any supply-chain or privilege-related red flags in the diff itself.

@@ -13,12 +13,12 @@ pkgbase = paru
 	license = GPL-3.0-or-later
 	makedepends = cargo
 	depends = git
-	depends = pacman
-	depends = libalpm.so>=14
+	depends = pacman>=7.1
+	depends = libalpm.so
 	optdepends = bat: colored pkgbuild printing
 	optdepends = devtools: build in chroot and downloading pkgbuilds
 	backup = etc/paru.conf
-	source = paru-2.1.0.tar.gz::https://github.com/Morganamilo/paru/archive/v2.1.0.tar.gz
-	sha256sums = eea4dbb524db765d5316f540f9ee670c0bf81aae4827b5417eebb4c9b5651727
+	source = paru-2.2.0.tar.gz::https://github.com/Morganamilo/paru/archive/v2.2.0.tar.gz
+	sha256sums = 213d55a67605ff69faefa523917fee7168ea5bf143be8cef800fb48c9759f348
 
 pkgname = paru

Comment

The change is low risk. It only bumps paru to 2.2.0, updates the source checksum, and adjusts dependency constraints to match the new upstream release (pacman>=7.1 and unversioned libalpm.so). No new sources, patches, install scripts, network-fetching build steps, privilege escalation, or packaging actions were introduced. The removed `cargo update alpm alpm-utils` in prepare() is actually a reduction in build-time dependency mutation, not a security concern. I found no evidence of malicious behavior in this diff.

@@ -1,7 +1,7 @@
 # Maintainer: Morgan <morganamilo@archlinux.org>
 pkgname=paru
-pkgver=2.1.0
-pkgrel=2
+pkgver=2.2.0
+pkgrel=1
 pkgdesc='Feature packed AUR helper'
 url='https://github.com/morganamilo/paru'
 source=("$pkgname-$pkgver.tar.gz::https://github.com/Morganamilo/paru/archive/v$pkgver.tar.gz")

Comment

The change is low risk. It updates paru to 2.2.0, refreshes the source checksum, and tightens the pacman dependency to >=7.1 while dropping the explicit libalpm.so versioned dependency in favor of the unversioned soname. The only build-step change is removing `cargo update alpm alpm-utils`, which reduces network-dependent dependency mutation during prepare() and is not suspicious. The source remains an HTTPS GitHub tarball, and there are no added install scripts, patches, or other execution/persistence mechanisms in this diff.

@@ -9,13 +9,12 @@ backup=("etc/paru.conf")
 arch=('i686' 'pentium4' 'x86_64' 'arm' 'armv7h' 'armv6h' 'aarch64')
 license=('GPL-3.0-or-later')
 makedepends=('cargo')
-depends=('git' 'pacman' 'libalpm.so>=14')
+depends=('git' 'pacman>=7.1' 'libalpm.so')
 optdepends=('bat: colored pkgbuild printing' 'devtools: build in chroot and downloading pkgbuilds')
-sha256sums=('eea4dbb524db765d5316f540f9ee670c0bf81aae4827b5417eebb4c9b5651727')
+sha256sums=('213d55a67605ff69faefa523917fee7168ea5bf143be8cef800fb48c9759f348')
 
 prepare() {
   cd "$pkgname-$pkgver"
-  cargo update alpm alpm-utils
   cargo fetch --locked --target "$(rustc -vV | sed -n 's|host: ||p')"
 }