Review Results

Comment

The change is a straightforward version bump in .SRCINFO from XnViewMP 1.12.2 to 1.12.3, with the source URL and checksum updated accordingly. The source remains HTTPS on the vendor’s download domain, there are no new build steps, scripts, patches, or privilege-related metadata changes, and no suspicious dependencies or packaging flags were introduced. Based on the provided diff alone, this looks like a routine upstream update with no evident security impact.

@@ -1,15 +1,15 @@
 pkgbase = xnviewmp
 	pkgdesc = An efficient multimedia viewer, browser and converter.
-	pkgver = 1.12.2
+	pkgver = 1.12.3
 	pkgrel = 1
 	url = https://www.xnview.com/en/xnviewmp/
 	arch = x86_64
 	license = custom
 	depends = qt6-multimedia
 	optdepends = glib2: support for moving files to trash
-	source = XnViewMP-linux-x64_1.12.2-rel1.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-1.12.2-linux-x64.tgz
+	source = XnViewMP-linux-x64_1.12.3-rel1.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-1.12.3-linux-x64.tgz
 	source = XnView.desktop
-	sha256sums = 66faa259a1377f5f055b089ea182b8596a0d495790778798b27d763344984e64
+	sha256sums = 54d86e4aaa5996c9a6be53e65b0cbb271d56b3e8d5b9d9b7e6df2917c91b5339
 	sha256sums = f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a
 
 pkgname = xnviewmp

Comment

The only change in this diff is a pkgver bump from 1.12.2 to 1.12.3. No build logic, sources, install scripts, permissions, or packaging behavior changed in the reviewed hunk, so there is no new security concern visible here. I did not inspect unrelated files beyond what is necessary for this single-line version update.

@@ -8,7 +8,7 @@
 # Contributor: Martin Poljak <martin 'at' poljak 'dot' cz>
 
 pkgname=xnviewmp
-pkgver=1.12.2
+pkgver=1.12.3
 srcrel=1 # Incremented when there is a new release for the same version number
 pkgrel=1
 pkgdesc="An efficient multimedia viewer, browser and converter."

Comment

The change only updates the SHA-256 checksum for the upstream tarball source in PKGBUILD. The source URL remains HTTPS and points to the vendor's download host, with no new build steps, scripts, or packaging logic introduced. This is a routine integrity update and does not add any obvious security risk by itself.

@@ -24,7 +24,7 @@ optdepends=('glib2: support for moving files to trash')
 
 source=("XnViewMP-linux-x64_${pkgver}-rel${srcrel}.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-${pkgver}-linux-x64.tgz"
         'XnView.desktop')
-sha256sums=('66faa259a1377f5f055b089ea182b8596a0d495790778798b27d763344984e64'
+sha256sums=('54d86e4aaa5996c9a6be53e65b0cbb271d56b3e8d5b9d9b7e6df2917c91b5339'
             'f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a')
 
 package() {