Review Results

Comment

The change is a straightforward version bump in .SRCINFO for NVIDIA beta utilities, updating the upstream download URL, checksum, and virtual provides/dependency versions. I do not see any new sources, build-time network behavior, privilege escalation, persistence mechanisms, or other suspicious packaging metadata introduced by this diff. The package still points to the official NVIDIA download host over HTTPS and the checksum was updated accordingly. Risk is low because this is only metadata synchronization, not a functional build script or install hook change.

@@ -1,12 +1,12 @@
 pkgbase = nvidia-utils-beta
 	pkgdesc = NVIDIA drivers utilities (beta version)
-	pkgver = 615.78.08
+	pkgver = 620.70.06
 	pkgrel = 1
 	url = https://www.nvidia.com/
 	arch = x86_64
 	license = LicenseRef-NVIDIA-Driver-License-Agreement
 	options = !strip
-	source = https://us.download.nvidia.com/XFree86/Linux-x86_64/615.78.08/NVIDIA-Linux-x86_64-615.78.08.run
+	source = https://us.download.nvidia.com/XFree86/Linux-x86_64/620.70.06/NVIDIA-Linux-x86_64-620.70.06.run
 	source = nvidia-drm-outputclass.conf
 	source = nvidia-utils.conf
 	source = nvidia-utils.sysusers

Comment

This change only updates .SRCINFO metadata for a new NVIDIA beta release: versioned source URL, checksums, and provided package versions. The source remains HTTPS and points to the official NVIDIA download host, with no new build-time code or packaging logic introduced. I did not see any suspicious dependency, install-script, or patch changes in this diff; the accompanying patch is a simple desktop Exec path fix and does not add execution or persistence behavior. Overall this is a routine version bump with low security risk.

@@ -16,7 +16,7 @@ pkgbase = nvidia-utils-beta
 	source = 10-gsk.conf
 	source = gsk-renderer.sh
 	source = 120-nvidia-settings-change-desktop-paths.patch
-	sha256sums = 3e3f6dddc2ee767a08185300af7be3cb286ece76698d2dde3524599782d07ffe
+	sha256sums = 29118e3abd08c07559bcca3d9c76238d039490af0362a2e5bcfcbe7204afd4b1
 	sha256sums = be99ff3def641bb900c2486cce96530394c5dc60548fc4642f19d3a4c784134d
 	sha256sums = 8ed91802c2a2d5b46c0692c624caf01dcde62a885dc617dda6694f4666de4c8e
 	sha256sums = f77a5247a3ba63e9fad3a3b2822d0fcfa51e0f79b5a90bd79bf08ea34b64ab07

Comment

The change only updates .SRCINFO metadata to match a newer NVIDIA beta version in the provides fields. There are no build-script, source, install-script, or privilege-related changes in this hunk, and nothing suggests network access, persistence, or integrity issues. This is routine package metadata maintenance.

@@ -44,11 +44,11 @@ pkgname = nvidia-utils-beta
 	optdepends = opencl-nvidia-beta: for OpenCL support
 	optdepends = xorg-server: for Xorg support
 	optdepends = xorg-server-devel: for nvidia-xconfig
-	provides = nvidia-utils=615.78.08
+	provides = nvidia-utils=620.70.06
 	provides = vulkan-driver
 	provides = opengl-driver
-	provides = nvidia-libgl=615.78.08
-	provides = nvidia-libgl-beta=615.78.08
+	provides = nvidia-libgl=620.70.06
+	provides = nvidia-libgl-beta=620.70.06
 	conflicts = nvidia-utils
 	conflicts = nvidia-libgl
 	replaces = nvidia-libgl

Comment

This is a straightforward version bump in .SRCINFO for NVIDIA beta utilities and related virtual provides/dependency constraints. The source URL remains the official NVIDIA download host over HTTPS, and the checksum was updated accordingly. No new sources, scripts, install hooks, or packaging behavior changes are introduced by this diff. The only security-relevant effect is metadata alignment with the new upstream release, so risk is minimal.

@@ -57,7 +57,7 @@ pkgname = opencl-nvidia-beta
 	pkgdesc = OpenCL implemention for NVIDIA (beta version)
 	depends = glibc
 	optdepends = opencl-headers: headers necessary for OpenCL development
-	provides = opencl-nvidia=615.78.08
+	provides = opencl-nvidia=620.70.06
 	provides = opencl-driver
 	conflicts = opencl-nvidia
 

Comment

This is a metadata-only version bump in .SRCINFO for nvidia-settings-beta, updating the dependency and provided version from 615.78.08 to 620.70.06. There are no changes to source URLs, build commands, install scripts, permissions, or package contents in the reviewed hunk, and nothing here introduces network access, privilege escalation, or persistence behavior. The change appears to simply keep package metadata aligned with a newer NVIDIA beta release.

@@ -72,9 +72,9 @@ pkgname = nvidia-settings-beta
 	depends = hicolor-icon-theme
 	depends = libx11
 	depends = libxext
-	depends = nvidia-utils-beta>=615.78.08
+	depends = nvidia-utils-beta>=620.70.06
 	depends = pango
 	depends = wayland
-	provides = nvidia-settings=615.78.08
-	provides = nvidia-settings-beta=615.78.08
+	provides = nvidia-settings=620.70.06
+	provides = nvidia-settings-beta=620.70.06
 	conflicts = nvidia-settings

Comment

The change is a routine upstream version bump in PKGBUILD plus updated checksum and two additional NVIDIA-shipped DLSS-related files installed from the vendor .run archive. The source remains the official NVIDIA HTTPS download URL, there are no new build-time network fetches, no shell execution changes, and no install-script/systemd/persistence logic added. The new files are installed into /usr/lib and /usr/lib/nvidia/wine like the rest of the vendor blobs, so the security posture is unchanged aside from trusting the new upstream release contents, which is expected for this package.

@@ -5,7 +5,7 @@
 
 pkgbase=nvidia-utils-beta
 pkgname=('nvidia-utils-beta' 'opencl-nvidia-beta' 'nvidia-settings-beta')
-pkgver=615.78.08
+pkgver=620.70.06
 pkgrel=1
 pkgdesc='NVIDIA drivers utilities (beta version)'
 arch=('x86_64')

Comment

The change is low risk. It updates the package version and checksum to a new NVIDIA beta release and adds packaging of two additional upstream DLSS-related files into /usr/lib and /usr/lib/nvidia/wine. I did not see any new build-time network access, privilege escalation, persistence, or suspicious install-script behavior in the reviewed hunk. The new files are installed from the already-verified upstream .run payload, so this looks like a routine upstream content update rather than a supply-chain concern.

@@ -23,7 +23,7 @@ source=("https://us.download.nvidia.com/XFree86/Linux-${CARCH}/${pkgver}/${_pkg}
         '10-gsk.conf'
         'gsk-renderer.sh'
         '120-nvidia-settings-change-desktop-paths.patch')
-sha256sums=('3e3f6dddc2ee767a08185300af7be3cb286ece76698d2dde3524599782d07ffe'
+sha256sums=('29118e3abd08c07559bcca3d9c76238d039490af0362a2e5bcfcbe7204afd4b1'
             'be99ff3def641bb900c2486cce96530394c5dc60548fc4642f19d3a4c784134d'
             '8ed91802c2a2d5b46c0692c624caf01dcde62a885dc617dda6694f4666de4c8e'
             'f77a5247a3ba63e9fad3a3b2822d0fcfa51e0f79b5a90bd79bf08ea34b64ab07'

Comment

The change adds two additional NVIDIA DLSS/NGX runtime artifacts to the package payload: a new shared library and a Wine DLL from the extracted upstream driver bundle. This is a packaging-only inclusion of files already coming from the signed NVIDIA .run source, with no new network access, scripts, privilege changes, or install-time execution. I do not see evidence in this diff of persistence, backdoors, or integrity bypass beyond the usual trust placed in the upstream binary blob source.

@@ -216,7 +216,9 @@ package_nvidia-utils-beta() {
     # NGX / DLSS
     install -D -m755 nvidia-ngx-updater -t "${pkgdir}/usr/bin"
     install -D -m755 "libnvidia-ngx.so.${pkgver}" -t "${pkgdir}/usr/lib"
+    install -D -m755 libnvidia-ngx-builtin-dlssd.so.310.9.0 -t "${pkgdir}/usr/lib"
     install -D -m644 {,_}nvngx.dll -t "${pkgdir}/usr/lib/nvidia/wine"
+    install -D -m644 ngx-builtins/nvngx_dlssd.dll -t "${pkgdir}/usr/lib/nvidia/wine"
     
     # Optical flow
     install -D -m755 "libnvidia-opticalflow.so.${pkgver}" -t "${pkgdir}/usr/lib"