Review Results

Comment

The change only adjusts runtime dependencies in .SRCINFO from lua54/lua54-lgi to lua/lua-lgi-git. This is a metadata-only change and does not itself introduce executable code, network fetches, privilege escalation, or packaging logic. The main concern is that it switches to a VCS AUR dependency (lua-lgi-git), which can reduce supply-chain stability and reproducibility compared with a versioned repo package, but that is a packaging hygiene issue rather than a direct security flaw in this diff. No high-confidence malicious behavior is present in the reviewed hunk.

@@ -18,8 +18,8 @@ pkgbase = awesome-git
 	depends = gdk-pixbuf2
 	depends = libxdg-basedir
 	depends = libxkbcommon-x11
-	depends = lua54
-	depends = lua54-lgi
+	depends = lua
+	depends = lua-lgi-git
 	depends = pango
 	depends = startup-notification
 	depends = xcb-util-cursor

Comment

The change replaces the stable dependency `lua-lgi` with `lua-lgi-git` while leaving the original line commented out. This is a supply-chain integrity regression: it switches the package from a pinned, repository-provided dependency to a VCS/AUR-style dependency that may track moving HEAD and is not inherently reproducible or vetted in the same way. Even though this diff is small and does not introduce direct code execution, it weakens trust in the build by pulling in an unpinned git-based dependency. No other obvious malicious behavior is present in this hunk.

@@ -16,7 +16,10 @@ arch=('i686' 'x86_64')
 url='https://awesomewm.org/'
 license=('GPL2')
 depends=('cairo' 'dbus' 'gdk-pixbuf2' 'libxdg-basedir' 'libxkbcommon-x11'
-         'lua' 'lua-lgi' 'pango' 'startup-notification' 'xcb-util-cursor'
+         'lua'
+		 #'lua-lgi'
+		 'lua-lgi-git'
+		 'pango' 'startup-notification' 'xcb-util-cursor'
          'xcb-util-keysyms' 'xcb-util-wm' 'xcb-util-xrm' 'libxfixes')
 makedepends=('asciidoctor' 'cmake' 'docbook-xsl' 'git' 'imagemagick' 'ldoc'
              'xmlto')