Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.11.1 to 26.11.2. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust were changed in the reviewed diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.11.1
+	pkgver = 26.11.2
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.11.1 to v26.11.2. The source remains an HTTPS GitHub release artifact from the official upstream project, with no new build steps, scripts, patches, or packaging metadata changes that would introduce execution or integrity risks. Based on the provided diff alone, this is low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.1/qownnotes-26.11.1.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.2/qownnotes-26.11.2.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/tag and the release tarball checksum were updated to a new GitHub release. The source remains an HTTPS release artifact from the official upstream project, with no new build steps, no added scripts, and no changes to dependencies or packaging behavior. I do not see any supply-chain red flags in this diff alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.11.1
-tag="f120e5d8ee223a17d9a29c2636ece2144361a2e7"
+pkgver=26.11.2
+tag="b0f511114705bd62206afa58365d4e02381b801e"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball while keeping the source URL pinned to the official GitHub release asset over HTTPS. No build logic, install scripts, or additional sources were introduced, and there are no signs of network access or privilege escalation in this diff. Security impact is limited to integrity verification of the same upstream artifact.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('2b2109e8dee5b4eea6e9265a8e1a49a314c0e3ca2165e88d9655312d6bd07631')
+sha256sums=('b2673e25378ad01b685eee9b89221eb47eae7eb53cbec862220e8a823deb86ec')
 
 prepare() {
     cd "${pkgname}-${pkgver}"