Review Results

Version #1923 of gstreamer0.10-base · commit 0f07b20dd2e5 · status Reviewed

Risk 0/5 · Safe .SRCINFO

Result #1085

Comment

The change is a low-risk metadata update only: pkgrel is incremented and the project URL is switched from HTTP to HTTPS. There are no build-script, source, dependency, or install-time behavior changes in the provided diff, and the new URL points to the same official upstream site over a more secure transport. No security concerns are evident from this change alone.

@@ -1,7 +1,7 @@
 pkgbase = gstreamer0.10-base
 	pkgver = 0.10.36
-	pkgrel = 14
-	url = http://gstreamer.freedesktop.org/
+	pkgrel = 15
+	url = https://gstreamer.freedesktop.org/
 	arch = i686
 	arch = x86_64
 	arch = armv7h

Risk 0/5 · Safe .SRCINFO

Result #1086

Comment

The change is limited to .SRCINFO metadata and does not introduce executable code, install scripts, or new sources. The added makedepends/depends/provides entries are consistent with the package’s legacy GStreamer 0.10 plugin split and appear to reflect packaging metadata updates rather than a supply-chain or privilege-escalation risk. The only notable change is the tightened dependency on gstreamer0.10-base=0.10.36-15 for the plugin subpackage, which is normal version pinning. No suspicious URLs, build-time downloads, or persistence mechanisms are present in this diff.

@@ -16,38 +16,65 @@ pkgbase = gstreamer0.10-base
 	makedepends = libtheora
 	makedepends = pango
 	makedepends = cairo
-	makedepends = gobject-introspection
 	makedepends = glib2-devel
+	makedepends = libogg
+	makedepends = libx11
+	makedepends = libxext
 	makedepends = libxml2
+	makedepends = perl
+	makedepends = zlib
 	options = !emptydirs
 	source = https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-0.10.36.tar.xz
 	source = fix-crash-0-byte-ogg.patch
 	source = colorbalance-fix-abi.patch
 	source = videoscale-fix-negotiation.patch
 	source = ayuv64-lanczos.patch
-	source = gstaudio-symbols.patch
 	source = enum_headers.patch
 	sha256sums = 1fe45c3894903001d4d008b0713dab089f53726dcb5842d5b40c2595a984e64a
 	sha256sums = a6a01035ea9627737f9c17f72919857ed43ccc7c2cb08b645b43ed89f78d0f4f
 	sha256sums = 7442c5c68068428b8c7ac1d3825ce29f1bb152b75b77047b9e806c7d322b780c
 	sha256sums = ae27f7be58997217f67898b37b138a485c203389e56b65e6b31c23f769ef39ca
 	sha256sums = 3792dfe80c69f51c0db98533e8fb16707b5dd2ee6933ea6098583af873ceb44a
-	sha256sums = 56e7a988df39d2ec4befa265536ad8c30d3c8d18d136cebef64e8d6baac1abae
-	sha256sums = 0e2a6ef0479621d522c7dbaeb577df3e422c8f7111f5892540f8437475a38932
+	sha256sums = 6c2b99c62741a17c6571fe36f82a263e06608316f9d17172edbf07517787ce88
 
 pkgname = gstreamer0.10-base
-	pkgdesc = GStreamer Multimedia Framework Base plugin libraries
+	pkgdesc = Legacy GStreamer 0.10 base plugin libraries
 	depends = gstreamer0.10>=0.10.36
-	depends = orc
+	depends = glib2
+	depends = glibc
+	depends = libx11
+	depends = libxext
+	depends = libxml2
 	depends = libxv
+	depends = orc
+	depends = perl
+	depends = zlib
+	provides = libgstapp-0.10.so
+	provides = libgstaudio-0.10.so
+	provides = libgstcdda-0.10.so
+	provides = libgstfft-0.10.so
+	provides = libgstinterfaces-0.10.so
+	provides = libgstnetbuffer-0.10.so
+	provides = libgstpbutils-0.10.so
+	provides = libgstriff-0.10.so
+	provides = libgstrtp-0.10.so
+	provides = libgstrtsp-0.10.so
+	provides = libgstsdp-0.10.so
+	provides = libgsttag-0.10.so
+	provides = libgstvideo-0.10.so
 
 pkgname = gstreamer0.10-base-plugins
-	pkgdesc = GStreamer Multimedia Framework Base Plugins (gst-plugins-base)
+	pkgdesc = Legacy GStreamer 0.10 base plugins
 	groups = gstreamer0.10-plugins
-	depends = gstreamer0.10-base=0.10.36
+	depends = gstreamer0.10-base=0.10.36-15
 	depends = alsa-lib
+	depends = cairo
 	depends = cdparanoia
+	depends = glib2
+	depends = glibc
+	depends = gstreamer0.10
+	depends = libogg
+	depends = libtheora
 	depends = libvisual
 	depends = libvorbis
-	depends = libtheora
 	depends = pango

Risk 0/5 · Safe PKGBUILD

Result #1087

Comment

The change is low risk. It updates the homepage to HTTPS, removes an obsolete patch from the source list, and adjusts build/package metadata and quoting. The new check() target only runs local test suites and does not introduce network access or privileged actions. I did not find any curl|bash, external downloads, sudo, persistence mechanisms, or suspicious install-script/unit changes in this diff. The only notable change is the removal of gobject-introspection from makedepends and the addition of several normal library/perl dependencies, which appears consistent with the package’s legacy build/test requirements rather than malicious behavior.

@@ -5,37 +5,34 @@
 _pkgname=gst-plugins-base
 pkgname=('gstreamer0.10-base' 'gstreamer0.10-base-plugins')
 pkgver=0.10.36
-pkgrel=14
+pkgrel=15
 arch=('i686' 'x86_64' 'armv7h')
 license=('LGPL-2.0-or-later')
 makedepends=('gstreamer0.10>=0.10.36' 'orc' 'libxv' 'alsa-lib' 'cdparanoia'
-             'libvisual' 'libvorbis' 'libtheora' 'pango' 'cairo' 'gobject-introspection'
-             'glib2-devel' 'libxml2')
+             'libvisual' 'libvorbis' 'libtheora' 'pango' 'cairo' 'glib2-devel'
+             'libogg' 'libx11' 'libxext' 'libxml2' 'perl' 'zlib')
 options=(!emptydirs)
-url='http://gstreamer.freedesktop.org/'
+url='https://gstreamer.freedesktop.org/'
 source=("https://gstreamer.freedesktop.org/src/${_pkgname}/${_pkgname}-${pkgver}.tar.xz"
         fix-crash-0-byte-ogg.patch
         colorbalance-fix-abi.patch
         videoscale-fix-negotiation.patch
         ayuv64-lanczos.patch
-        gstaudio-symbols.patch
         enum_headers.patch)
 sha256sums=('1fe45c3894903001d4d008b0713dab089f53726dcb5842d5b40c2595a984e64a'
             'a6a01035ea9627737f9c17f72919857ed43ccc7c2cb08b645b43ed89f78d0f4f'
             '7442c5c68068428b8c7ac1d3825ce29f1bb152b75b77047b9e806c7d322b780c'
             'ae27f7be58997217f67898b37b138a485c203389e56b65e6b31c23f769ef39ca'
             '3792dfe80c69f51c0db98533e8fb16707b5dd2ee6933ea6098583af873ceb44a'
-            '56e7a988df39d2ec4befa265536ad8c30d3c8d18d136cebef64e8d6baac1abae'
-            '0e2a6ef0479621d522c7dbaeb577df3e422c8f7111f5892540f8437475a38932')
+            '6c2b99c62741a17c6571fe36f82a263e06608316f9d17172edbf07517787ce88')
 
 prepare() {
-  cd ${_pkgname}-${pkgver}
+  cd "${_pkgname}-${pkgver}"
   sed -i -e '/AC_PATH_XTRA/d' -e 's/AM_CONFIG_HEADER/AC_CONFIG_HEADERS/' configure.ac
   patch -Np1 -i ../fix-crash-0-byte-ogg.patch
   patch -Np1 -i ../colorbalance-fix-abi.patch
   patch -Np1 -i ../ayuv64-lanczos.patch
   patch -Np1 -i ../videoscale-fix-negotiation.patch
-  patch -Np1 -i ../gstaudio-symbols.patch
   patch -Np1 -i ../enum_headers.patch
 
   sed -i 's|g_object_ref (G_OBJECT (interface))|g_object_ref ((GstMixer *)(interface))|' ext/alsa/gstalsamixer.c

Risk 0/5 · Safe PKGBUILD

Result #1088

Comment

The change is low risk. It only adds quoting around the build directory path and removes the `-Wno-error` compiler flags, which makes builds stricter rather than weaker. There are no new sources, downloads, privilege changes, install-script changes, or packaging/persistence behaviors introduced by this diff hunk.

@@ -44,13 +41,13 @@ prepare() {
 }
 
 build() {
-  cd ${_pkgname}-${pkgver}
+  cd "${_pkgname}-${pkgver}"
 
   CPPFLAGS+=" $(pkg-config --cflags pangocairo pango cairo)"
   LDFLAGS+=" $(pkg-config --libs libxml-2.0)"
   export CPPFLAGS LDFLAGS
-  export CFLAGS="$CFLAGS -Wno-error -Wno-deprecated-declarations"
-  export CXXFLAGS="$CXXFLAGS -Wno-error -Wno-deprecated-declarations"
+  export CFLAGS="$CFLAGS -Wno-deprecated-declarations"
+  export CXXFLAGS="$CXXFLAGS -Wno-deprecated-declarations"
 
   ./configure --prefix=/usr \
               --sysconfdir=/etc \

Risk 0/5 · Safe PKGBUILD

Result #1089

Comment

The change is low risk. It only updates packaging metadata and build/test steps: switches the upstream URL to HTTPS, removes an obsolete patch, adds a check() function, and adjusts dependencies/provides. I do not see any network fetches at build time, privilege escalation, suspicious scripts, or installation outside pkgdir. The new check() runs upstream tests, which is normal for a package build. The only notable packaging change is adding provides() entries and expanding depends(), but these are consistent with the libraries shipped by gst-plugins-base and do not introduce a security concern.

@@ -62,23 +59,37 @@ build() {
               --disable-introspection
 
   make
-  sed -e 's/^SUBDIRS_EXT =.*/SUBDIRS_EXT =/' -i Makefile
+}
+
+check() {
+  cd "${_pkgname}-${pkgver}"
+  make check-exports
+  make -C tests/check check CFLAGS="${CFLAGS} -std=gnu17" \
+    TESTS='libs/audio libs/fft libs/netbuffer'
 }
 
 package_gstreamer0.10-base() {
-  pkgdesc="GStreamer Multimedia Framework Base plugin libraries"
-  depends=('gstreamer0.10>=0.10.36' 'orc' 'libxv')
+  pkgdesc="Legacy GStreamer 0.10 base plugin libraries"
+  depends=('gstreamer0.10>=0.10.36' 'glib2' 'glibc' 'libx11' 'libxext' 'libxml2'
+           'libxv' 'orc' 'perl' 'zlib')
+  provides=('libgstapp-0.10.so' 'libgstaudio-0.10.so' 'libgstcdda-0.10.so'
+            'libgstfft-0.10.so' 'libgstinterfaces-0.10.so' 'libgstnetbuffer-0.10.so'
+            'libgstpbutils-0.10.so' 'libgstriff-0.10.so' 'libgstrtp-0.10.so'
+            'libgstrtsp-0.10.so' 'libgstsdp-0.10.so' 'libgsttag-0.10.so'
+            'libgstvideo-0.10.so')
 
-  cd ${_pkgname}-${pkgver}
-  make DESTDIR="${pkgdir}" install
+  cd "${_pkgname}-${pkgver}"
+  make DESTDIR="${pkgdir}" SUBDIRS_EXT= install
 }
 
 package_gstreamer0.10-base-plugins() {
-  pkgdesc="GStreamer Multimedia Framework Base Plugins (gst-plugins-base)"
-  depends=("gstreamer0.10-base=${pkgver}" 'alsa-lib' 'cdparanoia' 'libvisual' 'libvorbis' 'libtheora' 'pango')
+  pkgdesc="Legacy GStreamer 0.10 base plugins"
+  depends=("gstreamer0.10-base=${pkgver}-${pkgrel}" 'alsa-lib' 'cairo' 'cdparanoia'
+           'glib2' 'glibc' 'gstreamer0.10' 'libogg' 'libtheora' 'libvisual' 'libvorbis'
+           'pango')
   groups=('gstreamer0.10-plugins')
 
-  cd ${_pkgname}-${pkgver}
+  cd "${_pkgname}-${pkgver}"
   make -C gst-libs DESTDIR="${pkgdir}" install
   make -C ext DESTDIR="${pkgdir}" install
   make -C gst-libs DESTDIR="${pkgdir}" uninstall

Risk 0/5 · Safe enum_headers.patch

Result #1090

Comment

The change only removes an escaped backslash before `#include` in several generated Makefile.in rules, so the generated enum header snippets will now contain literal preprocessor includes instead of an escaped `\#include`. This is a build-system fix, not a security-sensitive behavior change: it does not add network access, privilege escalation, persistence, or bundled binaries, and it stays within the existing source tree/build process. I see no malicious pattern in this diff hunk.

@@ -22,111 +22,3 @@ diff --unified --recursive --text package.orig/common/gst-glib-gen.mak package.n
  
  # these are all the rules generating the relevant files
  $(glib_gen_basename)-marshal.h: $(glib_gen_basename)-marshal.list
-diff --unified --recursive --text package.orig/gst/encoding/Makefile.in package.new/gst/encoding/Makefile.in
---- package.orig/gst/encoding/Makefile.in	2020-03-18 22:16:50.807426248 -0400
-+++ package.new/gst/encoding/Makefile.in	2020-03-18 22:17:26.620476983 -0400
-@@ -493,7 +493,7 @@
- BUILT_SOURCES = $(built_headers) $(built_sources)
- EXTRA_DIST = gstencode-marshal.list
- CLEANFILES = $(BUILT_SOURCES)
--enum_headers = $(foreach h,$(glib_enum_headers),\n\#include \"$(h)\")
-+enum_headers = $(foreach h,$(glib_enum_headers),\n#include \"$(h)\")
- all: $(BUILT_SOURCES)
- 	$(MAKE) $(AM_MAKEFLAGS) all-am
- 
-diff --unified --recursive --text package.orig/gst/playback/Makefile.in package.new/gst/playback/Makefile.in
---- package.orig/gst/playback/Makefile.in	2020-03-18 22:16:50.804092941 -0400
-+++ package.new/gst/playback/Makefile.in	2020-03-18 22:17:26.540477618 -0400
-@@ -569,7 +569,7 @@
- BUILT_SOURCES = $(built_headers) $(built_sources)
- EXTRA_DIST = gstplay-marshal.list
- CLEANFILES = $(BUILT_SOURCES)
--enum_headers = $(foreach h,$(glib_enum_headers),\n\#include \"$(h)\")
-+enum_headers = $(foreach h,$(glib_enum_headers),\n#include \"$(h)\")
- all: $(BUILT_SOURCES)
- 	$(MAKE) $(AM_MAKEFLAGS) all-am
- 
-diff --unified --recursive --text package.orig/gst/tcp/Makefile.in package.new/gst/tcp/Makefile.in
---- package.orig/gst/tcp/Makefile.in	2020-03-18 22:16:50.804092941 -0400
-+++ package.new/gst/tcp/Makefile.in	2020-03-18 22:17:26.457144945 -0400
-@@ -471,7 +471,7 @@
- glib_enum_define = GST_TCP
- glib_gen_prefix = gst_tcp
- glib_gen_basename = gsttcp
--enum_headers = $(foreach h,$(glib_enum_headers),\n\#include \"$(h)\")
-+enum_headers = $(foreach h,$(glib_enum_headers),\n#include \"$(h)\")
- built_sources = gsttcp-enumtypes.c gsttcp-marshal.c
- built_headers = gsttcp-enumtypes.h gsttcp-marshal.h
- BUILT_SOURCES = $(built_sources) $(built_headers)
-diff --unified --recursive --text package.orig/gst-libs/gst/app/Makefile.in package.new/gst-libs/gst/app/Makefile.in
---- package.orig/gst-libs/gst/app/Makefile.in	2020-03-18 22:16:50.817426170 -0400
-+++ package.new/gst-libs/gst/app/Makefile.in	2020-03-18 22:17:27.103806485 -0400
-@@ -473,7 +473,7 @@
- glib_enum_define = GST_APP
- glib_gen_prefix = __gst_app
- glib_gen_basename = gstapp
--enum_headers = $(foreach h,$(glib_enum_headers),\n\#include \"$(h)\")
-+enum_headers = $(foreach h,$(glib_enum_headers),\n#include \"$(h)\")
- built_sources = gstapp-marshal.c
- built_headers = gstapp-marshal.h
- BUILT_SOURCES = $(built_sources) $(built_headers)
-diff --unified --recursive --text package.orig/gst-libs/gst/audio/Makefile.in package.new/gst-libs/gst/audio/Makefile.in
---- package.orig/gst-libs/gst/audio/Makefile.in	2020-03-18 22:16:50.817426170 -0400
-+++ package.new/gst-libs/gst/audio/Makefile.in	2020-03-18 22:17:27.070473416 -0400
-@@ -544,7 +544,7 @@
-   $(GST_BASE_LIBS) $(GST_LIBS)
- 
- libgstaudio_@GST_MAJORMINOR@_la_LDFLAGS = $(GST_LIB_LDFLAGS) $(GST_ALL_LDFLAGS) $(GST_LT_LDFLAGS)
--enum_headers = $(foreach h,$(glib_enum_headers),\n\#include \"$(h)\")
-+enum_headers = $(foreach h,$(glib_enum_headers),\n#include \"$(h)\")
- @HAVE_INTROSPECTION_TRUE@BUILT_GIRSOURCES = GstAudio-@GST_MAJORMINOR@.gir
- @HAVE_INTROSPECTION_TRUE@gir_headers = $(patsubst %,$(srcdir)/%, \
- @HAVE_INTROSPECTION_TRUE@	$(libgstaudio_@GST_MAJORMINOR@include_HEADERS)) \
-diff --unified --recursive --text package.orig/gst-libs/gst/interfaces/Makefile.in package.new/gst-libs/gst/interfaces/Makefile.in
---- package.orig/gst-libs/gst/interfaces/Makefile.in	2020-03-18 22:16:50.814092862 -0400
-+++ package.new/gst-libs/gst/interfaces/Makefile.in	2020-03-18 22:17:26.897141457 -0400
-@@ -551,7 +551,7 @@
- 
- EXTRA_DIST = interfaces-marshal.list
- CLEANFILES = $(BUILT_SOURCES) $(am__append_1)
--enum_headers = $(foreach h,$(glib_enum_headers),\n\#include \"$(h)\")
-+enum_headers = $(foreach h,$(glib_enum_headers),\n#include \"$(h)\")
- @HAVE_INTROSPECTION_TRUE@BUILT_GIRSOURCES = GstInterfaces-@GST_MAJORMINOR@.gir
- @HAVE_INTROSPECTION_TRUE@gir_headers = $(patsubst %,$(srcdir)/%, \
- @HAVE_INTROSPECTION_TRUE@	$(libgstinterfacesinclude_HEADERS)) \
-diff --unified --recursive --text package.orig/gst-libs/gst/pbutils/Makefile.in package.new/gst-libs/gst/pbutils/Makefile.in
---- package.orig/gst-libs/gst/pbutils/Makefile.in	2020-03-18 22:16:50.814092862 -0400
-+++ package.new/gst-libs/gst/pbutils/Makefile.in	2020-03-18 22:17:26.937141140 -0400
-@@ -542,7 +542,7 @@
- 
- # DISTCLEANFILES is for files generated by configure
- DISTCLEANFILES = $(built_headers_configure)
--enum_headers = $(foreach h,$(glib_enum_headers),\n\#include \"$(h)\")
-+enum_headers = $(foreach h,$(glib_enum_headers),\n#include \"$(h)\")
- @HAVE_INTROSPECTION_TRUE@BUILT_GIRSOURCES = GstPbutils-@GST_MAJORMINOR@.gir
- @HAVE_INTROSPECTION_TRUE@gir_headers = $(patsubst %,$(srcdir)/%, \
- @HAVE_INTROSPECTION_TRUE@	$(libgstpbutils_@GST_MAJORMINOR@include_HEADERS)) \
-diff --unified --recursive --text package.orig/gst-libs/gst/rtsp/Makefile.in package.new/gst-libs/gst/rtsp/Makefile.in
---- package.orig/gst-libs/gst/rtsp/Makefile.in	2020-03-18 22:16:50.817426170 -0400
-+++ package.new/gst-libs/gst/rtsp/Makefile.in	2020-03-18 22:17:27.113806406 -0400
-@@ -517,7 +517,7 @@
- glib_enum_define = gst_rtsp
- glib_enum_headers = gstrtspdefs.h
- glib_gen_basename = gstrtsp
--enum_headers = $(foreach h,$(glib_enum_headers),\n\#include \"$(h)\")
-+enum_headers = $(foreach h,$(glib_enum_headers),\n#include \"$(h)\")
- @HAVE_INTROSPECTION_TRUE@BUILT_GIRSOURCES = GstRtsp-@GST_MAJORMINOR@.gir
- @HAVE_INTROSPECTION_TRUE@gir_headers = $(patsubst %,$(srcdir)/%, \
- @HAVE_INTROSPECTION_TRUE@	$(libgstrtspinclude_HEADERS)) \
-diff --unified --recursive --text package.orig/gst-libs/gst/video/Makefile.in package.new/gst-libs/gst/video/Makefile.in
---- package.orig/gst-libs/gst/video/Makefile.in	2020-03-18 22:16:50.810759555 -0400
-+++ package.new/gst-libs/gst/video/Makefile.in	2020-03-18 22:17:26.847141854 -0400
-@@ -553,7 +553,7 @@
- 	$(GST_ALL_LDFLAGS) \
- 	$(GST_LT_LDFLAGS)
- 
--enum_headers = $(foreach h,$(glib_enum_headers),\n\#include \"$(h)\")
-+enum_headers = $(foreach h,$(glib_enum_headers),\n#include \"$(h)\")
- @HAVE_INTROSPECTION_TRUE@BUILT_GIRSOURCES = GstVideo-@GST_MAJORMINOR@.gir
- @HAVE_INTROSPECTION_TRUE@gir_headers = $(patsubst %,$(srcdir)/%, \
- @HAVE_INTROSPECTION_TRUE@	$(libgstvideo_@GST_MAJORMINOR@include_HEADERS)) \