Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver downgrade from 3.12.1 to 3.12.0. This is not a direct code-execution or persistence issue, but it is an integrity/supply-chain concern because it makes the package metadata advertise an older release than the previous commit, which could cause users to build/install a stale version with potentially unpatched vulnerabilities. I did not see any evidence in the provided diff of malicious payloads, network fetches, or install-script changes, so the risk is limited to version rollback / downgrade behavior.

@@ -1,6 +1,6 @@
 pkgbase = ipscan
 	pkgdesc = Angry IP Scanner (or simply ipscan) is an open-source and cross-platform network scanner designed to be fast and simple to use. It scans IP addresses and ports as well as has many other features.
-	pkgver = 3.12.1
+	pkgver = 3.12.0
 	pkgrel = 1
 	url = https://angryip.org
 	arch = i686

Comment

The change only updates .SRCINFO metadata to point the source tarball and pkgver from 3.12.1 to 3.12.0, with the corresponding checksum adjusted. This does not introduce new code execution, network behavior, privilege changes, or packaging/install-script risk by itself. The main concern is a version downgrade, which is a supply-chain integrity issue in general, but within this isolated .SRCINFO-only diff there is no evidence of malicious behavior or a security impact beyond packaging correctness.

@@ -11,10 +11,10 @@ pkgbase = ipscan
 	source = ipscan
 	source = ipscan.desktop
 	source = build.gradle.patch
-	source = https://github.com/angryip/ipscan/archive/refs/tags/3.12.1.zip
+	source = https://github.com/angryip/ipscan/archive/refs/tags/3.12.0.zip
 	sha512sums = e2caf62412c35a7a29128d0ae176aca1e4a45cf81e44b76e4bb23ad1c0633fa8833d674d7d514942a170ab54223b6c4a93ab458f2736107e7bbe9a5e806a7c5e
 	sha512sums = c17db5e4ac90af8675e9ac2a8e77f1322beb8bacb578a288bcfbf8da67270004ec40314b2793ea8ed8eeeeb64f9c03b3f80694e38c55be9d213486b825689a0f
 	sha512sums = 8ec4aae1b2226af984e58acd20ddc7d78268ab53a1f39cb6c85143741638727cf94794597bb9755483968c5f93e37cc96c33c61527529c074782f9447914399a
-	sha512sums = 60726ed74bbcee8a52af7efa443d9f96f40cf157844b32615df7bee6a05583641410e9f2ed7d2ada6eb6824d9041ed9f6f14d386b5ef589a0a4d7114270a4bec
+	sha512sums = 1949c471c25e94ea596041a897763a31bcf9a03e093d349a415633cfb5a73f4a2ce0ace37e0c46f06802cbdedacd58afb37a8b0015125cf4ff302ae81429661e
 
 pkgname = ipscan

Comment

The only change in this diff is a version downgrade in PKGBUILD from 3.12.1 to 3.12.0. This does not introduce any new code execution, network access, privilege escalation, or packaging hygiene issues by itself. It may be a packaging mistake or a rollback, but there is no security-sensitive behavior added in the reviewed hunk.

@@ -3,7 +3,7 @@
 # Maintainer:  max.bra <max dot bra at alice dot it>
 
 pkgname=ipscan
-pkgver=3.12.1
+pkgver=3.12.0
 pkgrel=1
 pkgdesc='Angry IP Scanner (or simply ipscan) is an open-source and cross-platform network scanner designed to be fast and simple to use. It scans IP addresses and ports as well as has many other features.'
 arch=('i686' 'x86_64')

Comment

The change only updates the sha512 checksum for one source artifact in PKGBUILD. There are no new sources, no build-script logic changes, and no evidence of added network access, privilege escalation, or install-time persistence. Based on the diff alone, this appears to be a routine integrity hash refresh with no security impact.

@@ -21,7 +21,7 @@ source=(ipscan ipscan.desktop build.gradle.patch \
 sha512sums=('e2caf62412c35a7a29128d0ae176aca1e4a45cf81e44b76e4bb23ad1c0633fa8833d674d7d514942a170ab54223b6c4a93ab458f2736107e7bbe9a5e806a7c5e'
             'c17db5e4ac90af8675e9ac2a8e77f1322beb8bacb578a288bcfbf8da67270004ec40314b2793ea8ed8eeeeb64f9c03b3f80694e38c55be9d213486b825689a0f'
             '8ec4aae1b2226af984e58acd20ddc7d78268ab53a1f39cb6c85143741638727cf94794597bb9755483968c5f93e37cc96c33c61527529c074782f9447914399a'
-            '60726ed74bbcee8a52af7efa443d9f96f40cf157844b32615df7bee6a05583641410e9f2ed7d2ada6eb6824d9041ed9f6f14d386b5ef589a0a4d7114270a4bec')
+            '1949c471c25e94ea596041a897763a31bcf9a03e093d349a415633cfb5a73f4a2ce0ace37e0c46f06802cbdedacd58afb37a8b0015125cf4ff302ae81429661e')
 
 # prefer jdk21, otherwise the system default JDK
 _javahome() {