Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 23.5.0-2 to 24.0.0-1. There are no changes to source URLs, checksums, install scripts, dependencies, or packaging logic visible in the provided diff, so no new security concern is introduced by this metadata-only update. I did not see evidence of suspicious sources, build-time network access, privilege escalation, or persistence mechanisms in the reviewed hunk.

@@ -1,7 +1,7 @@
 pkgbase = asterisk
 	pkgdesc = A complete PBX solution
-	pkgver = 23.5.0
-	pkgrel = 2
+	pkgver = 24.0.0
+	pkgrel = 1
 	url = https://www.asterisk.org
 	arch = x86_64
 	arch = i686

Comment

The change only updates .SRCINFO metadata to track a new upstream release tarball (23.5.0 -> 24.0.0), resets pkgrel, and updates the corresponding checksum. The source remains an HTTPS download from the official Asterisk site, with no new sources, scripts, patches, or build logic introduced in this diff. Based on the provided hunk alone, there are no obvious supply-chain or privilege-escalation concerns.

@@ -135,12 +135,12 @@ pkgbase = asterisk
 	backup = etc/asterisk/voicemail.conf
 	backup = etc/asterisk/websocket_client.conf
 	backup = etc/asterisk/xmpp.conf
-	source = https://downloads.asterisk.org/pub/telephony/asterisk/releases/asterisk-23.5.0.tar.gz
+	source = https://downloads.asterisk.org/pub/telephony/asterisk/releases/asterisk-24.0.0.tar.gz
 	source = asterisk.sysusers
 	source = asterisk.logrotated
 	source = asterisk.tmpfiles
 	source = fix-upnp.patch
-	sha256sums = 8ed3a237e6d8dff94a09527a83143530b5afcc1aee73fa7b85c069bda507adac
+	sha256sums = ece42a75bc965180007c56b03f2fd1dc8484eb84fc4cddc090db0ee5d5da1af9
 	sha256sums = 38a53911647fb2308482179cba605ebf12345df37eed23eb4ea67bf0bf041486
 	sha256sums = b97dc10a262621c95e4b75e024834712efd58561267b59b9171c959ecd9f7164
 	sha256sums = 1b6b489d4f71015bfc56ce739d92df7e9abdb349aed6f5a47dd9c18d84546c1b

Comment

The change only bumps the package version from 23.5.0-2 to 24.0.0-1 and does not alter sources, build steps, install scripts, permissions, or package metadata beyond the version/release numbers. Based on the provided diff hunk, there are no new supply-chain, persistence, privilege-escalation, or integrity red flags introduced by this change.

@@ -7,8 +7,8 @@
 # Contributor: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 
 pkgname=asterisk
-pkgver=23.5.0
-pkgrel=2
+pkgver=24.0.0
+pkgrel=1
 pkgdesc='A complete PBX solution'
 arch=(x86_64 i686 aarch64 armv7h)
 url=https://www.asterisk.org

Comment

The change is a straightforward version bump of the upstream Asterisk tarball from 23.5.0 to 24.0.0, with the source checksum updated accordingly. The source URL remains the official HTTPS upstream download site, and there are no new build-time commands, network fetches, privilege escalations, or packaging-script changes in this hunk. Based on the diff provided, I do not see a security issue introduced here.

@@ -147,7 +147,7 @@ source=("https://downloads.asterisk.org/pub/telephony/$pkgname/releases/$_archiv
         "$pkgname.logrotated"
         "$pkgname.tmpfiles"
         "fix-upnp.patch")
-sha256sums=('8ed3a237e6d8dff94a09527a83143530b5afcc1aee73fa7b85c069bda507adac'
+sha256sums=('ece42a75bc965180007c56b03f2fd1dc8484eb84fc4cddc090db0ee5d5da1af9'
             '38a53911647fb2308482179cba605ebf12345df37eed23eb4ea67bf0bf041486'
             'b97dc10a262621c95e4b75e024834712efd58561267b59b9171c959ecd9f7164'
             '1b6b489d4f71015bfc56ce739d92df7e9abdb349aed6f5a47dd9c18d84546c1b'