Review Results

Comment

The only change in this .SRCINFO diff is a pkgrel bump from 1 to 2. No sources, build steps, install scripts, dependencies, or package contents are altered by this change, so there is no new security risk introduced by the diff itself.

@@ -1,7 +1,7 @@
 pkgbase = discord_arch_electron
 	pkgdesc = Discord using system provided electron for increased security and performance
 	pkgver = 1.0.168
-	pkgrel = 1
+	pkgrel = 2
 	epoch = 1
 	url = https://discord.com
 	install = discord_arch_electron.install

Comment

The change is limited to .SRCINFO metadata and swaps one Discord distro artifact source for another on the same official HTTPS host and pinned version. There is no evidence of added build-time execution, privilege escalation, or new untrusted infrastructure. While the package still relies on upstream binary blobs, this diff does not introduce a new security concern beyond the existing trust model.

@@ -35,7 +35,7 @@ pkgbase = discord_arch_electron
 	source = discord_modules-1.0.168.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.168/discord_modules/1/full.distro
 	source = discord_spellcheck-1.0.168.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.168/discord_spellcheck/1/full.distro
 	source = discord_dispatch-1.0.168.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.168/discord_dispatch/1/full.distro
-	source = discord_cloudsync-1.0.168.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.168/discord_cloudsync/1/full.distro
+	source = discord_ndi-1.0.168.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.168/discord_ndi/1/full.distro
 	source = discord_sysimg-1.0.168.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.168/discord_sysimg/1/full.distro
 	sha512sums = 33ff24e65e2f1daaf7b1047ad663cee79cb1b1819b9a6d6507e08b55ab6efd423d4c3ee23f7b07ea00f909affef7c0b7826dc502ab3f800cbf6d7ed3955d8d09
 	sha512sums = SKIP

Comment

The change only updates a sha512 checksum entry in .SRCINFO. This is metadata-only and does not alter build logic, install scripts, sources, or package contents. I did not see any indication from the diff itself of a malicious source swap or other security-relevant behavior. Risk is minimal, though checksum changes should always be correlated with the corresponding PKGBUILD/source update in a full review.

@@ -54,7 +54,7 @@ pkgbase = discord_arch_electron
 	sha512sums = cd35b680c0bd5ca7ee74014b2696156af2c53d39c23ae49e20f7d97fb6d012778110808c6fe9c4eceb4f0fcf3276a5b52fdcbdba93e1138dae67d42fc9c08464
 	sha512sums = cb4ef01ee9f203324902d49716c5f2a9e069c6ffaef8702574f2edf49f73e2251d83bfc19c49d9642453239b16bbb83f676a5e1fd5ab4dbe87cea4caf769bb1a
 	sha512sums = 8acaeeda97dc025ca8782364cde16397d4db870290dcbe954cf94ae8f9ba67ec26b4ab020bf2255de64d559b2a8f653ed47a75e6cd1835deb0f89dfdb28d7cf0
-	sha512sums = ccdf8145b5647e82b827b501bb6b577f1288dd23dadedf51cf2401b8b2cd000ac5fcb8c00d0c93dde5dc4f49b624a75d10873597d67b58bcf53707c4f40f130b
+	sha512sums = c3405234f82a03190e782073c559c93e3e4cef07972d1163ff553b56421df5545aa93abf50042535c661118d961000ea3d698fa7435bdd9030b8b2a868a06a6a
 	sha512sums = 160edd27d3c7710fc05a7fb5d9c4be8ad369a2485e77b5a17b1a3c29a4a8d829619e79036dce547c99e69e0c4ad3212e8c1f3ee36fe3a1f50938eaf6b7c73a95
 
 pkgname = discord_arch_electron

Comment

This change only bumps pkgrel from 1 to 2 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or packaging behavior. No security-relevant functionality is introduced by the diff itself.

@@ -10,7 +10,7 @@ _pkgname=discord
 _electron=electron
 pkgname=${_pkgname}_arch_electron
 pkgver=1.0.168
-pkgrel=1
+pkgrel=2
 epoch=1
 pkgdesc="Discord using system provided ${_electron} for increased security and performance"
 arch=('x86_64')

Comment

The change only swaps one Discord-provided source tarball for another: `discord_cloudsync` is replaced with `discord_ndi`, both fetched over HTTPS from the same official Discord CDN and still covered by sha512 checksums. There is no added build-time code execution, no new external/unpinned source, and no packaging logic change. Security impact appears minimal; the main effect is a different upstream component being packaged.

@@ -46,7 +46,7 @@ source=("https://dl.discordapp.net/apps/linux/${pkgver}/${_pkgname}-${pkgver}.ta
         "discord_modules-${pkgver}.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/${pkgver}/discord_modules/1/full.distro"
         "discord_spellcheck-${pkgver}.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/${pkgver}/discord_spellcheck/1/full.distro"
         "discord_dispatch-${pkgver}.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/${pkgver}/discord_dispatch/1/full.distro"
-        "discord_cloudsync-${pkgver}.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/${pkgver}/discord_cloudsync/1/full.distro"
+        "discord_ndi-${pkgver}.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/${pkgver}/discord_ndi/1/full.distro"
         "discord_sysimg-${pkgver}.tar.br::https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/${pkgver}/discord_sysimg/1/full.distro")
 sha512sums=('33ff24e65e2f1daaf7b1047ad663cee79cb1b1819b9a6d6507e08b55ab6efd423d4c3ee23f7b07ea00f909affef7c0b7826dc502ab3f800cbf6d7ed3955d8d09'
             '2590151db4404a9ecbae2c45269c74f5ea26479967de5bc0b221a9143f4efeeeda9e335c23cf1f982680ab4fd895dcf3fd5731bd230908b3b2568eee0ec223ec'

Comment

The only change is an update to one sha512 checksum in PKGBUILD. This is a normal integrity metadata refresh and does not introduce new sources, build steps, scripts, or packaging behavior. I see no evidence of malicious code execution, privilege escalation, or supply-chain risk from this diff alone.

@@ -65,7 +65,7 @@ sha512sums=('33ff24e65e2f1daaf7b1047ad663cee79cb1b1819b9a6d6507e08b55ab6efd423d4
             'cd35b680c0bd5ca7ee74014b2696156af2c53d39c23ae49e20f7d97fb6d012778110808c6fe9c4eceb4f0fcf3276a5b52fdcbdba93e1138dae67d42fc9c08464'
             'cb4ef01ee9f203324902d49716c5f2a9e069c6ffaef8702574f2edf49f73e2251d83bfc19c49d9642453239b16bbb83f676a5e1fd5ab4dbe87cea4caf769bb1a'
             '8acaeeda97dc025ca8782364cde16397d4db870290dcbe954cf94ae8f9ba67ec26b4ab020bf2255de64d559b2a8f653ed47a75e6cd1835deb0f89dfdb28d7cf0'
-            'ccdf8145b5647e82b827b501bb6b577f1288dd23dadedf51cf2401b8b2cd000ac5fcb8c00d0c93dde5dc4f49b624a75d10873597d67b58bcf53707c4f40f130b'
+            'c3405234f82a03190e782073c559c93e3e4cef07972d1163ff553b56421df5545aa93abf50042535c661118d961000ea3d698fa7435bdd9030b8b2a868a06a6a'
             '160edd27d3c7710fc05a7fb5d9c4be8ad369a2485e77b5a17b1a3c29a4a8d829619e79036dce547c99e69e0c4ad3212e8c1f3ee36fe3a1f50938eaf6b7c73a95')
 
 # Skip "LICENSE.html" and "OSS-LICENSES.html" files hashes as they are unstable