Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2. This is metadata-only and does not alter sources, build steps, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = openvino
 	pkgdesc = A toolkit for optimizing and deploying deep learning models
 	pkgver = 2026.2.1
-	pkgrel = 1
+	pkgrel = 2
 	url = https://docs.openvino.ai/
 	arch = x86_64
 	license = Apache-2.0

Comment

Risk score 0. This .SRCINFO-only change just bumps pkgrel, adds a new local patch source with a matching checksum, and removes redundant libstdc++ dependency declarations from generated metadata. I checked the referenced patch: it is a small one-line OpenCV API compatibility fix in a source file, with no network access, privilege changes, persistence mechanisms, or embedded binaries. No security-relevant behavior is introduced by this metadata update.

@@ -50,6 +50,7 @@ pkgbase = openvino
 	source = 010-openvino-change-install-paths.patch
 	source = 020-openvino-disable-werror.patch
 	source = 030-openvino-ignore-system-onnx.patch
+	source = 040-openvino-opencv5-fix.patch
 	validpgpkeys = 968479A1AFF927E37D1A566BB5690EEEBB952194
 	sha256sums = e5ef4309dc42382fbd70779e3db3f39dc18bab83cb42c061e9674dc9351a882c
 	sha256sums = SKIP

Comment

The change is low risk. It only updates .SRCINFO metadata to match the PKGBUILD: adds a new patch checksum/source entry and removes explicit libstdc++ dependency declarations that are no longer present in PKGBUILD. The added patch is a small source fix for an OpenCV API change, and there is no evidence of network access, privilege escalation, or other malicious packaging behavior in this diff. Risk is limited to normal packaging metadata synchronization.

@@ -78,11 +79,11 @@ pkgbase = openvino
 	sha256sums = fa1d3bc0b89fb36ef254b572958b806f76b37dac2faab53a148ba9db9cbffd0d
 	sha256sums = 07814fc576c6bced01c2d37e1f0d5c13f90ebb3c0e4fa404b3c5d367d83dc48c
 	sha256sums = 30835fc8bc6cfcb5c140fe66f473865e56fec6e2842da542d69cf03f4b34f904
+	sha256sums = e9ca24f135bf85606be18d0fb52f8a0702dc4ed82c10dd5de122e18be47df3c0
 
 pkgname = openvino
 	depends = glibc
 	depends = libgcc
-	depends = libstdc++
 	depends = onetbb
 	depends = pugixml
 	depends = snappy

Comment

The change only removes an explicit runtime dependency on libstdc++ from the openvino-intel-gpu-plugin package metadata in .SRCINFO. This does not introduce any new code execution, network access, privilege escalation, or packaging integrity concerns. At most it may affect dependency resolution, but it is not a security issue in itself.

@@ -97,7 +98,6 @@ pkgname = openvino-intel-gpu-plugin
 	depends = glibc
 	depends = intel-compute-runtime
 	depends = libgcc
-	depends = libstdc++
 	depends = ocl-icd
 	depends = onetbb
 	depends = openvino=2026.2.1

Comment

The change only removes an explicit runtime dependency on libstdc++ from the openvino-intel-npu-plugin package metadata in .SRCINFO. This does not introduce code execution, network access, privilege changes, or packaging integrity issues; it merely alters dependency declaration. I see no security impact from the diff itself.

@@ -109,7 +109,6 @@ pkgname = openvino-intel-npu-plugin
 	depends = intel-npu-compiler
 	depends = intel-npu-driver
 	depends = libgcc
-	depends = libstdc++
 	depends = onetbb
 	depends = opencv
 	depends = openvino=2026.2.1

Comment

The change only removes an explicit runtime dependency on libstdc++ from the python-openvino package metadata in .SRCINFO. This does not introduce any new code execution, network access, privilege changes, or packaging red flags. At worst it could affect dependency resolution on some systems, but it is not a security issue in itself.

@@ -119,7 +118,6 @@ pkgname = python-openvino
 	pkgdesc = Python bindings for OpenVINO
 	depends = glibc
 	depends = libgcc
-	depends = libstdc++
 	depends = openvino=2026.2.1
 	depends = python
 	depends = python-numpy

Comment

The patch is a one-line fix in a C++ source file inside an existing patch artifact. It only changes `out.size.dims()` to `out.size.dims`, which appears to be a compatibility/build fix for OpenCV 5 API differences. There are no added downloads, scripts, privilege changes, persistence mechanisms, or other security-relevant behaviors in this diff. Risk is effectively nil for this change alone.

@@ -0,0 +1,11 @@
+--- a/src/plugins/intel_npu/tools/protopipe/src/utils/utils.cpp
++++ b/src/plugins/intel_npu/tools/protopipe/src/utils/utils.cpp
+@@ -34,7 +34,7 @@ void generateRandom(cv::Mat& out) {
+         break;
+     case CV_16F: {
+         std::vector<int> dims;
+-        for (int i = 0; i < out.size.dims(); ++i) {
++        for (int i = 0; i < out.size.dims; ++i) {
+             dims.push_back(out.size[i]);
+         }
+         cv::Mat fp32_mat;

Comment

The change only bumps pkgrel from 1 to 2 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or package contents. No new security-relevant behavior is introduced by this diff hunk.

@@ -7,7 +7,7 @@ pkgname=(
     'openvino-intel-npu-plugin'
     'python-openvino')
 pkgver=2026.2.1
-pkgrel=1
+pkgrel=2
 _commit=ede283a88e35465f0d680dabbf1f44080f8fc387
 pkgdesc='A toolkit for optimizing and deploying deep learning models'
 arch=('x86_64')

Comment

The change is low risk. It only adds a local patch file to the source array, applies it in prepare(), and updates the checksum list. The patch is a small one-line OpenCV API compatibility fix in a utility source file (changing `out.size.dims()` to `out.size.dims`), with no network access, privilege changes, install-script behavior, or packaging-path changes introduced. The other PKGBUILD edits are just pkgrel bump and removal of redundant `libstdc++` depends, which do not create a security concern.

@@ -57,7 +57,8 @@ source=("git+https://github.com/openvinotoolkit/openvino.git#commit=${_commit}?s
         'git+https://github.com/herumi/xbyak_riscv.git'
         '010-openvino-change-install-paths.patch'
         '020-openvino-disable-werror.patch'
-        '030-openvino-ignore-system-onnx.patch')
+        '030-openvino-ignore-system-onnx.patch'
+        '040-openvino-opencv5-fix.patch')
 sha256sums=('e5ef4309dc42382fbd70779e3db3f39dc18bab83cb42c061e9674dc9351a882c'
             'SKIP'
             'SKIP'

Comment

The change is low risk. It adds a new patch to fix OpenCV 5 compatibility and updates the checksum list accordingly; the patch itself is a one-line source fix in a C++ loop bound and does not introduce new build-time downloads, shell execution, privilege changes, or packaging/persistence behavior. The rest of the diff only removes redundant libstdc++ runtime dependencies, which is not security-sensitive. No red flags in the added patch or surrounding PKGBUILD changes.

@@ -84,7 +85,8 @@ sha256sums=('e5ef4309dc42382fbd70779e3db3f39dc18bab83cb42c061e9674dc9351a882c'
             'SKIP'
             'fa1d3bc0b89fb36ef254b572958b806f76b37dac2faab53a148ba9db9cbffd0d'
             '07814fc576c6bced01c2d37e1f0d5c13f90ebb3c0e4fa404b3c5d367d83dc48c'
-            '30835fc8bc6cfcb5c140fe66f473865e56fec6e2842da542d69cf03f4b34f904')
+            '30835fc8bc6cfcb5c140fe66f473865e56fec6e2842da542d69cf03f4b34f904'
+            'e9ca24f135bf85606be18d0fb52f8a0702dc4ed82c10dd5de122e18be47df3c0')
 validpgpkeys=('968479A1AFF927E37D1A566BB5690EEEBB952194')
 
 export GIT_LFS_SKIP_SMUDGE='1'

Comment

Risk is low. The change only adds a new patch file to fix an OpenCV 5 API break (`out.size.dims()` -> `out.size.dims`) and bumps `pkgrel`. The patch content is a one-line source compatibility fix in an upstream tool source file, with no signs of network access, privilege escalation, persistence, or packaging-path abuse. I also checked the surrounding PKGBUILD context: the package still sources code from pinned HTTPS git commits and the new patch is shipped locally in the AUR package, not fetched at build time. No additional red flags are introduced by this diff.

@@ -126,6 +128,7 @@ prepare() {
     patch -d openvino -Np1 -i "${srcdir}/010-openvino-change-install-paths.patch"
     patch -d openvino -Np1 -i "${srcdir}/020-openvino-disable-werror.patch"
     patch -d openvino -Np1 -i "${srcdir}/030-openvino-ignore-system-onnx.patch"
+    patch -d openvino -Np1 -i "${srcdir}/040-openvino-opencv5-fix.patch"
     
     install -d -m755 {benchmark_app,licenses}
     install -d -m755 intel-gpu-plugin/usr/lib/openvino

Comment

The change only removes an explicit runtime dependency on libstdc++ from the package metadata. This does not introduce code execution, network access, privilege escalation, or packaging integrity issues. At most it could affect dependency resolution if the package truly needs libstdc++, but that is a correctness/packaging concern rather than a security risk.

@@ -179,7 +182,6 @@ package_openvino() {
     depends=(
         'glibc'
         'libgcc'
-        'libstdc++'
         'onetbb'
         'pugixml'
         'snappy')

Comment

The change only removes an explicit runtime dependency on libstdc++ from the openvino-intel-gpu-plugin package. This does not introduce code execution, network access, privilege changes, or packaging integrity issues. At worst it may affect dependency resolution on some systems, but it is not a security concern in this diff.

@@ -215,7 +217,6 @@ package_openvino-intel-gpu-plugin() {
         'glibc'
         'intel-compute-runtime'
         'libgcc'
-        'libstdc++'
         'ocl-icd'
         'onetbb'
         "openvino=${pkgver}"

Comment

The change removes `libstdc++` from the runtime dependencies of `openvino-intel-npu-plugin`. This is a packaging metadata adjustment only; it does not add code execution, network access, privilege escalation, or persistence mechanisms. I did not find any security-relevant behavior introduced by this diff hunk. The main impact would be potential runtime breakage on systems that no longer pull in `libstdc++` transitively, but that is a correctness/compatibility issue rather than a security issue.

@@ -232,7 +233,6 @@ package_openvino-intel-npu-plugin() {
         'intel-npu-compiler'
         'intel-npu-driver'
         'libgcc'
-        'libstdc++'
         'onetbb'
         'opencv'
         "openvino=${pkgver}"

Comment

The change removes an explicit runtime dependency on libstdc++ from the python-openvino subpackage. This is a packaging metadata adjustment only; it does not alter build steps, install scripts, sources, permissions, or introduce any execution/network behavior. I see no security impact from this diff alone.

@@ -247,7 +247,6 @@ package_python-openvino() {
     depends=(
         'glibc'
         'libgcc'
-        'libstdc++'
         "openvino=${pkgver}"
         'python'
         'python-numpy'