Review Results

Comment

The only change in this diff is a version bump in .SRCINFO from 1.5.0 to 1.5.1. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic changed, so there is no new security-relevant behavior to assess from this hunk alone. This is a low-risk metadata update.

@@ -1,6 +1,6 @@
 pkgbase = rustdesk-bin
 	pkgdesc = Yet another remote desktop software, written in Rust. Works out of the box, no configuration required.
-	pkgver = 1.5.0
+	pkgver = 1.5.1
 	pkgrel = 1
 	url = https://github.com/rustdesk/rustdesk
 	install = rustdesk-bin.install

Comment

The change only bumps the pinned upstream binary release from RustDesk 1.5.0 to 1.5.1 in .SRCINFO, with HTTPS GitHub release URLs and updated SHA-256 checksums. No new sources, scripts, build steps, or packaging logic are introduced in this diff, so there is no evident security regression in the reviewed hunk. The main residual risk is the inherent trust in prebuilt upstream binaries, but that existed before and is not worsened by this metadata-only update.

@@ -24,9 +24,9 @@ pkgbase = rustdesk-bin
 	options = !strip
 	options = !lto
 	options = !debug
-	source_x86_64 = rustdesk-1.5.0-1-x86_64.pkg.tar.zst::https://github.com/rustdesk/rustdesk/releases/download/1.5.0/rustdesk-1.5.0-0-x86_64.pkg.tar.zst
-	sha256sums_x86_64 = e920621899aeaa18c6e7e23b2b565615e7dc957dc987494795ca7a94c3108d7d
-	source_aarch64 = rustdesk-1.5.0-1-aarch64.rpm::https://github.com/rustdesk/rustdesk/releases/download/1.5.0/rustdesk-1.5.0-0.aarch64.rpm
-	sha256sums_aarch64 = 1b436234e51ca59bfd3beba6ba81096be13a22a7e2f8b94bd45218b8c77e5e13
+	source_x86_64 = rustdesk-1.5.1-1-x86_64.pkg.tar.zst::https://github.com/rustdesk/rustdesk/releases/download/1.5.1/rustdesk-1.5.1-0-x86_64.pkg.tar.zst
+	sha256sums_x86_64 = b1dcad4d23ac91b6ce662a2a1495d69a92b5b1ae5d7b6c5b0e11a6cbfc9cccac
+	source_aarch64 = rustdesk-1.5.1-1-aarch64.rpm::https://github.com/rustdesk/rustdesk/releases/download/1.5.1/rustdesk-1.5.1-0.aarch64.rpm
+	sha256sums_aarch64 = b26753b64c9fcb26855bb9bd1fbefc22c146875d2376f892581ab6d79764f669
 
 pkgname = rustdesk-bin

Comment

The change only bumps pkgver from 1.5.0 to 1.5.1 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic were modified, so there is no new security-relevant behavior introduced by this diff. Based on the provided hunk alone, this is low risk.

@@ -6,7 +6,7 @@
 
 pkgbase=rustdesk-bin
 pkgname=(rustdesk-bin)
-pkgver=1.5.0
+pkgver=1.5.1
 pkgrel=1
 pkgdesc="Yet another remote desktop software, written in Rust. Works out of the box, no configuration required."
 url="https://github.com/rustdesk/rustdesk"

Comment

The change only updates the pinned SHA-256 checksums for the prebuilt upstream release artifacts referenced in source_x86_64/source_aarch64. The download URLs remain HTTPS and still point to the upstream RustDesk release assets, with no new build-time code execution, no install-script changes, and no packaging/persistence red flags introduced by this diff. Security impact is limited to integrity metadata refresh for the same external binaries.

@@ -33,8 +33,8 @@ optdepends=(
 options=('!strip' '!lto' '!debug')
 source_x86_64=("${pkgbase%-bin}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst::$url/releases/download/${pkgver/_/-}/rustdesk-${pkgver/_/-}-0-x86_64.pkg.tar.zst")
 source_aarch64=("${pkgbase%-bin}-${pkgver}-${pkgrel}-aarch64.rpm::$url/releases/download/${pkgver/_/-}/rustdesk-${pkgver/_/-}-0.aarch64.rpm")
-sha256sums_x86_64=('e920621899aeaa18c6e7e23b2b565615e7dc957dc987494795ca7a94c3108d7d')
-sha256sums_aarch64=('1b436234e51ca59bfd3beba6ba81096be13a22a7e2f8b94bd45218b8c77e5e13')
+sha256sums_x86_64=('b1dcad4d23ac91b6ce662a2a1495d69a92b5b1ae5d7b6c5b0e11a6cbfc9cccac')
+sha256sums_aarch64=('b26753b64c9fcb26855bb9bd1fbefc22c146875d2376f892581ab6d79764f669')
 
 install=$pkgname.install