Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 7.0.0 to 7.1.0. No sources, checksums, build steps, install scripts, or package metadata affecting execution/persistence were changed in the reviewed diff. On its face this is low risk; any security concerns would depend on the corresponding upstream release contents, which are not part of this diff.

@@ -1,6 +1,6 @@
 pkgbase = davmail
 	pkgdesc = a POP/IMAP/SMTP/Caldav/LDAP gateway for the exchange service
-	pkgver = 7.0.0
+	pkgver = 7.1.0
 	pkgrel = 1
 	url = http://davmail.sourceforge.net/
 	install = davmail.install

Comment

The change is a straightforward version bump in .SRCINFO from davmail 7.0.0 to 7.1.0 with the corresponding source filename and checksum update. No new sources, scripts, build steps, or packaging behaviors are introduced here. The source remains the same SourceForge download location as before (still HTTP, which is a pre-existing integrity concern, but not newly introduced by this diff). Based on this single metadata-only change, I do not see evidence of malicious behavior or a new security regression.

@@ -13,11 +13,11 @@ pkgbase = davmail
 	depends = java-runtime
 	optdepends = java-openjfx: Office 365 browser based authentication
 	optdepends = swt: Fix issues with the tray icon
-	source = http://downloads.sourceforge.net/davmail/davmail-7.0.0-4403.zip
+	source = http://downloads.sourceforge.net/davmail/davmail-7.1.0-4498.zip
 	source = davmail.desktop
 	source = davmail@.system_service
 	source = davmail@.user_service
-	md5sums = b3a6c84c92f4e7c1b17d4554cf1a3c4b
+	md5sums = f06562115cb76a934f7418613b749e97
 	md5sums = 1df37a6120d88de8df3cb735977336ba
 	md5sums = 8d373851babe1d8bb860228c8b4db702
 	md5sums = 271e9e66dfdb496d242c9a6102937c65

Comment

The change is a straightforward version bump for davmail from 7.0.0 to 7.1.0, with the corresponding upstream revision and checksum updated. I do not see any new build-time commands, extra sources, privilege escalation, or packaging changes beyond the version/source hash refresh. The only minor concern is that the source URL still uses HTTP rather than HTTPS, but that was pre-existing and not introduced by this diff. Overall this specific change appears low risk.

@@ -1,7 +1,7 @@
 # Contributor: Hy Goldsher <hyness-at-freshlegacycode-dot-org>
 # Maintainer: Hy Goldsher <hyness-at-freshlegacycode-dot-org>
 pkgname=davmail
-pkgver=7.0.0
+pkgver=7.1.0
 pkgrel=1
 pkgdesc="a POP/IMAP/SMTP/Caldav/LDAP gateway for the exchange service"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a routine upstream version bump for davmail, updating the package version, SourceForge revision, and checksum. I do not see any new build-time code execution, extra sources, privilege escalation, or packaging changes beyond the expected release update. One minor hygiene issue remains that the source URL still uses plain HTTP instead of HTTPS, but this is pre-existing and not introduced by this diff. Overall risk is low.

@@ -11,12 +11,12 @@ makedepends=('unzip')
 depends=('java-runtime')
 optdepends=('java-openjfx: Office 365 browser based authentication'
             'swt: Fix issues with the tray icon')
-_rev=4403
+_rev=4498
 source=(http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver-$_rev.zip
         $pkgname.desktop
         $pkgname@.system_service
         $pkgname@.user_service)
-md5sums=('b3a6c84c92f4e7c1b17d4554cf1a3c4b'
+md5sums=('f06562115cb76a934f7418613b749e97'
          '1df37a6120d88de8df3cb735977336ba'
          '8d373851babe1d8bb860228c8b4db702'
          '271e9e66dfdb496d242c9a6102937c65')