Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from swift 6.4.1 to 6.4.2. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = swift-bin
 	pkgdesc = Binary builds of the Swift programming language
-	pkgver = 6.4.1
+	pkgver = 6.4.2
 	pkgrel = 1
 	url = https://www.swift.org/
 	arch = x86_64

Comment

The change only bumps the pinned upstream Swift binary release from 6.4.1 to 6.4.2 for both x86_64 and aarch64, with matching SHA256 updates. The sources remain HTTPS on the official download.swift.org domain, there are no new build-time commands, no added scripts, and no packaging/persistence changes. This is a routine version update with no evident security regression in the diff shown.

@@ -14,9 +14,9 @@ pkgbase = swift-bin
 	provides = swift-language
 	replaces = swift-language-bin
 	options = !strip
-	source_x86_64 = https://download.swift.org/swift-6.4.1-release/ubi10/swift-6.4.1-RELEASE/swift-6.4.1-RELEASE-ubi10.tar.gz
-	sha256sums_x86_64 = 180ca7843cd092f2bcce230ab59c3b025159a41e81696e6543f349405f34d321
-	source_aarch64 = https://download.swift.org/swift-6.4.1-release/ubi10-aarch64/swift-6.4.1-RELEASE/swift-6.4.1-RELEASE-ubi10-aarch64.tar.gz
-	sha256sums_aarch64 = 632c82f08b48bebd7e66e5b43bb30f9c6dce51a3c1ac5c60c01aa08c9645cf5d
+	source_x86_64 = https://download.swift.org/swift-6.4.2-release/ubi10/swift-6.4.2-RELEASE/swift-6.4.2-RELEASE-ubi10.tar.gz
+	sha256sums_x86_64 = d2663c735fd2a5a6d2a004a5701f77df14ff93b9e5ea54815e8616832058bfbf
+	source_aarch64 = https://download.swift.org/swift-6.4.2-release/ubi10-aarch64/swift-6.4.2-RELEASE/swift-6.4.2-RELEASE-ubi10-aarch64.tar.gz
+	sha256sums_aarch64 = 236a49a0e848a6359937044ec125896f76a4f5284c99a954468e3bb93429c258
 
 pkgname = swift-bin

Comment

The only change in the reviewed hunk is a version bump from 6.4.1 to 6.4.2 in PKGBUILD. No build logic, sources, checksums, install scripts, permissions, or package metadata affecting trust were changed in the provided diff. Based on this hunk alone, there is no security concern.

@@ -4,7 +4,7 @@
 # Contributor: Frederic Bezies <fredbezies at gmail dot com>, youngunix <>
 
 pkgname=swift-bin
-pkgver=6.4.1
+pkgver=6.4.2
 pkgrel=1
 pkgdesc="Binary builds of the Swift programming language"
 arch=('x86_64' 'aarch64')

Comment

The change only bumps the Swift binary package version from 6.4.1 to 6.4.2 and updates the corresponding SHA-256 checksums for the official download.swift.org release tarballs on both x86_64 and aarch64. No new sources, scripts, build steps, or packaging logic were introduced, and the URLs remain HTTPS and pinned to the release version. This looks like a routine upstream version update with no evident security regression in the diff provided.

@@ -18,8 +18,8 @@ provides=('swift-language')
 replaces=('swift-language-bin')
 source_x86_64=("https://download.swift.org/swift-$pkgver-release/ubi10/swift-$pkgver-RELEASE/swift-$pkgver-RELEASE-ubi10.tar.gz")
 source_aarch64=("https://download.swift.org/swift-$pkgver-release/ubi10-aarch64/swift-$pkgver-RELEASE/swift-$pkgver-RELEASE-ubi10-aarch64.tar.gz")
-sha256sums_x86_64=('180ca7843cd092f2bcce230ab59c3b025159a41e81696e6543f349405f34d321')
-sha256sums_aarch64=('632c82f08b48bebd7e66e5b43bb30f9c6dce51a3c1ac5c60c01aa08c9645cf5d')
+sha256sums_x86_64=('d2663c735fd2a5a6d2a004a5701f77df14ff93b9e5ea54815e8616832058bfbf')
+sha256sums_aarch64=('236a49a0e848a6359937044ec125896f76a4f5284c99a954468e3bb93429c258')
 
 package() {
   _swift_root="/usr/lib/swift/usr"