Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 9.0.21 to 9.0.22. No sources, checksums, build steps, dependencies, install scripts, or packaging permissions are modified here, so there is no new security-relevant behavior introduced by this diff alone.

@@ -1,6 +1,6 @@
 pkgbase = seafile-client
 	pkgdesc = GUI client for synchronizing your local files with seafile server
-	pkgver = 9.0.21
+	pkgver = 9.0.22
 	pkgrel = 1
 	url = https://github.com/haiwen/seafile-client
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO: it updates the upstream tarball URL, the seafile dependency floor, and the corresponding SHA-256 checksums. The source remains an HTTPS GitHub release archive, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. I did not see any indication of malicious behavior in the metadata-only update.

@@ -11,14 +11,14 @@ pkgbase = seafile-client
 	license = Apache
 	makedepends = cmake
 	makedepends = qt6-tools
-	depends = seafile>=9.0.21
+	depends = seafile>=9.0.22
 	depends = qt6-base
 	depends = qt6-webengine
 	depends = qt6-5compat
 	optdepends = gtk-update-icon-cache
-	source = seafile-client-9.0.21.tar.gz::https://github.com/haiwen/seafile-client/archive/v9.0.21.tar.gz
+	source = seafile-client-9.0.22.tar.gz::https://github.com/haiwen/seafile-client/archive/v9.0.22.tar.gz
 	source = fix_build_with_QT6.diff
-	sha256sums = a074031607c3a7948ff37fe2b4ac7d9653128a2f0edc5a1ba5797afb5870dd31
-	sha256sums = 3b07339e4cd5f453d4cbec400201daa35c5813761f241b56793aab553362c068
+	sha256sums = e69acbff805a25d2e6b7a3bc3cb4a107f61d6e61d38e538018f0f0d6dbb5c836
+	sha256sums = 6ceef1cb14af8ce3d06e17df67d0a80e5a22f3cd982792e517b7d85e8b695509
 
 pkgname = seafile-client

Comment

The change only bumps pkgver from 9.0.21 to 9.0.22 and updates the corresponding source and patch checksums. The source remains an HTTPS GitHub release tarball, there are no new build steps, no added network access, and no packaging/persistence red flags introduced by this diff. I did not see any suspicious metadata changes or install-script/unit changes in the reviewed hunk.

@@ -4,7 +4,7 @@
 # Contributor: Edvinas Valatka <edacval@gmail.com>
 
 pkgname=seafile-client
-pkgver=9.0.21
+pkgver=9.0.22
 pkgrel=1
 pkgdesc='GUI client for synchronizing your local files with seafile server'
 arch=('i686' 'x86_64' 'armv7h' 'armv6h' 'aarch64')

Comment

The change is a routine version bump in PKGBUILD plus updated SHA-256 checksums for the two declared source artifacts. No new sources, no build-script logic changes, no network fetches, and no packaging/install-time behavior changes are introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -23,8 +23,8 @@ source=(
     'fix_build_with_QT6.diff'
 )
 sha256sums=(
-    'a074031607c3a7948ff37fe2b4ac7d9653128a2f0edc5a1ba5797afb5870dd31'
-    '3b07339e4cd5f453d4cbec400201daa35c5813761f241b56793aab553362c068'
+    'e69acbff805a25d2e6b7a3bc3cb4a107f61d6e61d38e538018f0f0d6dbb5c836'
+    '6ceef1cb14af8ce3d06e17df67d0a80e5a22f3cd982792e517b7d85e8b695509'
 )
 
 prepare() {

Comment

The change is limited to a build-system patch for Qt6 detection in CMakeLists.txt. It replaces a generic qmake lookup with qmake6 and uses that executable consistently when probing the Qt version. There are no added network fetches, install scripts, privilege changes, or packaging-time side effects. The removed hunk in the diff only drops unrelated source-file changes from this patch file, which does not introduce a security concern by itself. Overall this looks like a benign build compatibility fix with low risk.

@@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 2e578c01..d20eba55 100644
+index b6db0965..9a83f6b8 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
 @@ -133,14 +133,14 @@ ENDIF()

Comment

The change only removes a stale hunk from the local patch file `fix_build_with_QT6.diff`; the remaining content is a straightforward CMakeLists.txt adjustment for Qt6 detection. There are no added build-time downloads, no execution of external commands, no privilege changes, and no packaging/install-script behavior introduced by this diff. I do not see any security-relevant impact from deleting the `message-poller.cpp` include hunk from the patch artifact.

@@ -19,16 +19,3 @@ index 2e578c01..d20eba55 100644
      OUTPUT_VARIABLE QT_VERSION_MAJOR
      OUTPUT_STRIP_TRAILING_WHITESPACE)
  MESSAGE("QT_VERSION_MAJOR: ${QT_VERSION_MAJOR}")
-diff --git a/src/message-poller.cpp b/src/message-poller.cpp
-index 2ab32c50..4b9b3d87 100644
---- a/src/message-poller.cpp
-+++ b/src/message-poller.cpp
-@@ -1,6 +1,8 @@
- #include <QTimer>
- #include <QDateTime>
- #include <QJsonDocument>
-+#include <QJsonValue>
-+#include <QRegularExpression>
- 
- #include "utils/utils.h"
- #include "utils/translate-commit-desc.h"