Review Results

Comment

The change only bumps pkgrel in .SRCINFO from 11 to 12, with no source, build, dependency, install-script, or packaging logic changes. This is a metadata-only update and does not introduce any new security-relevant behavior.

@@ -1,7 +1,7 @@
 pkgbase = compiz
 	pkgdesc = Composite manager for Aiglx and Xgl, with plugins and CCSM
 	pkgver = 0.9.14.2
-	pkgrel = 11
+	pkgrel = 12
 	url = https://launchpad.net/compiz
 	arch = i686
 	arch = x86_64

Comment

The change switches the package from a fixed release tarball to a pinned git checkout at a specific commit, which is acceptable from an integrity standpoint because it is still commit-pinned over HTTPS. The added `git` makedepend is expected for VCS sources, and adding `gtk3` as a runtime dependency is not inherently suspicious. I do note that the `.SRCINFO` diff removes several previously listed patch sources and checksums, but since this review is limited to the metadata change and not the PKGBUILD/patch contents, there is no direct evidence here of malicious behavior or build-time network fetching beyond the pinned upstream git source. Overall this looks like a packaging update rather than a security issue.

@@ -11,11 +11,13 @@ pkgbase = compiz
 	makedepends = boost
 	makedepends = cmake
 	makedepends = cython
+	makedepends = git
 	makedepends = intltool
 	makedepends = ninja
 	makedepends = python-setuptools
 	depends = glibmm
 	depends = glu
+	depends = gtk3
 	depends = libice
 	depends = libnotify
 	depends = libsm

Comment

Risk is low but non-zero. The change switches the package source from a fixed release tarball to a git checkout pinned to a specific commit, which is acceptable from an integrity standpoint because it is still commit-pinned over HTTPS and not a floating branch. The added makedepends on git is expected for VCS sources, and the dependency addition on gtk3 is consistent with the new source set. I do note that the .SRCINFO now omits several previously listed patch sources and their checksums, but since this review is limited to the metadata diff and not the PKGBUILD/patch contents, there is no direct evidence of malicious behavior. Overall this looks like a packaging update rather than a security issue.

@@ -45,25 +47,17 @@ pkgbase = compiz
 	conflicts = compizconfig-python
 	conflicts = libcompizconfig
 	conflicts = simple-ccsm
-	source = compiz-0.9.14.2.tar.xz::https://launchpad.net/compiz/0.9.14/0.9.14.2/+download/compiz-0.9.14.2.tar.xz
+	source = compiz::git+https://git.launchpad.net/compiz#commit=ff7ff00fb3c4f771fd8caf98bb568837f58f0c0a
 	source = 0001-reverse-unity-config.patch
 	source = 0002-focus-prevention-disable.patch
 	source = 0003-gtk-extents.patch
 	source = 0004-screenshot-launch-fix.patch
 	source = 0005-no-compile-gschemas.patch
-	source = 0006-Drop-toggle-shaded-since-it-s-no-longer-included-in-.patch
-	source = 0007-64-bit-time-t-compat.patch
-	source = 1001-fix-crash-in-vertexbuffer.patch
-	source = 1002-fix-wrapmode.patch
-	sha256sums = cfa061e93b032275ff9e7041f582a8f6d5ae271cf8a89e6bc74e3d3635999d3c
+	sha256sums = 4acc9a911c9a1e9b30ca1a1af8426d71bab194824bc37b0edb37dd81a45470e0
 	sha256sums = 6ec9c04540ca1649c687d9ab2c8311caea7075831e2cffe719ec7958c9ebab7b
 	sha256sums = f4897590b0f677ba34767a29822f8f922a750daf66e8adf47be89f7c2550cf4b
 	sha256sums = 16ddb6311ce42d958505e21ca28faae5deeddce02cb558d55e648380274ba4d9
 	sha256sums = 89ee91a8ea6b1424ef76661ea9a2db43412366aacddc12d24a7adf5e04bfbc61
 	sha256sums = 4ab3277da201314b3f65e30128bc30704ddee584fdbbfc8d0d83c7e0de91fa9a
-	sha256sums = 9b9e92a7174f2255f408d340dcb7b765211777cd92fe9ed17b5888ff13578291
-	sha256sums = 90969b7beba107a7146b11c3a60969b62c2be7a3e891d7dee913504ec6de759c
-	sha256sums = 859dca15821fac3b8d1e231d48932c0fad3f5d3f16cb53a8a761df2bd51b9d3a
-	sha256sums = 9d107c0f15462e281d341e8b2e94830ba8f39b87c3cf4b853791537a10b20253
 
 pkgname = compiz

Comment

Risk is low. The change switches the package from a release tarball to a pinned Launchpad git commit over HTTPS, which is an integrity improvement rather than a downgrade. The commit is pinned to an exact hash, so it is not floating. The added build dependency on git is expected for a VCS source. The only notable packaging changes are adding gtk3 to depends and adjusting a cmake path via sed; neither introduces network access, privilege escalation, persistence, or suspicious install-time behavior. No .install, systemd, sudoers, or patch contents in this diff suggest malicious behavior.

@@ -5,10 +5,12 @@
 ## options
 : ${_build_sodeps:=false}
 
+: ${_commit:=ff7ff00fb3c4f771fd8caf98bb568837f58f0c0a} # 0.9.14.2.r25
+
 _pkgname='compiz'
 pkgname="$_pkgname"
 pkgver=0.9.14.2
-pkgrel=11
+pkgrel=12
 pkgdesc="Composite manager for Aiglx and Xgl, with plugins and CCSM"
 url="https://launchpad.net/compiz"
 arch=('i686' 'x86_64')

Comment

The only change in the reviewed hunk is adding `gtk3` to `depends`. This is a normal runtime dependency adjustment for a GUI package and does not introduce any new code execution, network access, privilege escalation, or packaging integrity concerns. No suspicious sources, install scripts, or permission changes are implicated by this diff hunk.

@@ -21,6 +23,7 @@ license=(
 depends=(
   'glibmm'
   'glu'
+  'gtk3'
   'libice'
   'libnotify'
   'libsm'

Comment

The only change in this hunk is adding `git` to makedepends. In the surrounding PKGBUILD, the package source has already been switched to a pinned `git+https://git.launchpad.net/compiz#commit=...` checkout, so `git` is a reasonable build dependency for fetching/verifying that source. There are no new execution paths, install-time hooks, privilege changes, or additional untrusted sources introduced by this specific line. Risk is therefore minimal.

@@ -37,6 +40,7 @@ makedepends=(
   'boost'
   'cmake'
   'cython'
+  'git'
   'intltool'
   'ninja'
   'python-setuptools'

Comment

The change switches the package source from a tarball release download to a pinned git checkout over HTTPS, which is acceptable from an integrity standpoint because it uses a specific commit hash. The added git dependency is expected for fetching VCS sources. I do not see any new network-at-build-time behavior beyond the declared source, no privilege escalation, and no suspicious install-script or systemd changes in the provided diff. The only notable risk is that moving to a VCS source can reduce reproducibility compared with a release tarball, but the commit is pinned and the rest of the packaging changes are routine.

@@ -73,10 +77,10 @@ conflicts=(
   'simple-ccsm'
 )
 
-_pkgsrc="$_pkgname-${pkgver%%.r*}"
+_pkgsrc="$_pkgname"
 _pkgext="tar.xz"
 source=(
-  "$_pkgsrc.$_pkgext"::"https://launchpad.net/$_pkgname/${pkgver:0:6}/${pkgver%%.r*}/+download/$_pkgsrc.$_pkgext"
+  "$_pkgsrc"::"git+https://git.launchpad.net/compiz#commit=$_commit"
 
   # Reverse Unity specific configuration patches
   "0001-reverse-unity-config.patch"

Comment

The change switches the package from a fixed upstream tarball to a pinned git checkout at a specific commit, which is acceptable from an integrity standpoint because it is still commit-pinned over HTTPS. The removed patches and checksum entries reduce the source set rather than adding new attack surface. The only notable packaging change is adding a small sed fix in prepare() and adjusting patch application to the checked-out source tree; neither introduces network access, privilege escalation, or installation outside pkgdir. I do not see evidence of malicious behavior or supply-chain risk in this diff.

@@ -92,35 +96,17 @@ source=(
 
   # Don't try to compile gschemas during make install
   "0005-no-compile-gschemas.patch"
-
-  # New upstream patches
-  "0006-Drop-toggle-shaded-since-it-s-no-longer-included-in-.patch"
-  "0007-64-bit-time-t-compat.patch"
-
-  # https://bugs.launchpad.net/compiz/+bug/2060620
-  "1001-fix-crash-in-vertexbuffer.patch"
-
-  # https://bugs.launchpad.net/compiz/+bug/2103951
-  "1002-fix-wrapmode.patch"
 )
 sha256sums=(
-  'cfa061e93b032275ff9e7041f582a8f6d5ae271cf8a89e6bc74e3d3635999d3c'
-
+  '4acc9a911c9a1e9b30ca1a1af8426d71bab194824bc37b0edb37dd81a45470e0'
   '6ec9c04540ca1649c687d9ab2c8311caea7075831e2cffe719ec7958c9ebab7b'
   'f4897590b0f677ba34767a29822f8f922a750daf66e8adf47be89f7c2550cf4b'
   '16ddb6311ce42d958505e21ca28faae5deeddce02cb558d55e648380274ba4d9'
   '89ee91a8ea6b1424ef76661ea9a2db43412366aacddc12d24a7adf5e04bfbc61'
   '4ab3277da201314b3f65e30128bc30704ddee584fdbbfc8d0d83c7e0de91fa9a'
-  '9b9e92a7174f2255f408d340dcb7b765211777cd92fe9ed17b5888ff13578291'
-  '90969b7beba107a7146b11c3a60969b62c2be7a3e891d7dee913504ec6de759c'
-
-  '859dca15821fac3b8d1e231d48932c0fad3f5d3f16cb53a8a761df2bd51b9d3a'
-  '9d107c0f15462e281d341e8b2e94830ba8f39b87c3cf4b853791537a10b20253'
 )
 
 prepare() {
-  cd "$_pkgsrc"
-
   local src
   for src in "${source[@]}"; do
     src="${src%%::*}"

Comment

The change switches the package from a released tarball with multiple integrity-checked patch files to a git checkout pinned to a specific commit, which is acceptable in principle, but it also removes several upstream bugfix patches and changes the patch application target to the source tree. I do not see direct evidence of malicious behavior, network fetches at build time, privilege escalation, or installation outside pkgdir. The new sed edit only rewrites a CMake module path, and the build flag change appears to be a packaging workaround rather than a security issue. Overall this looks like a normal packaging update with some integrity tradeoffs from moving to VCS source, but no high-confidence security problem in the reviewed hunk.

@@ -128,26 +114,23 @@ prepare() {
     src="${src%.zst}"
     if [[ $src == *.patch ]]; then
       printf '\nApplying patch: %s\n' "$src"
-      patch -Np1 -F100 -i "${srcdir:?}/$src"
+      patch -d "$_pkgsrc" -Np1 -F100 -i "${srcdir:?}/$src"
     fi
   done
 
-  # adjust declarations
-  sed -E \
-    -e 's&^(destroy_(bare|normal|switcher)_frame)\s?.*;$&\1 (decor_frame_t *frame);&' \
-    -i "gtk/window-decorator/gtk-window-decorator.h"
+  # fix cmake path
+  sed -E -e 's&(/share/cmake)-\S+/&\1/Modules/&' -i "$_pkgsrc/cmake/base.cmake"
 }
 
 build() {
-  export CXXFLAGS+=" -Wno-error=incompatible-pointer-types"
-
   local _cmake_options=(
     -B build
     -S "$_pkgsrc"
     -G Ninja
     -DCMAKE_BUILD_TYPE=None
     -DCMAKE_INSTALL_PREFIX='/usr'
-    -DCMAKE_CXX_STANDARD=17
+    -Wno-author
+
     -DBUILD_GTK=ON
     -DBUILD_METACITY=ON
     -DCOMPIZ_BUILD_TESTING=OFF

Comment

The reviewed hunk only removes the CMake warning suppression flag `-Wno-dev` from the build options. This does not introduce new code execution, network access, privilege escalation, or packaging integrity issues. At most it may surface developer warnings during build, but it has no security impact on the package contents or install behavior.

@@ -156,7 +139,6 @@ build() {
     -DCOMPIZ_DISABLE_SCHEMAS_INSTALL=ON
     -DCOMPIZ_PACKAGING_ENABLED=ON
     -DCOMPIZ_WERROR=OFF
-    -Wno-dev
   )
 
   cmake "${_cmake_options[@]}"