Review Results

Comment

The only change in this .SRCINFO diff is a pkgrel bump from 1 to 2. This is a metadata-only packaging revision with no source, dependency, install-script, or build-command changes visible in the provided hunk. On its face it does not introduce any new security risk.

@@ -1,7 +1,7 @@
 pkgbase = fvs2
 	pkgdesc = Standalone CLI for FVS v2
 	pkgver = 0.9.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://github.com/fvs-lab/fvs2
 	arch = x86_64
 	arch = aarch64

Comment

The only change in this diff is a pkgrel bump from 1 to 2. No build logic, sources, dependencies, install scripts, or packaged artifacts changed, so there is no new security-relevant behavior to assess in this hunk. This is effectively a metadata-only rebuild/release bump.

@@ -4,7 +4,7 @@ _corever=0.1.1
 
 pkgname=fvs2
 pkgver=0.9.0
-pkgrel=1
+pkgrel=2
 pkgdesc='Standalone CLI for FVS v2'
 arch=('x86_64' 'aarch64')
 url='https://github.com/fvs-lab/fvs2'

Comment

Low risk change. The patch only switches Go dependency caching from GOPATH to GOMODCACHE and keeps downloads confined to the build sandbox via `go mod download`; it does not introduce new sources, network endpoints, privilege changes, or install-time scripts. The added `GOMODCACHE` export in `build()` is consistent with the existing module-based workflow and does not affect package contents beyond build reproducibility. No security red flags are evident in this diff.

@@ -27,7 +27,7 @@ prepare() {
   ln -s "core-${_corever}" "$srcdir/core"
   cd "$builddir"
 
-  export GOPATH="$srcdir"
+  export GOMODCACHE="$srcdir/pkg/mod"
   go mod download -modcacherw
   mkdir -p build
 }

Comment

The change only sets GOMODCACHE to a build-local directory under $srcdir and does not introduce new network access, privilege escalation, persistence, or installation behavior. It appears to be a reproducibility/build-isolation tweak for Go module caching, with no security impact visible in the provided hunk.

@@ -39,6 +39,7 @@ build() {
   export CGO_CFLAGS="$CFLAGS"
   export CGO_CXXFLAGS="$CXXFLAGS"
   export CGO_LDFLAGS="$LDFLAGS"
+  export GOMODCACHE="$srcdir/pkg/mod"
   export GOFLAGS='-buildmode=pie -trimpath -mod=readonly -modcacherw'
 
   go build -ldflags='-linkmode external' -o "build/$pkgname" "./cmd/$pkgname"