Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 2 to 3 with no source, checksum, dependency, install-script, or build-command changes. This is a metadata-only update and does not introduce any new security-relevant behavior in the package contents reviewed here.

@@ -1,7 +1,7 @@
 pkgbase = aseprite
 	pkgdesc = Create animated sprites and pixel art
 	pkgver = 1.3.17.2
-	pkgrel = 2
+	pkgrel = 3
 	url = https://www.aseprite.org/
 	arch = x86_64
 	license = LicenseRef-Aseprite-EULA

Comment

The change only removes a set of runtime dependencies from .SRCINFO; it does not add any new sources, scripts, or build steps. By itself this is not a security issue, though it may indicate packaging metadata drift if the PKGBUILD still installs or links against those libraries. I see no evidence here of malicious behavior, privilege escalation, or integrity compromise in the reviewed hunk.

@@ -13,21 +13,7 @@ pkgbase = aseprite
 	makedepends = gn
 	makedepends = harfbuzz-icu
 	makedepends = clang>=22
-	depends = cmark
-	depends = curl
-	depends = giflib
-	depends = libjpeg-turbo
-	depends = zlib
-	depends = libpng
-	depends = tinyxml2>=11.0.0
-	depends = freetype2
-	depends = libarchive
-	depends = fmt
-	depends = libwebp
 	depends = hicolor-icon-theme
-	depends = expat
-	depends = harfbuzz
-	depends = libgl
 	depends = fontconfig
 	depends = libxcursor
 	depends = libxrandr

Comment

The change only adds four runtime dependencies to .SRCINFO (hicolor-icon-theme, fontconfig, libxcursor, libxrandr). This is metadata-only and does not introduce new sources, build steps, install scripts, or privilege/network behavior. The added dependencies are standard X11/font runtime libraries consistent with a GUI application like Aseprite, so there is no security concern evident in this diff.

@@ -67,6 +53,10 @@ pkgbase = aseprite
 	sha256sums = de5762bd0913eb4d27c91d79dca2b2c216c7b53b7ac20b6c653fa96e7823f154
 
 pkgname = aseprite
+	depends = hicolor-icon-theme
+	depends = fontconfig
+	depends = libxcursor
+	depends = libxrandr
 	depends = cmark
 	depends = curl
 	depends = giflib

Comment

The diff only reorders/removes several runtime dependency declarations in .SRCINFO (hicolor-icon-theme, fontconfig, libxcursor, libxrandr) and adds libwebp earlier in the list. There are no signs of malicious behavior, code execution, network access, privilege escalation, or packaging integrity issues in this change itself. The impact is limited to metadata accuracy and possibly dependency resolution, not security-sensitive behavior.

@@ -75,16 +65,12 @@ pkgname = aseprite
 	depends = libpng
 	depends = tinyxml2>=11.0.0
 	depends = freetype2
+	depends = libwebp
 	depends = libarchive
 	depends = fmt
-	depends = libwebp
-	depends = hicolor-icon-theme
 	depends = expat
 	depends = harfbuzz
 	depends = libgl
-	depends = fontconfig
-	depends = libxcursor
-	depends = libxrandr
 	depends = libcurl.so
 	depends = libgif.so
 	depends = libjpeg.so

Comment

The change only moves dependency declarations from the top-level depends array into package(), while keeping the same packages/sonames overall. This does not introduce new sources, network access, privilege escalation, install-script behavior, or packaging side effects. The only notable effect is a pkgrel bump and a reorganization of dependency metadata, which is low risk.

@@ -13,21 +13,12 @@ pkgname=aseprite
 pkgver=1.3.17.2
 _skiaver=m124
 _skiahash=08a5439a6b
-pkgrel=2
+pkgrel=3
 pkgdesc='Create animated sprites and pixel art'
 arch=('x86_64')
 url="https://www.aseprite.org/"
 license=('LicenseRef-Aseprite-EULA')
-depends=(# ~ Aseprite's direct dependencies ~
-         # pixman is not linked to because we use Skia instead
-         # harfbuzz is linked statically because Aseprite expects an older version
-         cmark curl giflib libjpeg-turbo zlib libpng 'tinyxml2>=11.0.0' freetype2 libarchive fmt
-         libwebp
-         hicolor-icon-theme # For installing Aseprite's icons
-         # ~ Skia deps ~
-         # (Skia links dynamically to HarfBuzz, only Aseprite itself doesn't. >_<)
-         expat harfbuzz libgl
-         # Already required by Aseprite: libjpeg-turbo libpng zlib freetype2
+depends=(hicolor-icon-theme # For installing Aseprite's icons
          # These two are only reported by Namcap, but don't seem to be direct dependencies?
          fontconfig libxcursor
          # Required Dependency

Comment

The change only moves a set of runtime dependencies from the top-level depends array into package(), where they are appended to depends before packaging. This does not introduce new code execution, network access, privilege escalation, or persistence mechanisms. The added packages are ordinary Arch dependencies (including explicit soname deps) and the rest of the PKGBUILD logic is unchanged. No suspicious sources, patches, or install scripts are involved in this diff.

@@ -173,7 +164,16 @@ check() {
 }
 
 package() {
-	depends+=(libcurl.so libgif.so libjpeg.so libfreetype.so libarchive.so libfmt.so
+	depends+=(# ~ Aseprite's direct dependencies ~
+         # pixman is not linked to because we use Skia instead
+         # harfbuzz is linked statically because Aseprite expects an older version
+         cmark curl giflib libjpeg-turbo zlib libpng 'tinyxml2>=11.0.0' freetype2
+         libwebp libarchive fmt
+         # ~ Skia deps ~
+         # (Skia links dynamically to HarfBuzz, only Aseprite itself doesn't. >_<)
+         expat harfbuzz libgl
+         # Already required by Aseprite: libjpeg-turbo libpng zlib freetype2
+         libcurl.so libgif.so libjpeg.so libfreetype.so libarchive.so libfmt.so
          libwebp.so libwebpmux.so libwebpdemux.so libjpeg.so libexpat.so=1-64 libharfbuzz.so=0-64
          libfontconfig.so)
 	export CXX=clang++

Comment

The change only adds `fmt-12.2.0-include-format.patch` to `REUSE.toml`, which is a metadata file used for license compliance. I inspected the referenced patch and it contains straightforward include additions in C++ source files, with no build-script execution, network access, privilege changes, or packaging behavior changes. This does not introduce a security concern by itself.

@@ -34,6 +34,7 @@ path = [
     "shared-skia-deps.patch",
     "shared_libjpeg-turbo.patch",
     "change_use_of_removed_intrinsic.patch",
+    "fmt-12.2.0-include-format.patch",
     "LicenseRef-Aseprite-EULA.txt",
 ]
 SPDX-FileCopyrightText = "Aseprite contributors"