Review Results

Comment

The change only reorders and adds dependency metadata in .SRCINFO to match the PKGBUILD; it does not introduce new build steps, network fetches, scripts, or privilege-related behavior. No security-relevant functionality is changed by this metadata-only update.

@@ -13,7 +13,21 @@ pkgbase = aseprite
 	makedepends = gn
 	makedepends = harfbuzz-icu
 	makedepends = clang>=22
+	depends = cmark
+	depends = curl
+	depends = giflib
+	depends = libjpeg-turbo
+	depends = zlib
+	depends = libpng
+	depends = tinyxml2>=11.0.0
+	depends = freetype2
+	depends = libwebp
+	depends = libarchive
+	depends = fmt
 	depends = libglvnd
+	depends = expat
+	depends = harfbuzz
+	depends = libgl
 	depends = hicolor-icon-theme
 	depends = fontconfig
 	depends = libxcursor

Comment

The change only reorders dependency entries in .SRCINFO and removes/reattaches a few runtime depends for pkgname=aseprite. There are no source URL, checksum, build-script, install-script, or permission changes, and no evidence of added code execution or persistence behavior. This is a metadata-only update with no security impact apparent from the diff.

@@ -54,11 +68,6 @@ pkgbase = aseprite
 	sha256sums = de5762bd0913eb4d27c91d79dca2b2c216c7b53b7ac20b6c653fa96e7823f154
 
 pkgname = aseprite
-	depends = libglvnd
-	depends = hicolor-icon-theme
-	depends = fontconfig
-	depends = libxcursor
-	depends = libxrandr
 	depends = cmark
 	depends = curl
 	depends = giflib

Comment

The change only adds four runtime dependencies in .SRCINFO: hicolor-icon-theme, fontconfig, libxcursor, and libxrandr. This is a metadata-only update with no evidence of code execution, privilege escalation, network access, or packaging integrity issues. The added dependencies are standard desktop/X11 libraries and do not appear suspicious in this context.

@@ -74,6 +83,10 @@ pkgname = aseprite
 	depends = expat
 	depends = harfbuzz
 	depends = libgl
+	depends = hicolor-icon-theme
+	depends = fontconfig
+	depends = libxcursor
+	depends = libxrandr
 	depends = libcurl.so
 	depends = libgif.so
 	depends = libjpeg.so

Comment

The change is low risk. It moves runtime package dependencies from package() into the top-level depends array, which is the correct PKGBUILD pattern, and does not introduce new sources, network fetches, privilege escalation, or install-script behavior. The only notable change is adding cmark/curl/giflib/etc. as explicit runtime deps and keeping the shared-library deps in package(); this affects packaging metadata but not execution flow. I do not see any supply-chain or backdoor indicators in this diff hunk.

@@ -18,7 +18,15 @@ pkgdesc='Create animated sprites and pixel art'
 arch=('x86_64')
 url="https://www.aseprite.org/"
 license=('LicenseRef-Aseprite-EULA')
-depends=(libglvnd
+depends=(# ~ Aseprite's direct dependencies ~
+         # pixman is not linked to because we use Skia instead
+         # harfbuzz is linked statically because Aseprite expects an older version
+         cmark curl giflib libjpeg-turbo zlib libpng 'tinyxml2>=11.0.0' freetype2
+         libwebp libarchive fmt libglvnd
+         # ~ Skia deps ~
+         # (Skia links dynamically to HarfBuzz, only Aseprite itself doesn't. >_<)
+         expat harfbuzz libgl
+         # Already required by Aseprite: libjpeg-turbo libpng zlib freetype2
 		 hicolor-icon-theme # For installing Aseprite's icons
          # These two are only reported by Namcap, but don't seem to be direct dependencies?
          fontconfig libxcursor

Comment

The change is a packaging-only refactor: it moves runtime dependency declarations from package() into the global depends array and removes a stray closing parenthesis. No new sources, downloads, scripts, permissions, or execution paths are introduced. The dependency list itself is unchanged in substance, so there is no evident security impact from this diff.

@@ -31,8 +39,7 @@ makedepends=(# "Meta" dependencies
              # Skia
              gn harfbuzz-icu
              # Upstream recommends using clang
-             'clang>=22'
-             )
+             'clang>=22')
 source=("https://github.com/aseprite/aseprite/releases/download/v$pkgver/Aseprite-v$pkgver-Source.zip"
         # Which branch a given build of Aseprite requires is noted in its `INSTALL.md`
         "skia-$_skiaver.tar.gz::https://github.com/aseprite/skia/archive/refs/tags/$_skiaver-$_skiahash.tar.gz"

Comment

The change only trims the package() dependency list, removing several explicit runtime dependencies from depends+=(...) while keeping the shared-library SONAME requirements. I do not see any new code execution, network access, privilege escalation, or packaging behavior changes. The main effect is metadata hygiene: the package may now rely more on transitive dependencies from the build environment, but that is not a security issue in itself. No suspicious sources, scripts, or unit files are introduced by this diff.

@@ -165,18 +172,9 @@ check() {
 }
 
 package() {
-	depends+=(# ~ Aseprite's direct dependencies ~
-         # pixman is not linked to because we use Skia instead
-         # harfbuzz is linked statically because Aseprite expects an older version
-         cmark curl giflib libjpeg-turbo zlib libpng 'tinyxml2>=11.0.0' freetype2
-         libwebp libarchive fmt libglvnd
-         # ~ Skia deps ~
-         # (Skia links dynamically to HarfBuzz, only Aseprite itself doesn't. >_<)
-         expat harfbuzz libgl
-         # Already required by Aseprite: libjpeg-turbo libpng zlib freetype2
-         libcurl.so libgif.so libjpeg.so libfreetype.so libarchive.so libfmt.so
-         libwebp.so libwebpmux.so libwebpdemux.so libjpeg.so libexpat.so=1-64 libharfbuzz.so=0-64
-         libfontconfig.so)
+	depends+=(libcurl.so libgif.so libjpeg.so libfreetype.so libarchive.so libfmt.so
+			  libwebp.so libwebpmux.so libwebpdemux.so libjpeg.so libexpat.so=1-64 libharfbuzz.so=0-64
+			  libfontconfig.so)
 	export CXX=clang++
 	export CC=clang
 	export CXXFLAGS+=" -std=c++11 -stdlib=libstdc++"