Review Results

Comment

The change only bumps pkgrel from 1 to 2 in .SRCINFO, with no source, build, install-script, dependency, or packaging logic changes. This is a metadata-only rebuild indicator and does not introduce any new security-relevant behavior.

@@ -1,7 +1,7 @@
 pkgbase = aseprite
 	pkgdesc = Create animated sprites and pixel art
 	pkgver = 1.3.18.1
-	pkgrel = 1
+	pkgrel = 2
 	url = https://www.aseprite.org/
 	arch = x86_64
 	license = LicenseRef-Aseprite-EULA

Comment

The change only alters nvchecker metadata used for upstream version tracking. It switches from scraping GitHub tags via regex to tracking the upstream git repo directly, which is not a packaging/runtime security concern. The new URL is HTTPS and points to the official upstream repository. The added exclude_regex/prefix values look like version-filtering logic, not code execution or persistence. No build scripts, install hooks, or shipped artifacts are affected by this diff.

@@ -1,4 +1,5 @@
 [aseprite]
-source = "regex"
-regex = 'v(\d+\.\d+\.\d+)'
-url = "https://github.com/aseprite/aseprite/tags"
+source = "git"
+git = "https://github.com/aseprite/aseprite"
+exclude_regex = "\\d+(\\.\\d+)+(-\\w+).\\d+"
+prefix = "v"
\ No newline at end of file

Comment

This change only bumps pkgrel from 1 to 2 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or packaging behavior. No new attack surface or integrity concern is introduced by the diff shown.

@@ -13,7 +13,7 @@ pkgname=aseprite
 pkgver=1.3.18.1
 _skiaver=m124
 _skiahash=08a5439a6b
-pkgrel=1
+pkgrel=2
 pkgdesc='Create animated sprites and pixel art'
 arch=('x86_64')
 url="https://www.aseprite.org/"

Comment

The added line only forces CMake to use the system `ar` and `ranlib` via `command -v`, which is a normal build-tool selection change and does not introduce network access, privilege escalation, persistence, or packaging outside `$pkgdir`. The trailing shell comment is harmless in a PKGBUILD context. No security-relevant behavior is added by this diff hunk.

@@ -157,6 +157,7 @@ build() {
 -DENABLE_UPDATER=OFF -DENABLE_{SCRIPTING,WEBSOCKET}=ON \
 -DLAF_WITH_{EXAMPLES,TESTS}=OFF -DLAF_BACKEND=skia \
 -DSKIA_DIR="$PWD/skia" -DSKIA_LIBRARY_DIR="$_skiadir" \
+-DCMAKE_AR=$(command -v ar) -DCMAKE_RANLIB=$(command -v ranlib) \ # cmake nonsense
 -DUSE_SHARED_{CMARK,CURL,FMT,GIFLIB,LIBJPEG_TURBO,ZLIB,LIBPNG,TINYXML,PIXMAN,FREETYPE,HARFBUZZ,LIBARCHIVE,WEBP}=ON \
 -DCMAKE_POLICY_VERSION_MINIMUM=3.5 # workaround
 	cmake --build build