Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2026.3 to 2026.3.0.1. No source URLs, build commands, dependencies, install scripts, or packaging behavior changed in the reviewed diff. While the URL field still uses HTTP in the existing metadata, that is pre-existing and not introduced by this change. No new security concern is evident from this version-only update.

@@ -1,6 +1,6 @@
 pkgbase = clion
 	pkgdesc = Cross-platform IDE for C and C++ from JetBrains.
-	pkgver = 2026.3
+	pkgver = 2026.3.0.1
 	pkgrel = 1
 	epoch = 1
 	url = http://www.jetbrains.com/clion

Comment

The change is a straightforward version bump in .SRCINFO for JetBrains CLion, updating the noextract/source filenames and their SHA256 checksums. The download URLs remain on the official JetBrains HTTPS domain, there are no new build steps, scripts, or privilege-related artifacts introduced, and no suspicious metadata changes (e.g., provides/conflicts, install scripts, or extra sources). This appears low risk and consistent with a normal upstream release update.

@@ -8,15 +8,15 @@ pkgbase = clion
 	arch = aarch64
 	license = custom
 	makedepends = rsync
-	noextract = CLion-2026.3.tar.gz
-	noextract = CLion-2026.3-aarch64.tar.gz
+	noextract = CLion-2026.3.0.1.tar.gz
+	noextract = CLion-2026.3.0.1-aarch64.tar.gz
 	options = !strip
 	source = jetbrains-clion.desktop
 	sha256sums = a7a3f9891f5d8e7e5650afe00819909413fa2ed911393dd0648fba91233974a2
-	source_x86_64 = https://download.jetbrains.com/cpp/CLion-2026.3.tar.gz
-	sha256sums_x86_64 = 136b6c22c984cc31734480ce4acf12f6af5b4838653af216601032f21cd35382
-	source_aarch64 = https://download.jetbrains.com/cpp/CLion-2026.3-aarch64.tar.gz
-	sha256sums_aarch64 = 680f05467148412fc80747311b535a0f4d11223e8550e0225fb8fb6973e947c4
+	source_x86_64 = https://download.jetbrains.com/cpp/CLion-2026.3.0.1.tar.gz
+	sha256sums_x86_64 = 72610a58b9526dd83ab66b885b216eb20b87a1bac3a0bc0571f0abd072a20d8e
+	source_aarch64 = https://download.jetbrains.com/cpp/CLion-2026.3.0.1-aarch64.tar.gz
+	sha256sums_aarch64 = 672ae4f6ea1bae9e999e090cdeea37bccf2492bcd0ad70e1c8f8c1149a9d4111
 
 pkgname = clion
 	depends = libdbusmenu-glib

Comment

The change only bumps CLion to a new upstream release version and updates the corresponding SHA-256 checksums for the official JetBrains download URLs. There are no new sources, no build-script changes, no added network activity beyond the existing release tarball downloads, and no packaging logic changes that would introduce persistence or privilege escalation. Risk is low and limited to the usual trust in upstream release artifacts.

@@ -9,7 +9,7 @@ pkgbase=clion
 pkgname=(clion clion-jre clion-cmake clion-gdb clion-lldb)
 _pkgname=clion
 _dlname=CLion
-pkgver=2026.3
+pkgver=2026.3.0.1
 pkgrel=1
 epoch=1
 pkgdesc="Cross-platform IDE for C and C++ from JetBrains."

Comment

The change only updates the SHA-256 checksums for the upstream JetBrains CLion tarballs on x86_64 and aarch64. The source URLs remain HTTPS and point to the official JetBrains download host, with no new build steps, scripts, or packaging logic introduced. This is a normal integrity-pin refresh and does not add any obvious security risk by itself.

@@ -22,8 +22,8 @@ source=("jetbrains-${pkgbase}.desktop")
 source_x86_64=("https://download.jetbrains.com/cpp/${_dlname}-${pkgver}.tar.gz")
 source_aarch64=("https://download.jetbrains.com/cpp/${_dlname}-${pkgver}-aarch64.tar.gz")
 sha256sums=('a7a3f9891f5d8e7e5650afe00819909413fa2ed911393dd0648fba91233974a2')
-sha256sums_x86_64=('136b6c22c984cc31734480ce4acf12f6af5b4838653af216601032f21cd35382')
-sha256sums_aarch64=('680f05467148412fc80747311b535a0f4d11223e8550e0225fb8fb6973e947c4')
+sha256sums_x86_64=('72610a58b9526dd83ab66b885b216eb20b87a1bac3a0bc0571f0abd072a20d8e')
+sha256sums_aarch64=('672ae4f6ea1bae9e999e090cdeea37bccf2492bcd0ad70e1c8f8c1149a9d4111')
 noextract=("${_dlname}-${pkgver}.tar.gz"
            "${_dlname}-${pkgver}-aarch64.tar.gz")