Review Results

Comment

The .SRCINFO update is a routine version bump from 12.0.0 to 13.0.1 with the upstream URL moved to the GitHub project page and the VCS source pinned to the new release tag. The added checkdepends are standard audio encoder/test dependencies and do not introduce suspicious fetches or execution paths. I do note the dependency rename from gcc-libs to libgcc, but that is a packaging metadata change rather than a security issue in this diff. No red flags for supply-chain integrity, privilege escalation, or persistence mechanisms are present in the reviewed hunk.

@@ -1,12 +1,21 @@
 pkgbase = flacon
 	pkgdesc = An Audio File Encoder. Extracts audio tracks from an audio CD image to separate tracks.
-	pkgver = 12.0.0
+	pkgver = 13.0.1
 	pkgrel = 1
-	url = https://flacon.github.io/
+	url = https://github.com/flacon/flacon
 	arch = x86_64
 	arch = i686
 	arch = aarch64
-	license = LGPL2.1
+	license = LGPL-2.1-or-later
+	checkdepends = alacenc
+	checkdepends = faac
+	checkdepends = flac
+	checkdepends = lame
+	checkdepends = mac
+	checkdepends = opus-tools
+	checkdepends = sox
+	checkdepends = vorbis-tools
+	checkdepends = wavpack
 	makedepends = git
 	makedepends = cmake
 	makedepends = icu

Comment

The only substantive change in the provided hunk is replacing `gcc-libs` with `libgcc` in `.SRCINFO`. This is a dependency metadata update and does not introduce code execution, network access, privilege escalation, or packaging-path issues. The rest of the diff shown by context is a version/source metadata refresh, but per the instruction to judge only the provided hunk, there is no security concern here.

@@ -17,7 +26,7 @@ pkgbase = flacon
 	depends = uchardet
 	depends = taglib
 	depends = glibc
-	depends = gcc-libs
+	depends = libgcc
 	optdepends = alacenc: For ALAC support
 	optdepends = faac: For AAC support
 	optdepends = flac: For FLAC support

Comment

The change is a straightforward version bump in .SRCINFO from v12.0.0 to v13.0.1, with the source still pinned to an HTTPS GitHub tag. The added checkdepends and metadata updates are normal packaging adjustments, and there are no signs of new build-time network fetches, scripts, privilege escalation, or suspicious sources in this diff. I do note that .SRCINFO alone is metadata and should match PKGBUILD, but nothing in this change suggests a security issue.

@@ -28,7 +37,7 @@ pkgbase = flacon
 	optdepends = ttaenc: For TrueAudio support
 	optdepends = vorbis-tools: For OGG support
 	optdepends = wavpack: For WavPack support
-	source = git+https://github.com/flacon/flacon.git#tag=v12.0.0
-	sha256sums = 027158f731462f75fdd6af2a890d8f6cdeec55c9587df5df7ddb830e424e6339
+	source = git+https://github.com/flacon/flacon.git#tag=v13.0.1
+	sha256sums = f21f89e95d653a84a07a6900984d0082f8334afca90a1a2e68f20bf04b1525c2
 
 pkgname = flacon

Comment

Low risk. The change updates the package to a new upstream release, switches the homepage to the upstream GitHub repo, and adjusts dependency naming from gcc-libs to libgcc. The build still fetches a pinned git tag over HTTPS, and there are no added install scripts, patches, privilege escalation, or suspicious network/download behavior in build/package. The only notable packaging concern is that the explicit -DUSE_QT6=ON flag was removed while qt6-base remains a dependency; that looks like a potential build break or feature regression, not a security issue. No high-confidence supply-chain or persistence red flags are present in this diff.

@@ -4,35 +4,72 @@
 # Contributor: Artem Sereda <overmind88 at gmail dot com>
 
 pkgname=flacon
-pkgver=12.0.0
+pkgver=13.0.1
 pkgrel=1
 pkgdesc="An Audio File Encoder. Extracts audio tracks from an audio CD image to separate tracks."
 arch=(x86_64 i686 aarch64)
-url="https://flacon.github.io/"
-license=(LGPL2.1)
-depends=(hicolor-icon-theme qt6-base uchardet taglib glibc gcc-libs)
-makedepends=(git cmake icu qt6-tools yaml-cpp)
+url="https://github.com/flacon/flacon"
+license=(LGPL-2.1-or-later)
+depends=(
+    hicolor-icon-theme
+    qt6-base
+    uchardet
+    taglib
+    glibc
+    libgcc
+    )
+makedepends=(
+    git
+    cmake
+    icu
+    qt6-tools
+    yaml-cpp
+    )
+checkdepends=(
+    alacenc
+    faac
+    flac
+    lame
+    mac
+    opus-tools
+    sox
+    #ttaenc
+    vorbis-tools
+    wavpack
+    )
 optdepends=(
-            'alacenc: For ALAC support'
-            'faac: For AAC support'
-            'flac: For FLAC support'
-            'lame: For MP3 support'
-            'mac: For APE support'
-            'opus-tools: For OPUS support'
-            'sox: For SoX support'
-            'ttaenc: For TrueAudio support'
-            'vorbis-tools: For OGG support'
-            'wavpack: For WavPack support'
-            )
+    'alacenc: For ALAC support'
+    'faac: For AAC support'
+    'flac: For FLAC support'
+    'lame: For MP3 support'
+    'mac: For APE support'
+    'opus-tools: For OPUS support'
+    'sox: For SoX support'
+    'ttaenc: For TrueAudio support'
+    'vorbis-tools: For OGG support'
+    'wavpack: For WavPack support'
+    )
 source=("git+https://github.com/flacon/flacon.git#tag=v${pkgver}")
-sha256sums=('027158f731462f75fdd6af2a890d8f6cdeec55c9587df5df7ddb830e424e6339')
+sha256sums=('f21f89e95d653a84a07a6900984d0082f8334afca90a1a2e68f20bf04b1525c2')
 
 build() {
+  # Disable warning Detected locale "C" with character encoding "ANSI_X3.4-1968", which is not UTF-8.
+  export LANG=C.UTF-8
+  export LC_ALL=C.UTF-8
+
+  # Disable all warnings
+  #export CFLAGS+=" -w"
+  #export CXXFLAGS+=" -w"
+
+  local _flags=(
+    -DUSE_QT5=OFF
+    #-DBUILD_TESTS=Yes
+  )
+
   cmake -B build -S "flacon" -Wno-dev \
     -DCMAKE_BUILD_TYPE=None \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DUSE_QT6=ON \
-    -DUSE_QT5=OFF
+    "${_flags[@]}"
 
   cmake --build build
 }