Review Results

Comment

The .SRCINFO change is limited to a version bump from 2.13.0 to 2.14.1 and a homepage URL update from https://geti2p.net to https://i2p.net. Both URLs are HTTPS and the new domain appears to be the project’s canonical site rather than a suspicious mirror or typosquat. No build logic, sources, install scripts, or packaging permissions are changed in this hunk, so there is no evident security impact from this diff alone.

@@ -1,8 +1,8 @@
 pkgbase = i2p
 	pkgdesc = A distributed anonymous network
-	pkgver = 2.13.0
+	pkgver = 2.14.1
 	pkgrel = 1
-	url = https://geti2p.net
+	url = https://i2p.net
 	install = i2p.install
 	arch = any
 	license = GPL2

Comment

The change is a straightforward metadata update in .SRCINFO for a new upstream release: it switches the source URL from the old i2p-projekt.de mirror to the official i2p.net release location, updates pkgver/url, and refreshes the source checksum. I don’t see any new build-time execution, install-script changes, or integrity regressions in this diff. The source remains HTTPS and the tarball is still accompanied by a detached signature and pinned PGP keys, so the supply-chain posture is unchanged or slightly improved.

@@ -14,8 +14,8 @@ pkgbase = i2p
 	conflicts = i2p-dev
 	options = !strip
 	backup = opt/i2p/wrapper.config
-	source = https://files.i2p-projekt.de/2.13.0/i2psource_2.13.0.tar.bz2
-	source = https://files.i2p-projekt.de/2.13.0/i2psource_2.13.0.tar.bz2.sig
+	source = https://files.i2p.net/2.14.1/i2psource_2.14.1.tar.bz2
+	source = https://files.i2p.net/2.14.1/i2psource_2.14.1.tar.bz2.sig
 	source = i2prouter.service
 	source = i2p.tmpfiles
 	source = wrapper.config

Comment

The .SRCINFO update is consistent with a routine upstream release bump: pkgver changes from 2.13.0 to 2.14.1, the project URL moves to the canonical i2p.net domain, and the source tarball/signature URLs are updated accordingly. The only substantive integrity change is the tarball SHA-256, which is expected for a new release. No suspicious new sources, build-time downloads, or privilege-related artifacts are introduced in this diff.

@@ -25,7 +25,7 @@ pkgbase = i2p
 	source = chromium-i2p.sh
 	validpgpkeys = 2D3D2D03910C6504C1210C65EE60C0C8EE7256A8
 	validpgpkeys = 70D2060738BEF80523ACAFF7D75C03B39B5E14E1
-	sha256sums = 4ea60401855d2dc3a0058b472829c9060291907bfe48c173c57dde6e7f5eb6ad
+	sha256sums = b9c73f27ca801cf77127dfcd9390356686862684a61a609ac000d652a62c7a71
 	sha256sums = SKIP
 	sha256sums = 644b771ec7f5db3efab3206bf1f896566cdb00d410a54608fda85bdb4c2ad876
 	sha256sums = fc30dd32f48fe1c93bf36c8297ca48203a1479e4e221ebe62c57cf3c3c0347d3

Comment

The change is a routine version bump and upstream URL update in PKGBUILD. It keeps HTTPS sources, uses the official i2p domain/files host, and does not introduce any new build-time execution, install scripts, patches, or privilege-related behavior. The only substantive changes are pkgver/pkgver checksum and source host/path updates, which are consistent with a normal upstream release refresh. No security red flags are evident in the provided diff.

@@ -5,10 +5,10 @@
 #export LG2=en
 
 pkgname=i2p
-pkgver=2.13.0
+pkgver=2.14.1
 pkgrel=1
 pkgdesc="A distributed anonymous network"
-url="https://geti2p.net"
+url="https://i2p.net"
 license=('GPL2')
 arch=('any')
 depends=('java-runtime>=17' 'java-service-wrapper')

Comment

The change only switches the upstream download host from files.i2p-projekt.de to files.i2p.net for the same versioned source tarball and signature. The URL remains HTTPS, the source filename and PGP verification setup are unchanged, and there is no added build-time execution, packaging logic, or integrity regression visible in this diff. I do not see any new supply-chain or persistence risk introduced by this host change alone.

@@ -25,7 +25,7 @@ options=(!strip)
 validpgpkeys=('2D3D2D03910C6504C1210C65EE60C0C8EE7256A8'
               '70D2060738BEF80523ACAFF7D75C03B39B5E14E1')
 
-_url="https://files.i2p-projekt.de/${pkgver}"
+_url="https://files.i2p.net/${pkgver}"
 #_url="https://launchpad.net/i2p/trunk/${pkgver}/+download"
 
 source=("${_url}/i2psource_${pkgver}.tar.bz2"{,.sig}

Comment

The change is a straightforward version bump from 2.13.0 to 2.14.1, along with updating the upstream website/source host and the source tarball checksum. No new build steps, scripts, patches, or privilege-related changes were introduced in the reviewed hunk. The source remains HTTPS and pinned to a release tarball with checksum verification, so there are no obvious supply-chain or execution red flags in this diff.

@@ -35,7 +35,7 @@ source=("${_url}/i2psource_${pkgver}.tar.bz2"{,.sig}
         #upstream.patch::'https://github.com/i2p/i2p.i2p/commit/6c0e18d3.patch'
 )
 
-sha256sums=('4ea60401855d2dc3a0058b472829c9060291907bfe48c173c57dde6e7f5eb6ad'
+sha256sums=('b9c73f27ca801cf77127dfcd9390356686862684a61a609ac000d652a62c7a71'
             'SKIP'
             '644b771ec7f5db3efab3206bf1f896566cdb00d410a54608fda85bdb4c2ad876'
             'fc30dd32f48fe1c93bf36c8297ca48203a1479e4e221ebe62c57cf3c3c0347d3'