Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 12.34.4 to 12.35.2. No source URLs, checksums, install scripts, permissions, or packaging logic are altered here, so there is no direct security concern visible in this diff. Any risk would depend on the corresponding PKGBUILD/source update, which is not part of the provided change.

@@ -1,6 +1,6 @@
 pkgbase = postman-bin
 	pkgdesc = Build, test, and document your APIs faster
-	pkgver = 12.34.4
+	pkgver = 12.35.2
 	pkgrel = 1
 	url = https://www.getpostman.com
 	arch = x86_64

Comment

The change is a routine version bump in .SRCINFO for the packaged upstream tarballs, with HTTPS download URLs on the official Postman domain and updated SHA256 checksums. No new sources, scripts, install hooks, or privilege-related metadata were introduced. Based on the provided diff, this does not add any obvious supply-chain or persistence risk.

@@ -38,9 +38,9 @@ pkgbase = postman-bin
 	options = !strip
 	source = postman.desktop
 	sha256sums = d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d
-	source_x86_64 = postman-12.34.4-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.34.4/linux64
-	sha256sums_x86_64 = 31a177c057d0c92e4a8e229ec494859d37e1daa4f521f0d78ca35812f75708d2
-	source_aarch64 = postman-12.34.4-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.34.4/linux_arm64
-	sha256sums_aarch64 = 242d4497fc35d70f9a932adcbf7bcf0a2b26f0e4161209e755107714015d475f
+	source_x86_64 = postman-12.35.2-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.35.2/linux64
+	sha256sums_x86_64 = 1c35279a83f67cc544c8eb9a7342a2d5e78e4259f654191fc2c0c8de84d3386d
+	source_aarch64 = postman-12.35.2-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.35.2/linux_arm64
+	sha256sums_aarch64 = 3cf64e44669464b1e7cdc01fa618c8f514e6e29c74f7517a83b1dba0cb926d8b
 
 pkgname = postman-bin

Comment

The change is a straightforward version bump in PKGBUILD from 12.34.4 to 12.35.2 with no other modifications. Based on the provided diff hunk, there are no new sources, build steps, install scripts, permissions changes, or other security-relevant alterations. This appears low risk.

@@ -4,7 +4,7 @@
 # Contributor: Juan Francisco Miranda <aurarchlinux.sleek355 at passfwd dot com>
 
 pkgname=postman-bin
-pkgver=12.34.4
+pkgver=12.35.2
 pkgrel=1
 pkgdesc="Build, test, and document your APIs faster"
 provides=('postman')

Comment

The change only updates the pinned SHA-256 checksums for the upstream Postman release tarballs on x86_64 and aarch64. The source URLs remain HTTPS and point to the official Postman download host, with no new build steps, scripts, or packaging logic introduced. This is a routine integrity refresh and does not add any obvious supply-chain or privilege-escalation risk.

@@ -20,8 +20,8 @@ source_x86_64=("postman-${pkgver}-linux-${arch[0]}.tar.gz::https://dl.pstmn.io/d
 source_aarch64=("postman-${pkgver}-linux-${arch[1]}.tar.gz::https://dl.pstmn.io/download/version/${pkgver}/linux_arm64")
 
 sha256sums=('d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d')
-sha256sums_x86_64=('31a177c057d0c92e4a8e229ec494859d37e1daa4f521f0d78ca35812f75708d2')
-sha256sums_aarch64=('242d4497fc35d70f9a932adcbf7bcf0a2b26f0e4161209e755107714015d475f')
+sha256sums_x86_64=('1c35279a83f67cc544c8eb9a7342a2d5e78e4259f654191fc2c0c8de84d3386d')
+sha256sums_aarch64=('3cf64e44669464b1e7cdc01fa618c8f514e6e29c74f7517a83b1dba0cb926d8b')
 
 package() {
   install -dm755 "${pkgdir}/opt/"