Review Results

Comment

The change only bumps the package version in .SRCINFO from 21 to 21.1.2. No build logic, sources, install scripts, permissions, or dependencies are modified, and there are no new execution or integrity risks visible in this diff. This is a metadata-only update with no security impact apparent from the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = aurutils
 	pkgdesc = helper tools for the arch user repository
-	pkgver = 21
+	pkgver = 21.1.2
 	pkgrel = 1
 	url = https://github.com/AladW/aurutils
 	install = aurutils.install

Comment

The change only updates the upstream release tarball URL and its SHA-256 checksum in .SRCINFO from aurutils 21 to 21.1.2. The source is still fetched over HTTPS from the official GitHub release archive, and there are no new build steps, scripts, or privilege-related artifacts introduced by this metadata-only update. No security concerns are evident from the diff alone.

@@ -23,7 +23,7 @@ pkgbase = aurutils
 	optdepends = git-delta: view-delta example script
 	optdepends = python-srcinfo: sync-rebuild example script
 	optdepends = expect: non-interactive usage
-	source = aurutils-21.tar.gz::https://github.com/AladW/aurutils/archive/refs/tags/21.tar.gz
-	sha256sums = 39d169f6139dd5ab26be00b903716aca24387b655e28b2c13d47f2ccaae4b072
+	source = aurutils-21.1.2.tar.gz::https://github.com/AladW/aurutils/archive/refs/tags/21.1.2.tar.gz
+	sha256sums = 463d904d5d591b590cb04dcd16ee5acaf19c30144b3a6f8adc082492354693ef
 
 pkgname = aurutils

Comment

The change only bumps pkgver from 21 to 21.1.2 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or other packaging logic are modified in the provided diff. Based on this hunk alone, there are no security red flags.

@@ -3,7 +3,7 @@
 # Co-Maintainer: zoorat <zoorat [at] protonmail [dot] com>
 
 pkgname=aurutils
-pkgver=21
+pkgver=21.1.2
 pkgrel=1
 pkgdesc='helper tools for the arch user repository'
 url='https://github.com/AladW/aurutils'

Comment

The change only updates the SHA-256 checksum for the upstream tarball source in PKGBUILD. The source URL remains the official GitHub release archive over HTTPS, and there are no new build steps, scripts, binaries, or privilege/persistence mechanisms introduced by this diff. I did not find any security-relevant behavior change in the reviewed hunk.

@@ -12,7 +12,7 @@ license=('ISC')
 source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/$pkgver.tar.gz")
 changelog=aurutils.changelog
 install=aurutils.install
-sha256sums=('39d169f6139dd5ab26be00b903716aca24387b655e28b2c13d47f2ccaae4b072')
+sha256sums=('463d904d5d591b590cb04dcd16ee5acaf19c30144b3a6f8adc082492354693ef')
 depends=('git' 'pacutils' 'curl' 'perl' 'perl-json-xs' 'bash' 'trurl')
 optdepends=('bash-completion: bash completion'
             'zsh: zsh completion'

Comment

The change only updates the changelog with release notes for version 21.1. It does not modify any executable code, build logic, install scripts, sources, or packaging metadata that could affect runtime behavior or supply-chain integrity. No security-relevant content is introduced by this diff.

@@ -1,3 +1,45 @@
+## 21.1
+
+* `aur-build`
+  + replace links in the local repository with `--pool`
+  + use `AUR_MAKEPKG_GNUPGHOME` for `--pkgver`
+  + check the file given with `--buildscript` (#1252)
+  + pass `--makepkg-conf` to `build--pkglist`
+  + `build--sync`: do not forward arguments to `pactrans`
+
+* `aur-chroot`
+  + add `--setenv` arguments for `run0` (#1268)
+
+* `aur-fetch`
+  + read standard input for `-` as the first argument
+  + read `aurutils.rebase` for each package
+  + pass `--ff` to git-merge
+  + strip trailing slashes from URLs
+  + `fetch--mirror`: match the mirror branch exactly
+
+* `aur-graph`
+  + include epoch in package versions
+  + compare dependencies with the full version
+  + try comparison operators in order
+
+* `aur-repo`
+  + use `--root` if no repository is specified
+  + `repo-filter`: update the default repositories
+  + `repo-parse`: take a value for `--delim`
+
+* `aur-srcver`
+  + read targets from `--arg-file`
+
+* `aur-sync`, `aur-build`, `aur-chroot`
+  + print errors to standard error
+
+* `perl`
+  + compare dependencies with the full version in `Depends`
+  + document the remaining `AUR` modules
+
+* `tests`
+  + move shell tests to `tests/lib`
+
 ## 21
 
 * `aur-sync`