Review Results

Comment

The change is a straightforward version bump in .SRCINFO from chromaprint 1.6.0 to 1.6.1 with updated checksum and dependency metadata. The source remains an HTTPS GitHub release tarball from the upstream project, there are no new build-time downloads, scripts, patches, or privilege-related artifacts introduced, and the dependency adjustments (gcc-libs -> libgcc/libstdc++) are consistent with packaging metadata changes rather than a security concern. No red flags are present in this diff alone.

@@ -1,18 +1,19 @@
 pkgbase = chromaprint-fftw
 	pkgdesc = Library for extracting fingerprints from any audio source (uses fftw for FFT calculations instead of ffmpeg)
-	pkgver = 1.6.0
+	pkgver = 1.6.1
 	pkgrel = 1
 	url = https://acoustid.org/chromaprint
 	arch = x86_64
 	license = GPL-2.0-or-later
 	makedepends = cmake
-	depends = gcc-libs
-	depends = glibc
 	depends = fftw
+	depends = glibc
+	depends = libgcc
+	depends = libstdc++
 	provides = chromaprint
 	provides = libchromaprint.so
 	conflicts = chromaprint
-	source = https://github.com/acoustid/chromaprint/archive/v1.6.0/chromaprint-1.6.0.tar.gz
-	sha256sums = 65bfce4a35b2e673dbcda917b6aa577e2f145cf805243d19e6a50fea2a520c2a
+	source = https://github.com/acoustid/chromaprint/archive/v1.6.1/chromaprint-1.6.1.tar.gz
+	sha256sums = 7065ec9db48ac1fa929ec6c42afcd966605b1bfe48b6d5e64c25378a05f4fb02
 
 pkgname = chromaprint-fftw

Comment

The change is a straightforward version bump from 1.6.0 to 1.6.1 with an updated upstream tarball checksum. The source remains the official GitHub release archive over HTTPS, there are no new build-time downloads, scripts, patches, or privilege-related changes, and the dependency adjustment from gcc-libs to libgcc/libstdc++ is a normal packaging metadata update. No security red flags are evident in the provided diff.

@@ -1,22 +1,23 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=chromaprint-fftw
-pkgver=1.6.0
+pkgver=1.6.1
 pkgrel=1
 pkgdesc='Library for extracting fingerprints from any audio source (uses fftw for FFT calculations instead of ffmpeg)'
 arch=('x86_64')
 url='https://acoustid.org/chromaprint'
 license=('GPL-2.0-or-later')
 depends=(
-    'gcc-libs'
+    'fftw'
     'glibc'
-    'fftw')
+    'libgcc'
+    'libstdc++')
 makedepends=(
     'cmake')
 provides=('chromaprint' 'libchromaprint.so')
 conflicts=('chromaprint')
 source=("https://github.com/acoustid/chromaprint/archive/v${pkgver}/chromaprint-${pkgver}.tar.gz")
-sha256sums=('65bfce4a35b2e673dbcda917b6aa577e2f145cf805243d19e6a50fea2a520c2a')
+sha256sums=('7065ec9db48ac1fa929ec6c42afcd966605b1bfe48b6d5e64c25378a05f4fb02')
 
 build() {
     cmake -B build -S "chromaprint-${pkgver}" \

Comment

The change is low risk. It only updates the package version/checksum and swaps a CMake warning flag from -Wno-dev to -Wno-author. There are no new sources, no build-time network fetches, no install-script or systemd changes, and no privilege/persistence mechanisms. The dependency list change from gcc-libs to libgcc/libstdc++ is a normal packaging adjustment for a C++ library and does not introduce a security concern. I found no evidence of malicious behavior in the reviewed diff.

@@ -26,7 +27,7 @@ build() {
         -DBUILD_TESTS:BOOL='ON' \
         -DBUILD_TOOLS:BOOL='OFF' \
         -DFFT_LIB:STRING='fftw3' \
-        -Wno-dev
+        -Wno-author
     cmake --build build
 }