Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2. This is a metadata-only rebuild indicator and does not alter sources, build commands, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = awesome-git
 	pkgdesc = Highly configurable framework window manager
 	pkgver = 4.3.1735.gfa805ab46
-	pkgrel = 1
+	pkgrel = 2
 	url = https://awesomewm.org/
 	arch = i686
 	arch = x86_64

Comment

The change only swaps a runtime dependency from `lua-lgi` to `lua-lgi-git` in `.SRCINFO`. This is a metadata-only update, but it weakens supply-chain hygiene by moving from a versioned package to a VCS package, which is typically less pinned and may track moving upstream state. I do not see any direct code execution, privilege escalation, install-script, or packaging-path abuse in this diff hunk itself. Risk is low, but not zero because the dependency now relies on a git-based package whose own integrity depends on its packaging.

@@ -19,7 +19,7 @@ pkgbase = awesome-git
 	depends = libxdg-basedir
 	depends = libxkbcommon-x11
 	depends = lua
-	depends = lua-lgi
+	depends = lua-lgi-git
 	depends = pango
 	depends = startup-notification
 	depends = xcb-util-cursor

Comment

The change only swaps the runtime dependency from the official repo package `lua-lgi` to `lua-lgi-git` (with the original line commented out). That is a supply-chain hygiene regression because it replaces a pinned, packaged dependency with a VCS-based AUR dependency that is not pinned here and may track moving upstream state. However, this PKGBUILD diff itself does not introduce direct code execution, downloads, privilege escalation, or install-script behavior. Risk is limited to increased trust in an unpinned external dependency rather than an immediate malicious payload in this change.

@@ -10,13 +10,16 @@
 _pkgname=awesome
 pkgname=${_pkgname}-git
 pkgver=4.3.1735.gfa805ab46
-pkgrel=1
+pkgrel=2
 pkgdesc='Highly configurable framework window manager'
 arch=('i686' 'x86_64')
 url='https://awesomewm.org/'
 license=('GPL2')
 depends=('cairo' 'dbus' 'gdk-pixbuf2' 'libxdg-basedir' 'libxkbcommon-x11'
-         'lua' 'lua-lgi' 'pango' 'startup-notification' 'xcb-util-cursor'
+         'lua'
+		 #'lua-lgi'
+		 'lua-lgi-git'
+		 'pango' 'startup-notification' 'xcb-util-cursor'
          'xcb-util-keysyms' 'xcb-util-wm' 'xcb-util-xrm' 'libxfixes')
 makedepends=('asciidoctor' 'cmake' 'docbook-xsl' 'git' 'imagemagick' 'ldoc'
              'xmlto')