Review Results

Comment

The change is a routine version bump in .SRCINFO for the nvidia-beta package, updating pkgver/provides/dependency pins and the NVIDIA upstream installer URL/checksums. I do note the source URL remains HTTP rather than HTTPS, which is a supply-chain integrity concern in general, but this is not introduced by the change and the package already relied on the same pattern. No new build-time execution, install-script behavior, or packaging red flags are present in this diff alone. Overall this looks low risk.

@@ -1,23 +1,23 @@
 pkgbase = nvidia-beta
 	pkgdesc = NVIDIA kernel module (beta version)
-	pkgver = 615.78.08
+	pkgver = 620.70.06
 	pkgrel = 1
 	url = https://www.nvidia.com/
 	arch = x86_64
 	license = LicenseRef-Custom
 	makedepends = dkms
 	makedepends = linux-headers
-	provides = nvidia=615.78.08
-	provides = nvidia-beta=615.78.08
+	provides = nvidia=620.70.06
+	provides = nvidia-beta=620.70.06
 	provides = NVIDIA-MODULE
 	conflicts = nvidia
 	options = !strip
-	source = http://us.download.nvidia.com/XFree86/Linux-x86_64/615.78.08/NVIDIA-Linux-x86_64-615.78.08-no-compat32.run
+	source = http://us.download.nvidia.com/XFree86/Linux-x86_64/620.70.06/NVIDIA-Linux-x86_64-620.70.06-no-compat32.run
 	source = 110-nvidia-change-dkms-conf.patch
-	sha256sums = e9d5167f4ca67f58b2b3447584b1e4273218d5088aba210d3aef2a407e522892
-	sha256sums = 673dc16f8b2e962c8f2081fa57b4a4b2774f783205e6eb20120f3d0d1a42317e
+	sha256sums = 20894d898b83622e385dcfb934dbd656471f09e38822770cf4c9fea4112990f3
+	sha256sums = 9ea85d1d3250bb65923cbaa43b75cdfe91df09f358d13604f4fc176df23b7ac4
 
 pkgname = nvidia-beta
 	depends = libglvnd
 	depends = linux
-	depends = nvidia-utils-beta=615.78.08
+	depends = nvidia-utils-beta=620.70.06

Comment

The change is a one-line version bump inside a patch that updates a DKMS configuration variable from 615.78.08 to 620.70.06. There is no added code execution, no network access, no privilege escalation, and no packaging behavior change visible in this hunk. It only adjusts the expected NVIDIA driver version string, which is consistent with a normal package update.

@@ -3,7 +3,7 @@
 @@ -1,12 +1,21 @@
  PACKAGE_NAME="nvidia"
 -PACKAGE_VERSION="__VERSION_STRING"
-+PACKAGE_VERSION="615.78.08"
++PACKAGE_VERSION="620.70.06"
  AUTOINSTALL="yes"
  
  # By default, DKMS will add KERNELRELEASE to the make command line; however,

Comment

The change is a straightforward version bump of the NVIDIA beta package from 615.78.08 to 620.70.06, with corresponding checksum updates for the upstream .run installer and the local DKMS patch. The diff does not introduce new sources, network fetches, privilege escalation, install-script logic, or packaging behavior changes beyond consuming a newer upstream release. The only notable risk is the usual trust in a proprietary prebuilt NVIDIA installer and the fact that the source URL is HTTP rather than HTTPS, but that issue already existed in the package and is not introduced by this change. No new high-confidence security issue is present in the reviewed hunk.

@@ -4,7 +4,7 @@
 # Contributor: Dan Vratil
 
 pkgname=nvidia-beta
-pkgver=615.78.08
+pkgver=620.70.06
 pkgrel=1
 pkgdesc="NVIDIA kernel module (beta version)"
 arch=('x86_64')

Comment

The PKGBUILD change is limited to a version bump and checksum refresh, plus a patch update. The package still downloads the NVIDIA upstream .run installer over plain HTTP, which is a supply-chain weakness, but this is pre-existing and not introduced by this diff. The new patch only adjusts dkms.conf to hardcode the version, use nproc for parallelism, and enumerate the expected NVIDIA kernel modules; there is no added network access, privilege escalation, persistence, or suspicious install-time behavior in the reviewed hunk. Overall this looks like a routine upstream version update with no new high-confidence security issue in the change itself.

@@ -19,8 +19,8 @@ options=('!strip')
 _pkg="NVIDIA-Linux-${CARCH}-${pkgver}-no-compat32"
 source=("http://us.download.nvidia.com/XFree86/Linux-${CARCH}/${pkgver}/${_pkg}.run"
         '110-nvidia-change-dkms-conf.patch')
-sha256sums=('e9d5167f4ca67f58b2b3447584b1e4273218d5088aba210d3aef2a407e522892'
-            '673dc16f8b2e962c8f2081fa57b4a4b2774f783205e6eb20120f3d0d1a42317e')
+sha256sums=('20894d898b83622e385dcfb934dbd656471f09e38822770cf4c9fea4112990f3'
+            '9ea85d1d3250bb65923cbaa43b75cdfe91df09f358d13604f4fc176df23b7ac4')
 
 prepare() {
     # extract the source file