Review Results

Comment

Risk is low. This change only renames the listed patch source filenames in .SRCINFO to match the package's prefixed patch files; it does not introduce new sources, network fetches, executable scripts, privilege changes, or packaging logic. The underlying source remains the same and the diff is metadata-only. No security-relevant issue is evident from this change alone.

@@ -21,14 +21,14 @@ pkgbase = esound
 	source = http://ftp.gnome.org/pub/GNOME/sources/esound/0.2/esound-0.2.41.tar.bz2
 	source = esound-system.service
 	source = esound-user.service
-	source = 0001-alsa-drain-hang.patch
-	source = 0002-undeclared-variable.patch
-	source = 0003-fix-audsp-crash.patch
-	source = 0004-link-to-libm.patch
-	source = 0005-missing-declaration-GCC-15.patch
-	source = 0006-revert-close-file-descriptors.patch
-	source = 0007-fix-wrong-micro-version.patch
-	source = 0008-move-nobeeps-to-the-default-options.patch
+	source = esound-0001-alsa-drain-hang.patch
+	source = esound-0002-undeclared-variable.patch
+	source = esound-0003-fix-audsp-crash.patch
+	source = esound-0004-link-to-libm.patch
+	source = esound-0005-missing-declaration-GCC-15.patch
+	source = esound-0006-revert-close-file-descriptors.patch
+	source = esound-0007-fix-wrong-micro-version.patch
+	source = esound-0008-move-nobeeps-option.patch
 	b2sums = 39403985557f44b99a6615e42f6772a31b8555cc3bf252140e36f55c812b4728ca7af519267ff1c8f4bd53604d82edbf682d07b16e98158ca39bbe8663bbaadd
 	b2sums = 1b55880c8212f2e85312c632ab79f1ff36d527c7463aa16fb932f324c496a5a67d109372aff657b59812b9fabe8c5978434e078e7a91868298731ab11ea48f2d
 	b2sums = b84310149765ca3caa7b0b93298af758b0ffbb04b16c3946b3fc8e0ad4e559d7f6221a956dd30a8f01a5e60d85386431078619b683e0d6a447bc1c9363a00e27

Comment

The change is a straightforward PKGBUILD maintenance update: it renames the local patch files in source=() and updates the corresponding patch paths in prepare(). I checked the newly referenced patch content (`esound-0008-move-nobeeps-option.patch`) and it is a normal config tweak moving `-nobeeps` from `spawn_options` to `default_options`; there is no evidence of added code execution, network access, privilege escalation, or packaging-path abuse. The only notable issue in the surrounding PKGBUILD remains the pre-existing HTTP upstream source URL, but that is unchanged by this diff. Overall this specific change is low risk.

@@ -22,15 +22,14 @@ backup=('etc/esd.conf')
 source=("http://ftp.gnome.org/pub/GNOME/sources/${pkgname}/${pkgver%.*}/${pkgname}-${pkgver}.tar.bz2"
         'esound-system.service'
         'esound-user.service'
-        '0001-alsa-drain-hang.patch'
-        '0002-undeclared-variable.patch'
-        '0003-fix-audsp-crash.patch'
-        '0004-link-to-libm.patch'
-        '0005-missing-declaration-GCC-15.patch'
-        '0006-revert-close-file-descriptors.patch'
-        '0007-fix-wrong-micro-version.patch'
-        '0008-move-nobeeps-to-the-default-options.patch'
-)
+        'esound-0001-alsa-drain-hang.patch'
+        'esound-0002-undeclared-variable.patch'
+        'esound-0003-fix-audsp-crash.patch'
+        'esound-0004-link-to-libm.patch'
+        'esound-0005-missing-declaration-GCC-15.patch'
+        'esound-0006-revert-close-file-descriptors.patch'
+        'esound-0007-fix-wrong-micro-version.patch'
+        'esound-0008-move-nobeeps-option.patch')
 b2sums=('39403985557f44b99a6615e42f6772a31b8555cc3bf252140e36f55c812b4728ca7af519267ff1c8f4bd53604d82edbf682d07b16e98158ca39bbe8663bbaadd'
         '1b55880c8212f2e85312c632ab79f1ff36d527c7463aa16fb932f324c496a5a67d109372aff657b59812b9fabe8c5978434e078e7a91868298731ab11ea48f2d'
         'b84310149765ca3caa7b0b93298af758b0ffbb04b16c3946b3fc8e0ad4e559d7f6221a956dd30a8f01a5e60d85386431078619b683e0d6a447bc1c9363a00e27'

Comment

The change only renames local patch files in source=() and the corresponding prepare() references. There is no new code execution, no new network fetch, and no change to package install behavior or privileges. I did not find any security-relevant impact in this diff; it is a straightforward filename consistency update.

@@ -46,14 +45,14 @@ b2sums=('39403985557f44b99a6615e42f6772a31b8555cc3bf252140e36f55c812b4728ca7af51
 prepare() {
   cd "${srcdir}/${pkgname}-${pkgver}"
 
-  patch -i "${srcdir}"/0001-alsa-drain-hang.patch
-  patch -i "${srcdir}"/0002-undeclared-variable.patch
-  patch -i "${srcdir}"/0003-fix-audsp-crash.patch
-  patch -i "${srcdir}"/0004-link-to-libm.patch
-  patch -i "${srcdir}"/0005-missing-declaration-GCC-15.patch
-  patch -i "${srcdir}"/0006-revert-close-file-descriptors.patch
-  patch -i "${srcdir}"/0007-fix-wrong-micro-version.patch
-  patch -i "${srcdir}"/0008-move-nobeeps-to-the-default-options.patch
+  patch -i "${srcdir}"/esound-0001-alsa-drain-hang.patch
+  patch -i "${srcdir}"/esound-0002-undeclared-variable.patch
+  patch -i "${srcdir}"/esound-0003-fix-audsp-crash.patch
+  patch -i "${srcdir}"/esound-0004-link-to-libm.patch
+  patch -i "${srcdir}"/esound-0005-missing-declaration-GCC-15.patch
+  patch -i "${srcdir}"/esound-0006-revert-close-file-descriptors.patch
+  patch -i "${srcdir}"/esound-0007-fix-wrong-micro-version.patch
+  patch -i "${srcdir}"/esound-0008-move-nobeeps-option.patch
 }
 
 build() {

Comment

The change only renames patch filenames in REUSE.toml to match the package’s current source layout. It does not alter build logic, introduce new sources, or change any executable content. No security-relevant behavior is affected by this metadata-only update.

@@ -14,28 +14,28 @@ SPDX-License-Identifier = "0BSD"
 
 [[annotations]]
 path = [
-  "0005-missing-declaration-GCC-15.patch",
-  "0006-revert-close-file-descriptors.patch",
-  "0007-fix-wrong-micro-version.patch",
-  "0008-move-nobeeps-to-the-default-options.patch",
+  "esound-0005-missing-declaration-GCC-15.patch",
+  "esound-0006-revert-close-file-descriptors.patch",
+  "esound-0007-fix-wrong-micro-version.patch",
+  "esound-0008-move-nobeeps-option.patch",
 ]
 SPDX-FileCopyrightText = "Arch Linux contributors"
 SPDX-License-Identifier = "GPL-2.0-or-later AND LGPL-2.0-or-later"
 
 [[annotations]]
-path = "0003-fix-audsp-crash.patch"
+path = "esound-0003-fix-audsp-crash.patch"
 SPDX-FileCopyrightText = "Debian contributors"
 SPDX-License-Identifier = "GPL-2.0-or-later AND LGPL-2.0-or-later"
 
 [[annotations]]
 path = [
-  "0001-alsa-drain-hang.patch",
-  "0004-link-to-libm.patch",
+  "esound-0001-alsa-drain-hang.patch",
+  "esound-0004-link-to-libm.patch",
 ]
 SPDX-FileCopyrightText = "Fedora contributors"
 SPDX-License-Identifier = "GPL-2.0-or-later AND LGPL-2.0-or-later"
 
 [[annotations]]
-path = "0002-undeclared-variable.patch"
+path = "esound-0002-undeclared-variable.patch"
 SPDX-FileCopyrightText = "Gentoo contributors"
 SPDX-License-Identifier = "GPL-2.0-or-later AND LGPL-2.0-or-later"

Comment

The patch is a small upstream/Fedora-sourced functional fix that changes ALSA playback teardown from snd_pcm_drain() to snd_pcm_drop() to avoid hangs. It does not add new code execution, network access, privilege changes, persistence, or packaging changes. The metadata points to a legitimate upstream-origin patch and the modification is limited to one API call in an existing C source file. Security risk is therefore minimal.

@@ -0,0 +1,27 @@
+Author: Martin Stransky <stransky@redhat.com>
+Date: Mon, 11 Jun 2007 10:35:24 UTC
+Origin: https://src.fedoraproject.org/rpms/esound/blob/d66e2950ee74cb99bb8e929b3002699ae5eb2c81/f/esound-0.2.38-drain.patch
+Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=238680
+Reviewed-by: Bastien Nocera <bnocera@redhat.com>
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] esd hangs the session on sound events
+
+Drop playback instead of waiting for drain to complete.
+---
+ audio_alsa09.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: b/audio_alsa09.c
+===================================================================
+--- a/audio_alsa09.c
++++ b/audio_alsa09.c
+@@ -506,7 +506,7 @@ void esd_audio_flush(void)
+ 	}
+ 
+ 	if (alsa_playback_handle != NULL)
+-		snd_pcm_drain( alsa_playback_handle );
++		snd_pcm_drop( alsa_playback_handle );
+   
+ 	if (alsadbg) 
+ 		print_state();

Comment

The patch is a small, straightforward compile fix for debug builds: it declares a local variable `addr` before use in `clients.c`. The change does not introduce new code paths, external inputs, network access, privilege changes, or packaging/install behavior. The only minor note is that the patch metadata includes an `Origin` URL and bug references, but the actual code delta is benign and limited to a local variable declaration.

@@ -0,0 +1,27 @@
+Author: Arttu Valo <arttuv69@gmail.com>
+Date: Wed, 26 Nov 2008 20:18:35 +0200
+Origin: https://bugs.gentoo.org/attachment.cgi?id=173496&action=edit
+Bug-Gentoo: https://bugs.gentoo.org/248821
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=516608
+Bug-GNOME: https://bugzilla.gnome.org/show_bug.cgi?id=562360
+Reviewed-by: Gilles Dartiguelongue <eva@gentoo.org>
+Reviewed-by: Josselin Mouette <joss@debian.org>
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] 'addr' undeclared for debug builds
+---
+ clients.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+Index: b/clients.c
+===================================================================
+--- a/clients.c
++++ b/clients.c
+@@ -175,6 +175,8 @@ int get_new_clients( int listen )
+ 	    ESDBG_TRACE( 
+ 	    if (esd_use_tcpip) {
+ 
++		unsigned long addr;
++
+ 		port = ntohs( incoming.sin_port );
+ 		addr = ntohl( incoming.sin_addr.s_addr );

Comment

The patch is a minimal one-line fix in a Debian-originated patch file: it initializes a struct field to NULL to prevent a crash on an uninitialized server. There are no signs of code execution, network access, privilege changes, persistence mechanisms, or packaging integrity issues in this diff. The metadata points to an upstream/debian bugfix and the change is narrowly scoped.

@@ -0,0 +1,22 @@
+Author: Josselin Mouette <joss@debian.org>
+Date: Sat, 30 Oct 2010 15:05:44 +0200
+Origin: https://sources.debian.org/patches/esound/0.2.41-11/04_audsp_crash.patch/
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601295
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] avoid audsp crashing on uninitialized server
+---
+ esdmgr.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+Index: b/esdmgr.c
+===================================================================
+--- a/esdmgr.c
++++ b/esdmgr.c
+@@ -128,6 +128,7 @@ esd_info_t *esd_get_all_info( int esd )
+ 
+     /* allocate the entire info structure, and set defaults to NULL */
+     esd_info_t *info = (esd_info_t *) malloc( sizeof(esd_info_t) );
++    info->server = NULL;
+     info->player_list = NULL;
+     info->sample_list = NULL;

Comment

The patch is a straightforward build-system change that adds -lm to the esd linker flags. It only affects Makefile.am, does not introduce new sources, scripts, network fetches, privilege changes, or runtime behavior beyond linking against libm. The metadata points to an upstream Fedora/Debian patch and the diff contains no suspicious content. Risk is low.

@@ -0,0 +1,25 @@
+Author: Adam Jackson <ajax@redhat.com>
+Date: Wed, 07 Nov 2012 13:00:47 -0500
+Origin: https://src.fedoraproject.org/rpms/esound/blob/a2c3b4678a31ec4f41eb5a96da6ad02ee51983bd/f/esound-0.2.41-libm.patch
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=711536
+Reviewed-by: Emilio Pozuelo Monfort <pochu@debian.org>
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] always link against libm
+---
+ Makefile.am |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: b/Makefile.am
+===================================================================
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -125,7 +125,7 @@ esdplay_SOURCES = \
+ 
+ LDADD = libesd.la $(AUDIOFILE_LIBS)
+ 
+-esd_LDADD = $(WRAP_LIB) $(LDADD)
++esd_LDADD = $(WRAP_LIB) $(LDADD) -lm
+ 
+ m4datadir = $(datadir)/aclocal
+ m4data_DATA = esd.m4

Comment

The patch is a straightforward header/prototype fix for GCC 15: it adds a missing declaration of clean_exit() to esd-server.h and removes the redundant local declaration from esd.c. There are no added build-time downloads, no execution changes, no packaging/install-script modifications, and no suspicious persistence or privilege-related behavior. The Origin points to an AUR comment and the diff is limited to a small source compatibility adjustment, so risk is very low.

@@ -0,0 +1,36 @@
+Author: Mike Pento <mjpento@gmail.com>
+Date: Sat, 14 Sep 2024 14:06:39 -0400
+Origin: https://aur.archlinux.org/packages/esound#comment-990764
+Bug-AUR: https://aur.archlinux.org/packages/esound#comment-990225
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] add missing declaration for 'clean_exit' for GCC 15
+---
+ esd-server.h |    1 +
+ esd.c        |    1 -
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+Index: b/esd-server.h
+===================================================================
+--- a/esd-server.h
++++ b/esd-server.h
+@@ -114,6 +114,7 @@ typedef struct esd_sample {
+ 
+ /*******************************************************************/
+ /* server function prototypes */
++void clean_exit( int signum );
+ 
+ /* esd.c - global variables */
+ extern int esd_is_owned;
+Index: b/esd.c
+===================================================================
+--- a/esd.c
++++ b/esd.c
+@@ -67,7 +67,6 @@ audio_read_t impl_esd_audio_read = esd_a
+ /* esd.c - prototypes */
+ void set_audio_buffer( void *buf, esd_format_t format, int magl, int magr,
+ 		int freq, int speed, int length, long offset );
+-void clean_exit( int signum );
+ void reset_signal( int signum );
+ void reset_daemon( int signum );
+ void reconnect_driver( int signum );

Comment

The patch removes a defensive file-descriptor cleanup from esd startup, allowing inherited descriptors to remain open. That is a behavior change, but in this context it is explicitly justified as restoring journalctl-visible logging and does not introduce new code execution, privilege escalation, network access, or persistence. I do not see a supply-chain or packaging integrity issue in this diff alone; the risk is limited to operational side effects from keeping descriptors open.

@@ -0,0 +1,42 @@
+Author: Tiago de Paula <tiagodepalves@gmail.com>
+Date: Sun, 15 Jun 2025 01:13:10 -0300
+Last-Update: 2026-02-09
+Subject: [PATCH] Revert "Close file descriptors after startup. Fixes #333186."
+
+Allow showing logs on journalctl.
+
+This reverts commit 2bec7e4653f672a51ff4780d4ff68d73af026e77.
+---
+ esd.c |   12 ------------
+ 1 file changed, 12 deletions(-)
+
+Index: b/esd.c
+===================================================================
+--- a/esd.c
++++ b/esd.c
+@@ -632,9 +632,6 @@ int main ( int argc, char *argv[] )
+     char *hostname=NULL;
+     char *endptr;
+ 
+-    int fd0;
+-    int max_fds;
+-
+     /* from esd_config.c */
+     extern char esd_spawn_options[];
+     extern char esd_default_options[];
+@@ -836,15 +833,6 @@ int main ( int argc, char *argv[] )
+     /* cd to / */
+     chdir ("/");
+ 
+-    /* close all open file descriptors */
+-    max_fds = getdtablesize();
+-    for(i=0;i<max_fds;i++){
+-      close(i);
+-    }
+-    fd0 = open("/dev/null", O_RDWR);
+-    dup(0);
+-    dup(0);
+-
+     /* open the listening socket */
+   listen_socket = open_listen_socket(hostname, esd_port );
+   if ( listen_socket < 0 ) {

Comment

The patch only corrects a version constant in configure.ac from 0.2.39 to 0.2.41. It does not add code execution, network access, privilege changes, packaging changes, or any other security-relevant behavior. This is a straightforward metadata/version fix with no apparent risk.

@@ -0,0 +1,23 @@
+Author: Tiago de Paula <tiagodepalves@gmail.com>
+Date: Sat, 14 Jun 2025 23:36:27 -0300
+Last-Update: 2026-02-09
+Subject: [PATCH] fix wrong micro version
+
+Current version is 0.2.41, not 0.2.39!
+---
+ configure.ac |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: b/configure.ac
+===================================================================
+--- a/configure.ac
++++ b/configure.ac
+@@ -3,7 +3,7 @@ AC_INIT(esound, 0.2.41)
+ 
+ ESD_MAJOR_VERSION=0
+ ESD_MINOR_VERSION=2
+-ESD_MICRO_VERSION=39
++ESD_MICRO_VERSION=41
+ ESD_VERSION=$ESD_MAJOR_VERSION.$ESD_MINOR_VERSION.$ESD_MICRO_VERSION
+ 
+ AC_CANONICAL_TARGET([])

Comment

The patch only moves the -nobeeps flag from spawn_options into default_options in esd.conf. This is a configuration change with no code execution, no new sources, no privilege changes, and no persistence or network behavior. It preserves the same effective default behavior for spawned instances while making the option apply more broadly. No security red flags are apparent in the diff itself.

@@ -0,0 +1,22 @@
+Author: Tiago de Paula <tiagodepalves@gmail.com>
+Date: Sat, 14 Jun 2025 22:36:23 -0300
+Last-Update: 2026-02-09
+Subject: [PATCH] move -nobeeps to default_options
+---
+ esd.conf |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+Index: b/esd.conf
+===================================================================
+--- a/esd.conf
++++ b/esd.conf
+@@ -4,7 +4,7 @@
+ # you should start it from the session controller, not some random
+ # app inside.
+ auto_spawn=0
+-spawn_options=-terminate -nobeeps -as 2
++spawn_options=-terminate -as 2
+ spawn_wait_ms=100
+ # default options are used in spawned and non-spawned mode
+-default_options=
++default_options=-nobeeps