Review Results

Comment

The only change in this commit range is a pkgrel bump from 1 to 2 in .SRCINFO, with no source, build, install-script, dependency, or packaging logic changes. This is a metadata-only rebuild marker and does not introduce any new security-relevant behavior.

@@ -1,7 +1,7 @@
 pkgbase = anydesk-bin
 	pkgdesc = The Fast Remote Desktop Application
 	pkgver = 8.1.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://anydesk.com
 	arch = x86_64
 	arch = aarch64

Comment

The change only updates the recorded SHA-256 checksums for the upstream AnyDesk release tarballs on the official HTTPS download host. No new sources, scripts, build steps, or packaging behavior are introduced, and the URLs remain pinned to the same versioned artifacts. This is a low-risk metadata-only integrity update, with no evidence of malicious behavior in the diff itself.

@@ -34,8 +34,8 @@ pkgbase = anydesk-bin
 	conflicts = anydesk
 	options = !strip
 	source_x86_64 = https://download.anydesk.com/linux/anydesk-8.1.0-amd64.tar.gz
-	sha256sums_x86_64 = 22615f1ac8aa4f9ab2fa7344e38358bc6229e7e0b973b7b7fba04848336010db
+	sha256sums_x86_64 = cd2e4fd9ec931d963b7015bc990d90e8cd255dcc7d559653b691b705beaeec84
 	source_aarch64 = https://download.anydesk.com/rpi/anydesk-8.1.0-arm64.tar.gz
-	sha256sums_aarch64 = 900000b49f97e66643fc98f688be2b09c8e6744f78a8a4e5a75a0575369a9b6a
+	sha256sums_aarch64 = 974926fd87bac35a0bfe3dabb82ea81cc25ce2ec1236aa0c7bd324004230aa12
 
 pkgname = anydesk-bin

Comment

The change only bumps pkgrel from 1 to 2 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or package contents. No security-relevant behavior is introduced by this diff.

@@ -1,7 +1,7 @@
 # Maintainer: Nico <d3sox at protonmail dot com>
 pkgname=anydesk-bin
 pkgver=8.1.0
-pkgrel=1
+pkgrel=2
 pkgdesc="The Fast Remote Desktop Application"
 arch=('x86_64' 'aarch64')
 url="https://anydesk.com"

Comment

The change only updates the pinned SHA-256 checksums for the official AnyDesk release tarballs and bumps pkgrel. Source URLs remain HTTPS and point to the vendor’s download host, with no new build steps, scripts, or privilege-related changes. I don’t see any added attack surface in this diff; the main effect is to accept a different upstream artifact for the same version, which is normal when upstream re-spins release archives.

@@ -13,8 +13,8 @@ provides=('anydesk')
 options=('!strip')
 source_x86_64=("https://download.anydesk.com/linux/anydesk-${pkgver}-amd64.tar.gz")
 source_aarch64=("https://download.anydesk.com/rpi/anydesk-${pkgver}-arm64.tar.gz")
-sha256sums_x86_64=('22615f1ac8aa4f9ab2fa7344e38358bc6229e7e0b973b7b7fba04848336010db')
-sha256sums_aarch64=('900000b49f97e66643fc98f688be2b09c8e6744f78a8a4e5a75a0575369a9b6a')
+sha256sums_x86_64=('cd2e4fd9ec931d963b7015bc990d90e8cd255dcc7d559653b691b705beaeec84')
+sha256sums_aarch64=('974926fd87bac35a0bfe3dabb82ea81cc25ce2ec1236aa0c7bd324004230aa12')
 
 package() {
     # install binary