Version #1768 of xlibre-xserver · commit b1bd6a26f6d4 · status Reviewed
The only change in this .SRCINFO hunk is a pkgrel bump from 2 to 3. This is metadata-only and does not alter sources, build steps, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by this diff alone.
@@ -1,6 +1,6 @@
pkgbase = xlibre-xserver
pkgver = 25.1.8
- pkgrel = 2
+ pkgrel = 3
url = https://xlibre.net
arch = x86_64
groups = xlibre
This change only bumps pkgrel from 2 to 3 in PKGBUILD with no source, build, install, dependency, or script changes. There are no new execution paths, network fetches, privilege changes, or packaging red flags introduced by this diff. Risk is therefore minimal.
@@ -8,7 +8,7 @@ pkgbase=xlibre-xserver
pkgname=('xlibre-xserver' 'xlibre-xserver-xephyr' 'xlibre-xserver-xvfb'
'xlibre-xserver-xnest' 'xlibre-xserver-common' 'xlibre-xserver-devel')
pkgver=25.1.8
-pkgrel=2
+pkgrel=3
arch=('x86_64')
license=('LicenseRef-Adobe-Display-PostScript'
'BSD-3-Clause'
The change is low risk. It only adjusts which prebuilt configuration snippets are copied into the package, adding /usr/share/X11/xorg.conf.d/10-nvidia-modules.conf and removing an obsolete deletion in the -devel split. I did not see any new network access, privilege escalation, shell execution, or installation outside pkgdir. The added file is a distro-provided Xorg config snippet, not an external download or executable payload. The only concern is that shipping an additional NVIDIA-related config file can affect runtime behavior, but that is expected packaging content rather than a security issue.
@@ -121,7 +121,7 @@ package_xlibre-xserver() {
_install fakeinstall/usr/bin/{X,Xorg,gtf,Xfbdev}
_install fakeinstall/usr/lib/Xorg{,.wrap}
_install fakeinstall/usr/lib/xorg/modules/*
- _install fakeinstall/usr/share/X11/xorg.conf.d/10-{nvidia,quirks}.conf
+ _install fakeinstall/usr/share/X11/xorg.conf.d/10-{nvidia,nvidia-modules,quirks}.conf
_install fakeinstall/usr/share/man/man1/{Xorg,Xorg.wrap,gtf,Xfbdev}.1
_install fakeinstall/usr/share/man/man4/{exa,fbdevhw,inputtestdrv,modesetting}.4
_install fakeinstall/usr/share/man/man5/{Xwrapper.config,xorg.conf,xorg.conf.d}.5
The change is a one-line removal of a cleanup step in package_xlibre-xserver-devel(): it no longer deletes fakeinstall/usr/share/X11/xorg.conf.d/10-nvidia-modules.conf from the staged package contents. This is not an execution or privilege-escalation issue by itself, but it does alter packaged files and could cause an extra NVIDIA-related Xorg config snippet to be shipped unexpectedly. That is a packaging/integrity concern rather than a direct security vulnerability, and the risk appears low based on the diff alone.
@@ -194,7 +194,6 @@ package_xlibre-xserver-devel() {
rm fakeinstall/etc/X11/xorg.conf.d/10-nvidia-modules.conf.debian
rm fakeinstall/etc/X11/xorg.conf.d/10-nvidia.conf.debian
- rm fakeinstall/usr/share/X11/xorg.conf.d/10-nvidia-modules.conf
_install fakeinstall/usr/include/xorg/*
_install fakeinstall/usr/lib/pkgconfig/xlibre-server.pc