Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 3.10.0 to 3.12.0, with the source URL and checksum updated accordingly. The only other metadata change is switching makedepends from the concrete package jdk21-openjdk to the virtual provider java-environment>=21, which broadens the acceptable build dependency but does not introduce execution, persistence, or integrity risks by itself. No suspicious URLs, build-time network fetches, or privilege-related metadata are introduced in this diff. Based on the provided hunk alone, this appears low risk.

@@ -1,20 +1,20 @@
 pkgbase = ipscan
 	pkgdesc = Angry IP Scanner (or simply ipscan) is an open-source and cross-platform network scanner designed to be fast and simple to use. It scans IP addresses and ports as well as has many other features.
-	pkgver = 3.10.0
+	pkgver = 3.12.0
 	pkgrel = 1
 	url = https://angryip.org
 	arch = i686
 	arch = x86_64
 	license = GPL2
-	makedepends = jdk21-openjdk
+	makedepends = java-environment>=21
 	depends = java-runtime>=21
 	source = ipscan
 	source = ipscan.desktop
 	source = build.gradle.patch
-	source = https://github.com/angryip/ipscan/archive/refs/tags/3.10.0.zip
+	source = https://github.com/angryip/ipscan/archive/refs/tags/3.12.0.zip
 	sha512sums = e2caf62412c35a7a29128d0ae176aca1e4a45cf81e44b76e4bb23ad1c0633fa8833d674d7d514942a170ab54223b6c4a93ab458f2736107e7bbe9a5e806a7c5e
 	sha512sums = c17db5e4ac90af8675e9ac2a8e77f1322beb8bacb578a288bcfbf8da67270004ec40314b2793ea8ed8eeeeb64f9c03b3f80694e38c55be9d213486b825689a0f
 	sha512sums = 8ec4aae1b2226af984e58acd20ddc7d78268ab53a1f39cb6c85143741638727cf94794597bb9755483968c5f93e37cc96c33c61527529c074782f9447914399a
-	sha512sums = 03b992d45ff0feee79d5c8c8b3a3d1dfe68bc0804298729c18a2c761a95c21ec43748724a81bb1fa730d8d0fcabfdcd97c36c4d0f3393144d540ab30c3697f61
+	sha512sums = 1949c471c25e94ea596041a897763a31bcf9a03e093d349a415633cfb5a73f4a2ce0ace37e0c46f06802cbdedacd58afb37a8b0015125cf4ff302ae81429661e
 
 pkgname = ipscan

Comment

The change is low risk overall. It updates the package version and switches makedepends from a specific JDK package to the virtual java-environment>=21, which is a normal packaging adjustment. The new _javahome() helper only selects an installed JDK path and the prepare() logic conditionally bumps Gradle/ProGuard versions when the local JDK is newer than 25; this is a build-time compatibility tweak, not a persistence or privilege-escalation mechanism. I did not see any network fetches outside the declared sources, shelling out to sudo, or suspicious install-time actions in this diff.

@@ -3,14 +3,14 @@
 # Maintainer:  max.bra <max dot bra at alice dot it>
 
 pkgname=ipscan
-pkgver=3.10.0
+pkgver=3.12.0
 pkgrel=1
 pkgdesc='Angry IP Scanner (or simply ipscan) is an open-source and cross-platform network scanner designed to be fast and simple to use. It scans IP addresses and ports as well as has many other features.'
 arch=('i686' 'x86_64')
 license=('GPL2')
 url='https://angryip.org'
 depends=('java-runtime>=21')
-makedepends=(jdk21-openjdk)
+makedepends=('java-environment>=21')
 
 [[ $CARCH == "i686" ]] && _intarch=linux
 [[ $CARCH == "x86_64" ]] && _intarch=linux64

Comment

The change is low risk. It only adjusts the build to prefer Java 21, and conditionally bumps Gradle/ProGuard versions when the local JDK is newer than 25. There is no added network fetch beyond the existing Gradle wrapper behavior, no new install-time code, and no privilege escalation or persistence mechanism. The only notable concern is that the build now depends on the host JDK version and rewrites wrapper/build files during prepare(), but this is a packaging/build reproducibility concern rather than a security issue.

@@ -21,19 +21,34 @@ source=(ipscan ipscan.desktop build.gradle.patch \
 sha512sums=('e2caf62412c35a7a29128d0ae176aca1e4a45cf81e44b76e4bb23ad1c0633fa8833d674d7d514942a170ab54223b6c4a93ab458f2736107e7bbe9a5e806a7c5e'
             'c17db5e4ac90af8675e9ac2a8e77f1322beb8bacb578a288bcfbf8da67270004ec40314b2793ea8ed8eeeeb64f9c03b3f80694e38c55be9d213486b825689a0f'
             '8ec4aae1b2226af984e58acd20ddc7d78268ab53a1f39cb6c85143741638727cf94794597bb9755483968c5f93e37cc96c33c61527529c074782f9447914399a'
-            '03b992d45ff0feee79d5c8c8b3a3d1dfe68bc0804298729c18a2c761a95c21ec43748724a81bb1fa730d8d0fcabfdcd97c36c4d0f3393144d540ab30c3697f61')
+            '1949c471c25e94ea596041a897763a31bcf9a03e093d349a415633cfb5a73f4a2ce0ace37e0c46f06802cbdedacd58afb37a8b0015125cf4ff302ae81429661e')
+
+# prefer jdk21, otherwise the system default JDK
+_javahome() {
+  if [[ -d /usr/lib/jvm/java-21-openjdk ]]; then
+    echo /usr/lib/jvm/java-21-openjdk
+  else
+    readlink -f /usr/lib/jvm/default
+  fi
+}
 
 prepare() {
   cd "${srcdir}/${pkgname}-${pkgver}"
   patch < ../build.gradle.patch
   sed -i "s|^version = .*|version = '${pkgver}'|" build.gradle
   sed -i -E "s|^( *'Version':) version,|\1 '${pkgver}',|g" build.gradle
+  # bundled Gradle 9.5 and ProGuard 7.8.1 handle up to Java 25; Java 27 needs Gradle 9.8.0+ and ProGuard 7.10+
+  local _jver=$(sed -n 's/^JAVA_VERSION="\([0-9]*\).*/\1/p' "$(_javahome)/release")
+  if (( _jver > 25 )); then
+    sed -i "s|gradle-.*-bin.zip|gradle-9.8.2-bin.zip|" gradle/wrapper/gradle-wrapper.properties
+    sed -i "s|com.guardsquare:proguard-gradle:[0-9.]*|com.guardsquare:proguard-gradle:7.10.0|" build.gradle
+  fi
 }
 
 build() {
   cd "${srcdir}/${pkgname}-${pkgver}"
   unset _JAVA_OPTIONS
-  export PATH=/usr/lib/jvm/java-21-openjdk/bin:$PATH
+  export JAVA_HOME="$(_javahome)"
   GRADLE_USER_HOME="${srcdir}" ./gradlew current
 }