Review Results

Comment

The only change in this diff is a pkgver bump in .SRCINFO from 3.2.34_53644 to 3.2.35_54395. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic are altered here, so there is no new security concern introduced by this change alone. Any risk would depend on the corresponding PKGBUILD/source update, which is outside the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = linuxqq
 	pkgdesc = New Linux QQ based on Electron
-	pkgver = 3.2.34_53644
+	pkgver = 3.2.35_54395
 	pkgrel = 1
 	epoch = 5
 	url = https://im.qq.com/linuxqq

Comment

The change only updates the pinned upstream binary package URLs and their SHA-512 checksums in .SRCINFO to a newer LinuxQQ release. The sources remain HTTPS on the vendor domain, and there are no new build steps, scripts, or privilege-related artifacts introduced by this diff. From the provided hunk alone, this is a routine version bump with no obvious security regression.

@@ -21,11 +21,11 @@ pkgbase = linuxqq
 	options = !debug
 	source = linuxqq.sh
 	sha512sums = bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7
-	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_amd64.deb
-	sha512sums_x86_64 = 774e45cd7238dc51b31c02ee494f9f86e773c487a90851790a806f776e130af125110045844e90dd68d0b073dc53bdd4d1c6d8fb7225b8f214fc0e35d1a20e32
-	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_arm64.deb
-	sha512sums_aarch64 = fa1424d41f934798a8f20b6cad8749f1eb99f29957501b3578449ade06fe105387e038e98cafb1bcc57d4d35010d771312ca0de7b14e62da0765cd29b005a5d1
-	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_loongarch64.deb
-	sha512sums_loong64 = c3fa5c8cc426a3dfc35e26c1f1e138d018c5541beb84b2deae647be05e66aed8cb80a349a694672ff303884f5947508ded5af0b6b4a9e733a24eec9060d2cbf3
+	source_x86_64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/816b3c79/linuxqq_3.2.35-54395_amd64.deb
+	sha512sums_x86_64 = c1dc085f2b50702a7c408aa6b89754ea5588c0646cf259fdf5c34a63f9883e0617008d6503469e6ae25e85bd1fd4063b56d8479dcd86529587c21a7f7316e95c
+	source_aarch64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/816b3c79/linuxqq_3.2.35-54395_arm64.deb
+	sha512sums_aarch64 = adb5c09354deacc3568607bbea95afcdc8f7c1c076761f08531bc8fcb6bcafdad9c704608635f6680f928c2b7d9bdee26cb4a6cdbcef335cb94566e5c88992c9
+	source_loong64 = https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/816b3c79/linuxqq_3.2.35-54395_loongarch64.deb
+	sha512sums_loong64 = e0883a55407c7636db864f343bbeec8a8c29559c54f4e70851a9e1bb06f9ab90c43ee564d606349be49aebb2dc923ae19f9df0de2ba8203d6a0ed56c2395dbf7
 
 pkgname = linuxqq

Comment

The change is a routine version bump in PKGBUILD: pkgver, upstream download path, and corresponding checksums were updated. The sources remain HTTPS on the official Tencent domain, there are no new build-time commands, no added scripts, and no packaging/persistence changes. I do note the package still downloads a prebuilt .deb from upstream, but that was already the case and this diff does not introduce a new risk beyond the existing trust model.

@@ -2,7 +2,7 @@
 # Contributor: Integral <integral@member.fsf.org>
 
 pkgname=linuxqq
-pkgver=3.2.34_53644
+pkgver=3.2.35_54395
 pkgrel=1
 epoch=5
 pkgdesc="New Linux QQ based on Electron"

Comment

The change only bumps the upstream QQNT .deb version from 9.9.36 to 9.9.37 and updates the corresponding per-arch source URLs and SHA-512 checksums. The sources remain HTTPS on the same official qqdl.gtimg.cn host, there are no new build-time commands, no added scripts, and no packaging logic changes. I do note the package continues to ship prebuilt upstream binaries, but that was already true before this diff and is not introduced here. No new security issue is evident in this hunk.

@@ -12,16 +12,16 @@ license=('LicenseRef-QQ')
 conflicts=("${pkgname}-nt-bwrap")
 depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
 optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
-_md5_prefix=9ee04bef
+_md5_prefix=816b3c79
 _src_prefix="${pkgname}_${pkgver/_/-}"
-source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
-source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
-source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
+source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
+source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
+source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
 source=("${pkgname}.sh")
 sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
-sha512sums_x86_64=('774e45cd7238dc51b31c02ee494f9f86e773c487a90851790a806f776e130af125110045844e90dd68d0b073dc53bdd4d1c6d8fb7225b8f214fc0e35d1a20e32')
-sha512sums_aarch64=('fa1424d41f934798a8f20b6cad8749f1eb99f29957501b3578449ade06fe105387e038e98cafb1bcc57d4d35010d771312ca0de7b14e62da0765cd29b005a5d1')
-sha512sums_loong64=('c3fa5c8cc426a3dfc35e26c1f1e138d018c5541beb84b2deae647be05e66aed8cb80a349a694672ff303884f5947508ded5af0b6b4a9e733a24eec9060d2cbf3')
+sha512sums_x86_64=('c1dc085f2b50702a7c408aa6b89754ea5588c0646cf259fdf5c34a63f9883e0617008d6503469e6ae25e85bd1fd4063b56d8479dcd86529587c21a7f7316e95c')
+sha512sums_aarch64=('adb5c09354deacc3568607bbea95afcdc8f7c1c076761f08531bc8fcb6bcafdad9c704608635f6680f928c2b7d9bdee26cb4a6cdbcef335cb94566e5c88992c9')
+sha512sums_loong64=('e0883a55407c7636db864f343bbeec8a8c29559c54f4e70851a9e1bb06f9ab90c43ee564d606349be49aebb2dc923ae19f9df0de2ba8203d6a0ed56c2395dbf7')
 options=('!strip' '!debug')
 
 package() {