Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 21.1.2 to 22. No source URLs, checksums, build commands, install scripts, permissions, or dependency metadata are altered here. By itself this does not introduce a security concern; any risk would depend on the corresponding PKGBUILD/source changes, which are outside this reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = aurutils
 	pkgdesc = helper tools for the arch user repository
-	pkgver = 21.1.2
+	pkgver = 22
 	pkgrel = 1
 	url = https://github.com/AladW/aurutils
 	install = aurutils.install

Comment

The change only bumps the upstream source tarball from aurutils 21.1.2 to 22 on the official GitHub release archive URL, still over HTTPS and with the checksum line unchanged in .SRCINFO. There are no new sources, scripts, patches, or build/install behavior introduced by this diff, so no additional supply-chain or execution risk is evident from the metadata change alone. The only caveat is that the checksum should be verified against the actual PKGBUILD/source update, but within this .SRCINFO-only diff there is no security issue.

@@ -23,7 +23,7 @@ pkgbase = aurutils
 	optdepends = git-delta: view-delta example script
 	optdepends = python-srcinfo: sync-rebuild example script
 	optdepends = expect: non-interactive usage
-	source = aurutils-21.1.2.tar.gz::https://github.com/AladW/aurutils/archive/refs/tags/21.1.2.tar.gz
+	source = aurutils-22.tar.gz::https://github.com/AladW/aurutils/archive/refs/tags/22.tar.gz
 	sha256sums = 463d904d5d591b590cb04dcd16ee5acaf19c30144b3a6f8adc082492354693ef
 
 pkgname = aurutils

Comment

The only change in the provided hunk is a version bump from 21.1.2 to 22 in PKGBUILD. No source URLs, build steps, install scripts, permissions, dependencies, or packaging logic are altered in this diff, so there is no new security risk visible from the reviewed change alone. I did not inspect unrelated files beyond what is necessary for context, and nothing in this hunk suggests malicious behavior or integrity issues.

@@ -3,7 +3,7 @@
 # Co-Maintainer: zoorat <zoorat [at] protonmail [dot] com>
 
 pkgname=aurutils
-pkgver=21.1.2
+pkgver=22
 pkgrel=1
 pkgdesc='helper tools for the arch user repository'
 url='https://github.com/AladW/aurutils'

Comment

The change is only a changelog update documenting fixes already made elsewhere; it does not alter build logic, sources, install scripts, or shipped executable behavior. No new attack surface or integrity risk is introduced by this file alone.

@@ -1,3 +1,48 @@
+## 22
+
+* `aur-build`
+  + check the signature of the database file (`<name>.db.sig`)
+  + pass `--dbext` to `aur-repo`
+  + resolve the `--pool` directory
+
+* `aur-depends`
+  + do not report a complete tree as out of range
+    (`AUR_DEPENDS_CALLBACK_MAX`)
+
+* `aur-fetch`
+  + update local clones of the AUR mirror (`AUR_FETCH_USE_MIRROR`, #1278)
+  + `fetch--mirror`: check that `AUR_ROOT` is a bare repository
+
+* `aur-format`
+  + parse the format once
+
+* `aur-graph`
+  + quote versions passed to `vercmp` (#1275)
+    - a dependency version in `.SRCINFO` could run commands
+
+* `aur-pkglist`
+  + check for download errors, keep the cached list (#1276)
+  + run `--verify` in `AUR_METADEST`
+
+* `aur-repo`
+  + `repo-filter`: warn if no terminal is available (#1276)
+  + `repo-filter`: fix usage message
+
+* `aur-sync`
+  + inspect build files before verifying dependencies (#1277)
+    - `aur-view` is run before `aur-graph` and `--auto-key-retrieve`
+    - build files are presented in the order of `aur-depends`
+  + do not pass keys to `gpg` as options (`--auto-key-retrieve`)
+  + return an error if the ninja build fails (`AUR_SYNC_USE_NINJA`)
+  + resolve a relative `AURDEST`
+
+* `completions`
+  + fix override for subcommands with a hyphen (bash)
+
+* `make`
+  + fix `.PHONY` targets in `completions` and `perl`
+  + do not create an `aurutils` directory in the source tree on install
+
 ## 21.1
 
 * `aur-build`