Review Results

Comment

The change is a straightforward version bump in .SRCINFO from XnViewMP 1.12.1 to 1.12.2, with the source URL and checksum updated accordingly. No new sources, scripts, build steps, permissions, or packaging metadata were introduced, and the source remains an HTTPS download from the vendor’s domain. Based on the provided diff alone, there are no security red flags.

@@ -1,15 +1,15 @@
 pkgbase = xnviewmp
 	pkgdesc = An efficient multimedia viewer, browser and converter.
-	pkgver = 1.12.1
-	pkgrel = 2
+	pkgver = 1.12.2
+	pkgrel = 1
 	url = https://www.xnview.com/en/xnviewmp/
 	arch = x86_64
 	license = custom
 	depends = qt6-multimedia
 	optdepends = glib2: support for moving files to trash
-	source = XnViewMP-linux-x64_1.12.1-rel1.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-1.12.1-linux-x64.tgz
+	source = XnViewMP-linux-x64_1.12.2-rel1.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-1.12.2-linux-x64.tgz
 	source = XnView.desktop
-	sha256sums = 76c9dac7c003033faf941641060cbd83b96edeb142e90b30b5968fd8960b1775
+	sha256sums = 66faa259a1377f5f055b089ea182b8596a0d495790778798b27d763344984e64
 	sha256sums = f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a
 
 pkgname = xnviewmp

Comment

The change is a routine version bump from 1.12.1 to 1.12.2 with the corresponding source checksum update and pkgrel reset. The source remains an HTTPS download from the vendor’s official domain, and there are no new build-time commands, scripts, patches, or packaging changes that would introduce execution, persistence, or integrity risks. Based on the provided diff, this is low risk.

@@ -8,9 +8,9 @@
 # Contributor: Martin Poljak <martin 'at' poljak 'dot' cz>
 
 pkgname=xnviewmp
-pkgver=1.12.1
+pkgver=1.12.2
 srcrel=1 # Incremented when there is a new release for the same version number
-pkgrel=2
+pkgrel=1
 pkgdesc="An efficient multimedia viewer, browser and converter."
 url="https://www.xnview.com/en/xnviewmp/"
 

Comment

The change is a straightforward version bump from 1.12.1 to 1.12.2 with an updated SHA256 for the upstream tarball. The source remains the official XnView download URL over HTTPS, and there are no new build-time commands, scripts, patches, or packaging logic changes. No obvious supply-chain or privilege-escalation concerns are introduced by this diff alone.

@@ -24,7 +24,7 @@ optdepends=('glib2: support for moving files to trash')
 
 source=("XnViewMP-linux-x64_${pkgver}-rel${srcrel}.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-${pkgver}-linux-x64.tgz"
         'XnView.desktop')
-sha256sums=('76c9dac7c003033faf941641060cbd83b96edeb142e90b30b5968fd8960b1775'
+sha256sums=('66faa259a1377f5f055b089ea182b8596a0d495790778798b27d763344984e64'
             'f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a')
 
 package() {