Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.1.0 to 2.2.0. No sources, checksums, install scripts, dependencies, or build logic are altered here, so there is no direct security impact visible in this diff. I did not see any indication of added network fetches, privilege escalation, or persistence mechanisms in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = paru-bin
 	pkgdesc = Feature packed AUR helper
-	pkgver = 2.1.0
+	pkgver = 2.2.0
 	pkgrel = 1
 	url = https://github.com/morganamilo/paru
 	arch = x86_64

Comment

The change is limited to metadata in .SRCINFO: it updates the packaged paru-bin release from 2.1.0 to 2.2.0 and tightens the pacman dependency to pacman>=7.1 while dropping the explicit libalpm.so version pin. The sources remain official GitHub release tarballs over HTTPS with updated checksums, and there are no new build-time commands, install scripts, or other execution paths introduced by this diff. No obvious supply-chain or persistence risk is present in the reviewed hunk.

@@ -8,18 +8,18 @@ pkgbase = paru-bin
 	arch = armv7h
 	license = GPL-3.0-or-later
 	depends = git
-	depends = pacman
-	depends = libalpm.so>=14
+	depends = pacman>=7.1
+	depends = libalpm.so
 	optdepends = bat: colored pkgbuild printing
 	optdepends = devtools: build in chroot and downloading pkgbuilds
 	provides = paru
 	conflicts = paru
 	backup = etc/paru.conf
-	source_x86_64 = https://github.com/Morganamilo/paru/releases/download/v2.1.0/paru-v2.1.0-x86_64.tar.zst
-	sha256sums_x86_64 = 28ef88736080e7e96e569f7adf10517ef8310a68b528e7f34c795287d7271880
-	source_aarch64 = https://github.com/Morganamilo/paru/releases/download/v2.1.0/paru-v2.1.0-aarch64.tar.zst
-	sha256sums_aarch64 = 7d3c7c029f5df300bdddf452f5af9fb194598253f4b1783dffa2c4668d65c3db
-	source_armv7h = https://github.com/Morganamilo/paru/releases/download/v2.1.0/paru-v2.1.0-armv7h.tar.zst
-	sha256sums_armv7h = 1423a07a626cb5aeb39a72a503a77dd9e5321a776bafd8d813bdeaa290d2b43e
+	source_x86_64 = https://github.com/Morganamilo/paru/releases/download/v2.2.0/paru-v2.2.0-x86_64.tar.zst
+	sha256sums_x86_64 = 52fc01ebd5ad120c19e0f879b0c262f3c81c58f956dba2f0d700457e1aa846cf
+	source_aarch64 = https://github.com/Morganamilo/paru/releases/download/v2.2.0/paru-v2.2.0-aarch64.tar.zst
+	sha256sums_aarch64 = 26d34fd815a8bb7d0ffe60247c7eb36c36d927d592382eb44b9ec2649e2543d8
+	source_armv7h = https://github.com/Morganamilo/paru/releases/download/v2.2.0/paru-v2.2.0-armv7h.tar.zst
+	sha256sums_armv7h = 1d1cd50af324b3d1de65a4e23b13c6cea5ce7f858c34841a4b457be992dee78d
 
 pkgname = paru-bin

Comment

The change is a straightforward version bump for a binary package, with updated checksums and a dependency adjustment from `pacman` to `pacman>=7.1` plus dropping the explicit `libalpm.so>=14` versioned dependency. I do not see any new sources, build-time network access, scripts, or packaging behavior changes in the diff. The only security-relevant question is whether the new binary release is trustworthy, but that is outside the scope of this diff and there is no evidence here of tampering or malicious packaging changes.

@@ -1,6 +1,6 @@
 # Maintainer: Morgan <morganamilo@archlinux.org>
 pkgname=paru-bin
-pkgver=2.1.0
+pkgver=2.2.0
 pkgrel=1
 pkgdesc='Feature packed AUR helper'
 url='https://github.com/morganamilo/paru'

Comment

The change is low risk. It only updates the binary package dependency constraint from `pacman` to `pacman>=7.1` and drops the explicit `libalpm.so>=14` versioned dependency in favor of the unversioned SONAME, plus refreshed checksums for the upstream release artifacts. There are no new build-time downloads, scripts, privilege changes, or install-time actions introduced in this hunk. The only thing to note is that the package now relies on the newer pacman version requirement, which is a compatibility change rather than a security concern.

@@ -10,13 +10,13 @@ source_armv7h=("https://github.com/Morganamilo/paru/releases/download/v$pkgver/p
 backup=("etc/paru.conf")
 arch=('x86_64' 'aarch64' 'armv7h')
 license=('GPL-3.0-or-later')
-depends=('git' 'pacman' 'libalpm.so>=14')
+depends=('git' 'pacman>=7.1' 'libalpm.so')
 optdepends=('bat: colored pkgbuild printing' 'devtools: build in chroot and downloading pkgbuilds')
 conflicts=('paru')
 provides=('paru')
-sha256sums_x86_64=('28ef88736080e7e96e569f7adf10517ef8310a68b528e7f34c795287d7271880')
-sha256sums_aarch64=('7d3c7c029f5df300bdddf452f5af9fb194598253f4b1783dffa2c4668d65c3db')
-sha256sums_armv7h=('1423a07a626cb5aeb39a72a503a77dd9e5321a776bafd8d813bdeaa290d2b43e')
+sha256sums_x86_64=('52fc01ebd5ad120c19e0f879b0c262f3c81c58f956dba2f0d700457e1aa846cf')
+sha256sums_aarch64=('26d34fd815a8bb7d0ffe60247c7eb36c36d927d592382eb44b9ec2649e2543d8')
+sha256sums_armv7h=('1d1cd50af324b3d1de65a4e23b13c6cea5ce7f858c34841a4b457be992dee78d')
 
 package() {
   cd "$srcdir/"