Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 17.13.0 to 17.14.1, with the source URL and sha256 updated accordingly. The source remains an HTTPS PyPI tarball, there are no new build-time commands, no added scripts, and no packaging metadata changes that suggest persistence, privilege escalation, or integrity bypass. Based on the diff provided, this looks like a routine release update with no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = ocrmypdf
 	pkgdesc = A tool to add an OCR text layer to scanned PDF files, allowing them to be searched
-	pkgver = 17.13.0
+	pkgver = 17.14.1
 	pkgrel = 1
 	url = https://github.com/ocrmypdf/OCRmyPDF
 	install = ocrmypdf.install

Comment

The change only updates the upstream source tarball version and its corresponding SHA-256 checksum in .SRCINFO. The source remains an HTTPS PyPI-hosted release tarball, with no new build steps, scripts, patches, or packaging metadata changes that would introduce execution, persistence, or integrity risks. This is a routine version bump with no security red flags in the diff provided.

@@ -31,7 +31,7 @@ pkgbase = ocrmypdf
 	depends = python-fpdf2
 	optdepends = jbig2enc: Better compression algorithm; results in smaller PDF files
 	optdepends = python-pillow-heif: HEIF/HEIC image support
-	source = https://files.pythonhosted.org/packages/source/o/ocrmypdf/ocrmypdf-17.13.0.tar.gz
-	sha256sums = 151c35d810eb628fbc5cb9bbe80b834ecf094737efa0e7a2e9e1fac3c730ed49
+	source = https://files.pythonhosted.org/packages/source/o/ocrmypdf/ocrmypdf-17.14.1.tar.gz
+	sha256sums = 77412e62f621f1d1dbf4a333b4ef76c7f70977b1cb2d1d1f2d8d1e85939c0bf7
 
 pkgname = ocrmypdf

Comment

The change is a version bump only, from 17.13.0 to 17.14.1, with no modifications to sources, build steps, install scripts, dependencies, or packaging logic in the provided diff hunk. On its face this introduces no new security-relevant behavior. I did not see any evidence in the reviewed hunk of network fetches, privilege escalation, persistence mechanisms, or integrity regressions.

@@ -5,7 +5,7 @@
 # Contributor: Daniel Reuter <daniel.robin.reuter@googlemail.com>
 
 pkgname=ocrmypdf
-pkgver=17.13.0
+pkgver=17.14.1
 pkgrel=1
 pkgdesc="A tool to add an OCR text layer to scanned PDF files, allowing them to be searched"
 url="https://github.com/ocrmypdf/OCRmyPDF"

Comment

The change only updates the pinned SHA-256 checksum for the upstream source tarball in PKGBUILD. The source URL remains HTTPS on files.pythonhosted.org, there are no new build steps, no additional sources, and no install-script or packaging logic changes. This is a routine integrity update consistent with a new upstream release tarball, with no evident security red flags in the diff provided.

@@ -17,7 +17,7 @@ depends=('python>=3.9' 'img2pdf' 'python-pillow' 'tesseract' 'ghostscript' 'unpa
 makedepends=('python-hatch-vcs' 'python-build' 'python-installer' 'python-wheel')
 optdepends=('jbig2enc: Better compression algorithm; results in smaller PDF files' 'python-pillow-heif: HEIF/HEIC image support')
 source=("https://files.pythonhosted.org/packages/source/${pkgname::1}/$pkgname/$pkgname-$pkgver.tar.gz")
-sha256sums=('151c35d810eb628fbc5cb9bbe80b834ecf094737efa0e7a2e9e1fac3c730ed49')
+sha256sums=('77412e62f621f1d1dbf4a333b4ef76c7f70977b1cb2d1d1f2d8d1e85939c0bf7')
 install="${pkgname}.install"
 
 build() {