Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 9.0.21 to 9.0.22. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust were changed in the reviewed diff. On its face this is a routine upstream version update with no security red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = seafile
 	pkgdesc = An online file storage and collaboration tool
-	pkgver = 9.0.21
+	pkgver = 9.0.22
 	pkgrel = 1
 	url = https://github.com/haiwen/seafile
 	arch = i686

Comment

Risk is low. The change only bumps the upstream release tarball from 9.0.21 to 9.0.22 and updates the corresponding SHA-256 checksum in .SRCINFO. The source remains the official GitHub release archive over HTTPS, with no new sources, scripts, build-time network access, or packaging/persistence changes introduced by this diff. No security red flags are evident in the metadata update itself.

@@ -19,9 +19,9 @@ pkgbase = seafile
 	depends = sqlite
 	provides = seafile-client-cli
 	conflicts = seafile-server
-	source = seafile-9.0.21.tar.gz::https://github.com/haiwen/seafile/archive/v9.0.21.tar.gz
+	source = seafile-9.0.22.tar.gz::https://github.com/haiwen/seafile/archive/v9.0.22.tar.gz
 	source = seaf-cli@.service
-	sha256sums = 10adb16e56ad366c36a2698fc81f41fe89a36d63c5d25512175f052ed60cc38d
+	sha256sums = ae62805813f156c474f5cc25993a4a9e4f1f1b2e0106d04ee95a4eff2d51c1d5
 	sha256sums = c37510109c1de64c774896df39aece240c056b54414d2119fca01860211156ba
 
 pkgname = seafile

Comment

The change is a simple version bump in PKGBUILD from 9.0.21 to 9.0.22 with no other packaging logic altered in the provided diff. There are no new sources, build steps, install scripts, permissions changes, or other security-relevant modifications visible in this hunk. Based on the reviewed change alone, I see no evidence of supply-chain risk or privilege/persistence issues.

@@ -4,7 +4,7 @@
 # Contributor: Aaron Lindsay <aaron@aclindsay.com>
 
 pkgname=seafile
-pkgver=9.0.21
+pkgver=9.0.22
 pkgrel=1
 pkgdesc='An online file storage and collaboration tool'
 arch=('i686' 'x86_64' 'armv7h' 'armv6h' 'aarch64')

Comment

The change is a straightforward version bump from 9.0.21 to 9.0.22 with an updated checksum for the upstream tarball. No new sources, no build-script changes, no added install hooks, and no suspicious packaging metadata changes are present in the reviewed hunk. Based on this diff alone, there are no evident security issues.

@@ -28,7 +28,7 @@ source=(
     "seaf-cli@.service"
 )
 sha256sums=(
-    '10adb16e56ad366c36a2698fc81f41fe89a36d63c5d25512175f052ed60cc38d'
+    'ae62805813f156c474f5cc25993a4a9e4f1f1b2e0106d04ee95a4eff2d51c1d5'
     'c37510109c1de64c774896df39aece240c056b54414d2119fca01860211156ba'
 )
 provides=('seafile-client-cli')