Review Results

Comment

The change is limited to bumping pkgver/pkgrel in .SRCINFO from 5.4-2 to 5.4.1-1. No build logic, sources, install scripts, or package contents are altered in the reviewed diff. The only notable issue visible is that the upstream URL remains HTTP rather than HTTPS, but that pre-existed this change and is not introduced here. Based on the provided hunk alone, there is no evidence of malicious behavior or supply-chain risk.

@@ -1,7 +1,7 @@
 pkgbase = photoqt
 	pkgdesc = Fast and highly configurable image viewer with a simple and nice interface.
-	pkgver = 5.4
-	pkgrel = 2
+	pkgver = 5.4.1
+	pkgrel = 1
 	url = http://photoqt.org/
 	arch = x86_64
 	license = GPL2

Comment

The change is low risk. It only updates the declared upstream source tarball from 5.4 to 5.4.1 and adds a new runtime dependency (resvg) in .SRCINFO. The source URL remains HTTPS on the official project domain, and the checksum is updated accordingly. No build scripts, install scripts, or executable artifacts are changed in this diff, so there is no evidence of malicious code execution, persistence, or integrity bypass introduced here.

@@ -29,11 +29,12 @@ pkgbase = photoqt
 	depends = yaml-cpp
 	depends = ffmpegthumbnailer
 	depends = qt6-quick3d
+	depends = resvg
 	optdepends = photoqt-extensions: Official extensions for PhotoQt
 	provides = photoqt-debug
 	conflicts = photoqt-bin
 	conflicts = photoqt-bin-debug
-	source = https://photoqt.org/downloads/source/photoqt-5.4.tar.gz
-	sha256sums = 1a27de9be8153e6a45eee8620f66ad7a3b4598e56ebbbb7664b28730d4b9caf6
+	source = https://photoqt.org/downloads/source/photoqt-5.4.1.tar.gz
+	sha256sums = bc28a133ce320df0dbcfbeea8a0205407fcb21aac7e881ca4b741d14f2d9f0b7
 
 pkgname = photoqt

Comment

The change is low risk. It only bumps the upstream version from 5.4 to 5.4.1, resets pkgrel, updates the source checksum, and adds a new runtime dependency (`resvg`). The source is still fetched over HTTPS from the official project site, there are no new build-time downloads or execution paths, and no install scripts or service files are introduced. I did not see any integrity red flags in this diff.

@@ -2,19 +2,19 @@
 # Contributor: archtux <antonio dot arias99999 at gmail dot com>
 
 pkgname=photoqt
-pkgver=5.4
-pkgrel=2
+pkgver=5.4.1
+pkgrel=1
 pkgdesc="Fast and highly configurable image viewer with a simple and nice interface."
 arch=('x86_64')
 url="http://photoqt.org/"
 license=('GPL2')
 conflicts=('photoqt-bin' 'photoqt-bin-debug')
 provides=('photoqt-debug')
-depends=('exiv2' 'imagemagick' 'qt6-imageformats' 'qt6-multimedia' 'qt6-svg' 'qt6-declarative' 'qt6-location' 'qt6-positioning' 'libraw' 'hicolor-icon-theme' 'libarchive' 'kimageformats' 'mpv' 'python-pychromecast' 'qt6-webengine' 'zxing-cpp' 'lcms2' 'openmp' 'yaml-cpp' 'ffmpegthumbnailer' 'qt6-quick3d')
+depends=('exiv2' 'imagemagick' 'qt6-imageformats' 'qt6-multimedia' 'qt6-svg' 'qt6-declarative' 'qt6-location' 'qt6-positioning' 'libraw' 'hicolor-icon-theme' 'libarchive' 'kimageformats' 'mpv' 'python-pychromecast' 'qt6-webengine' 'zxing-cpp' 'lcms2' 'openmp' 'yaml-cpp' 'ffmpegthumbnailer' 'qt6-quick3d' 'resvg')
 optdepends=('photoqt-extensions: Official extensions for PhotoQt')
 makedepends=('cmake' 'qt6-tools' 'extra-cmake-modules')
 source=(https://photoqt.org/downloads/source/$pkgname-$pkgver.tar.gz)
-sha256sums=('1a27de9be8153e6a45eee8620f66ad7a3b4598e56ebbbb7664b28730d4b9caf6')
+sha256sums=('bc28a133ce320df0dbcfbeea8a0205407fcb21aac7e881ca4b741d14f2d9f0b7')
 
 # NOTE
 # To use GraphicsMagick instead of ImageMagick replace it in the depends array above and change

Comment

The change only flips the CMake option WITH_RESVG from OFF to ON in PKGBUILD. This enables an additional upstream feature/library integration, but there is no evidence in the diff of any malicious behavior, network fetches, privilege escalation, install-script changes, or packaging integrity issues. The build still stays within the normal source/build flow and installs under /usr. Risk is low because this is a feature toggle, though it does expand the dependency surface slightly.

@@ -31,7 +31,7 @@ sha256sums=('1a27de9be8153e6a45eee8620f66ad7a3b4598e56ebbbb7664b28730d4b9caf6')
 prepare() {
   cd $srcdir/$pkgname-$pkgver
 
-  cmake . -DCMAKE_INSTALL_PREFIX=/usr -DWITH_DEVIL=OFF -DWITH_POPPLER=OFF -DWITH_QTPDF=ON -DWITH_IMAGEMAGICK=ON -DWITH_GRAPHICSMAGICK=OFF -DWITH_LIBVIPS=OFF -DWITH_VIDEO_MPV=ON -DWITH_CHROMECAST=ON -DWITH_RESVG=OFF -DWITH_ZXING=ON -DWITH_LCMS2=ON -DWITH_LIBSAI=OFF -DWITH_EXTENSIONS_SUPPORT=ON -DCMAKE_BUILD_TYPE=Release -DWITH_PUGIXML=OFF -DWITH_FFMPEGTHUMBNAILER=ON
+  cmake . -DCMAKE_INSTALL_PREFIX=/usr -DWITH_DEVIL=OFF -DWITH_POPPLER=OFF -DWITH_QTPDF=ON -DWITH_IMAGEMAGICK=ON -DWITH_GRAPHICSMAGICK=OFF -DWITH_LIBVIPS=OFF -DWITH_VIDEO_MPV=ON -DWITH_CHROMECAST=ON -DWITH_RESVG=ON -DWITH_ZXING=ON -DWITH_LCMS2=ON -DWITH_LIBSAI=OFF -DWITH_EXTENSIONS_SUPPORT=ON -DCMAKE_BUILD_TYPE=Release -DWITH_PUGIXML=OFF -DWITH_FFMPEGTHUMBNAILER=ON
 
 }