Review Results

Comment

The change is low risk. It upgrades the upstream tarball URL from HTTP to HTTPS, which improves integrity against MITM, and it normalizes patch source names in .SRCINFO without changing the actual content or introducing new sources. No build scripts, install scripts, or package behavior are affected by this metadata-only update.

@@ -18,17 +18,17 @@ pkgbase = esound
 	conflicts = esd
 	options = !libtool
 	backup = etc/esd.conf
-	source = http://ftp.gnome.org/pub/GNOME/sources/esound/0.2/esound-0.2.41.tar.bz2
+	source = https://ftp.gnome.org/pub/GNOME/sources/esound/0.2/esound-0.2.41.tar.bz2
 	source = esound-system.service
 	source = esound-user.service
-	source = esound-0001-alsa-drain-hang.patch
-	source = esound-0002-undeclared-variable.patch
-	source = esound-0003-fix-audsp-crash.patch
-	source = esound-0004-link-to-libm.patch
-	source = esound-0005-missing-declaration-GCC-15.patch
-	source = esound-0006-revert-close-file-descriptors.patch
-	source = esound-0007-fix-wrong-micro-version.patch
-	source = esound-0008-move-nobeeps-option.patch
+	source = 0001-alsa-drain-hang.patch
+	source = 0002-undeclared-variable.patch
+	source = 0003-fix-audsp-crash.patch
+	source = 0004-link-to-libm.patch
+	source = 0005-missing-declaration-GCC-15.patch
+	source = 0006-revert-close-file-descriptors.patch
+	source = 0007-fix-wrong-micro-version.patch
+	source = 0008-move-nobeeps-option.patch
 	b2sums = 39403985557f44b99a6615e42f6772a31b8555cc3bf252140e36f55c812b4728ca7af519267ff1c8f4bd53604d82edbf682d07b16e98158ca39bbe8663bbaadd
 	b2sums = 1b55880c8212f2e85312c632ab79f1ff36d527c7463aa16fb932f324c496a5a67d109372aff657b59812b9fabe8c5978434e078e7a91868298731ab11ea48f2d
 	b2sums = b84310149765ca3caa7b0b93298af758b0ffbb04b16c3946b3fc8e0ad4e559d7f6221a956dd30a8f01a5e60d85386431078619b683e0d6a447bc1c9363a00e27

Comment

The patch is a small functional change in an upstream Fedora-sourced patch: it replaces snd_pcm_drain() with snd_pcm_drop() to avoid hangs during audio flush. There are no signs of supply-chain risk, no added build/install logic, no network access, and no privilege/persistence mechanisms. The metadata points to a legitimate upstream bugfix source. Security impact is negligible; this is a behavior change only and does not introduce obvious integrity or execution concerns.

@@ -0,0 +1,27 @@
+Author: Martin Stransky <stransky@redhat.com>
+Date: Mon, 11 Jun 2007 10:35:24 UTC
+Origin: https://src.fedoraproject.org/rpms/esound/blob/d66e2950ee74cb99bb8e929b3002699ae5eb2c81/f/esound-0.2.38-drain.patch
+Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=238680
+Reviewed-by: Bastien Nocera <bnocera@redhat.com>
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] esd hangs the session on sound events
+
+Drop playback instead of waiting for drain to complete.
+---
+ audio_alsa09.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: b/audio_alsa09.c
+===================================================================
+--- a/audio_alsa09.c
++++ b/audio_alsa09.c
+@@ -506,7 +506,7 @@ void esd_audio_flush(void)
+ 	}
+ 
+ 	if (alsa_playback_handle != NULL)
+-		snd_pcm_drain( alsa_playback_handle );
++		snd_pcm_drop( alsa_playback_handle );
+   
+ 	if (alsadbg) 
+ 		print_state();

Comment

The patch is a small, targeted fix for a debug-build compile error in clients.c: it declares a local variable before use. It does not add new code paths, network behavior, privilege changes, install scripts, or packaging changes. The only minor note is that the patch metadata includes an unusual future Last-Update timestamp, but that is not a security issue in the code itself. No malicious or high-risk behavior is present in the diff provided.

@@ -0,0 +1,27 @@
+Author: Arttu Valo <arttuv69@gmail.com>
+Date: Wed, 26 Nov 2008 20:18:35 +0200
+Origin: https://bugs.gentoo.org/attachment.cgi?id=173496&action=edit
+Bug-Gentoo: https://bugs.gentoo.org/248821
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=516608
+Bug-GNOME: https://bugzilla.gnome.org/show_bug.cgi?id=562360
+Reviewed-by: Gilles Dartiguelongue <eva@gentoo.org>
+Reviewed-by: Josselin Mouette <joss@debian.org>
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] 'addr' undeclared for debug builds
+---
+ clients.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+Index: b/clients.c
+===================================================================
+--- a/clients.c
++++ b/clients.c
+@@ -175,6 +175,8 @@ int get_new_clients( int listen )
+ 	    ESDBG_TRACE( 
+ 	    if (esd_use_tcpip) {
+ 
++		unsigned long addr;
++
+ 		port = ntohs( incoming.sin_port );
+ 		addr = ntohl( incoming.sin_addr.s_addr );

Comment

The patch is a minimal one-line fix in a Debian-sourced patch file: it initializes a struct field to NULL to prevent a crash. There are no signs of network access, privilege escalation, persistence, embedded binaries, or other supply-chain red flags in the diff. The metadata points to an upstream Debian patch with a bug reference, and the change is narrowly scoped to a null initialization in esdmgr.c.

@@ -0,0 +1,22 @@
+Author: Josselin Mouette <joss@debian.org>
+Date: Sat, 30 Oct 2010 15:05:44 +0200
+Origin: https://sources.debian.org/patches/esound/0.2.41-11/04_audsp_crash.patch/
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601295
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] avoid audsp crashing on uninitialized server
+---
+ esdmgr.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+Index: b/esdmgr.c
+===================================================================
+--- a/esdmgr.c
++++ b/esdmgr.c
+@@ -128,6 +128,7 @@ esd_info_t *esd_get_all_info( int esd )
+ 
+     /* allocate the entire info structure, and set defaults to NULL */
+     esd_info_t *info = (esd_info_t *) malloc( sizeof(esd_info_t) );
++    info->server = NULL;
+     info->player_list = NULL;
+     info->sample_list = NULL;

Comment

The patch is a straightforward build-system fix that adds -lm to the esd binary link line. It does not introduce network access, privilege escalation, persistence, embedded binaries, or any other security-relevant behavior. The source metadata points to an upstream Fedora patch and the change is limited to linker flags in Makefile.am, so risk is minimal.

@@ -0,0 +1,25 @@
+Author: Adam Jackson <ajax@redhat.com>
+Date: Wed, 07 Nov 2012 13:00:47 -0500
+Origin: https://src.fedoraproject.org/rpms/esound/blob/a2c3b4678a31ec4f41eb5a96da6ad02ee51983bd/f/esound-0.2.41-libm.patch
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=711536
+Reviewed-by: Emilio Pozuelo Monfort <pochu@debian.org>
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] always link against libm
+---
+ Makefile.am |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: b/Makefile.am
+===================================================================
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -125,7 +125,7 @@ esdplay_SOURCES = \
+ 
+ LDADD = libesd.la $(AUDIOFILE_LIBS)
+ 
+-esd_LDADD = $(WRAP_LIB) $(LDADD)
++esd_LDADD = $(WRAP_LIB) $(LDADD) -lm
+ 
+ m4datadir = $(datadir)/aclocal
+ m4data_DATA = esd.m4

Comment

The patch is a minimal build-fix for GCC 15: it adds a missing function prototype to a header and removes the duplicate local declaration from esd.c. The change does not introduce new code paths, network access, privilege changes, packaging behavior, or persistence mechanisms. The metadata points to an AUR comment and upstream context, and the diff is limited to declaration hygiene only. No security concerns are evident in this hunk.

@@ -0,0 +1,36 @@
+Author: Mike Pento <mjpento@gmail.com>
+Date: Sat, 14 Sep 2024 14:06:39 -0400
+Origin: https://aur.archlinux.org/packages/esound#comment-990764
+Bug-AUR: https://aur.archlinux.org/packages/esound#comment-990225
+Last-Update: 2026-02-09
+Reviewed-by: Tiago de Paula <tiagodepalves@gmail.com>
+Subject: [PATCH] add missing declaration for 'clean_exit' for GCC 15
+---
+ esd-server.h |    1 +
+ esd.c        |    1 -
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+Index: b/esd-server.h
+===================================================================
+--- a/esd-server.h
++++ b/esd-server.h
+@@ -114,6 +114,7 @@ typedef struct esd_sample {
+ 
+ /*******************************************************************/
+ /* server function prototypes */
++void clean_exit( int signum );
+ 
+ /* esd.c - global variables */
+ extern int esd_is_owned;
+Index: b/esd.c
+===================================================================
+--- a/esd.c
++++ b/esd.c
+@@ -67,7 +67,6 @@ audio_read_t impl_esd_audio_read = esd_a
+ /* esd.c - prototypes */
+ void set_audio_buffer( void *buf, esd_format_t format, int magl, int magr,
+ 		int freq, int speed, int length, long offset );
+-void clean_exit( int signum );
+ void reset_signal( int signum );
+ void reset_daemon( int signum );
+ void reconnect_driver( int signum );

Comment

The patch removes the daemon’s file-descriptor closing logic so it can keep stdout/stderr open for journald logging. This is a behavior change, but it does not introduce new code execution, privilege escalation, persistence, network access, or packaging integrity issues in the patch itself. The change is limited to esd.c and simply stops closing inherited descriptors before opening the listening socket. Risk is low.

@@ -0,0 +1,42 @@
+Author: Tiago de Paula <tiagodepalves@gmail.com>
+Date: Sun, 15 Jun 2025 01:13:10 -0300
+Last-Update: 2026-02-09
+Subject: [PATCH] Revert "Close file descriptors after startup. Fixes #333186."
+
+Allow showing logs on journalctl.
+
+This reverts commit 2bec7e4653f672a51ff4780d4ff68d73af026e77.
+---
+ esd.c |   12 ------------
+ 1 file changed, 12 deletions(-)
+
+Index: b/esd.c
+===================================================================
+--- a/esd.c
++++ b/esd.c
+@@ -632,9 +632,6 @@ int main ( int argc, char *argv[] )
+     char *hostname=NULL;
+     char *endptr;
+ 
+-    int fd0;
+-    int max_fds;
+-
+     /* from esd_config.c */
+     extern char esd_spawn_options[];
+     extern char esd_default_options[];
+@@ -836,15 +833,6 @@ int main ( int argc, char *argv[] )
+     /* cd to / */
+     chdir ("/");
+ 
+-    /* close all open file descriptors */
+-    max_fds = getdtablesize();
+-    for(i=0;i<max_fds;i++){
+-      close(i);
+-    }
+-    fd0 = open("/dev/null", O_RDWR);
+-    dup(0);
+-    dup(0);
+-
+     /* open the listening socket */
+   listen_socket = open_listen_socket(hostname, esd_port );
+   if ( listen_socket < 0 ) {

Comment

The patch only corrects a version constant in configure.ac from 0.2.39 to 0.2.41 and updates the patch metadata. It does not add code execution, network access, privilege changes, packaging changes, or any other security-relevant behavior. This is a straightforward version fix with no apparent supply-chain or persistence risk.

@@ -0,0 +1,23 @@
+Author: Tiago de Paula <tiagodepalves@gmail.com>
+Date: Sat, 14 Jun 2025 23:36:27 -0300
+Last-Update: 2026-02-09
+Subject: [PATCH] fix wrong micro version
+
+Current version is 0.2.41, not 0.2.39!
+---
+ configure.ac |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: b/configure.ac
+===================================================================
+--- a/configure.ac
++++ b/configure.ac
+@@ -3,7 +3,7 @@ AC_INIT(esound, 0.2.41)
+ 
+ ESD_MAJOR_VERSION=0
+ ESD_MINOR_VERSION=2
+-ESD_MICRO_VERSION=39
++ESD_MICRO_VERSION=41
+ ESD_VERSION=$ESD_MAJOR_VERSION.$ESD_MINOR_VERSION.$ESD_MICRO_VERSION
+ 
+ AC_CANONICAL_TARGET([])

Comment

The patch only moves the `-nobeeps` flag from `spawn_options` to `default_options` in `esd.conf`, preserving the same runtime behavior while changing where the option is applied. This is a benign configuration refactor with no added code execution, network access, privilege changes, or persistence mechanisms. No security concern is evident from the diff alone.

@@ -0,0 +1,22 @@
+Author: Tiago de Paula <tiagodepalves@gmail.com>
+Date: Sat, 14 Jun 2025 22:36:23 -0300
+Last-Update: 2026-02-09
+Subject: [PATCH] move -nobeeps to default_options
+---
+ esd.conf |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+Index: b/esd.conf
+===================================================================
+--- a/esd.conf
++++ b/esd.conf
+@@ -4,7 +4,7 @@
+ # you should start it from the session controller, not some random
+ # app inside.
+ auto_spawn=0
+-spawn_options=-terminate -nobeeps -as 2
++spawn_options=-terminate -as 2
+ spawn_wait_ms=100
+ # default options are used in spawned and non-spawned mode
+-default_options=
++default_options=-nobeeps

Comment

The change is low risk. It only switches the tarball URL from HTTP to HTTPS and renames local patch filenames in PKGBUILD, with matching updates to the prepare() patch paths. I checked the referenced patch files and they are ordinary upstream/downstream fixes; no new code execution, network fetches at build time, privilege escalation, or packaging-path changes were introduced. The systemd units and build logic are unchanged by this diff.

@@ -19,17 +19,17 @@ provides=("esd=${pkgver}")
 conflicts=('esd')
 options=(!libtool)
 backup=('etc/esd.conf')
-source=("http://ftp.gnome.org/pub/GNOME/sources/${pkgname}/${pkgver%.*}/${pkgname}-${pkgver}.tar.bz2"
+source=("https://ftp.gnome.org/pub/GNOME/sources/${pkgname}/${pkgver%.*}/${pkgname}-${pkgver}.tar.bz2"
         'esound-system.service'
         'esound-user.service'
-        'esound-0001-alsa-drain-hang.patch'
-        'esound-0002-undeclared-variable.patch'
-        'esound-0003-fix-audsp-crash.patch'
-        'esound-0004-link-to-libm.patch'
-        'esound-0005-missing-declaration-GCC-15.patch'
-        'esound-0006-revert-close-file-descriptors.patch'
-        'esound-0007-fix-wrong-micro-version.patch'
-        'esound-0008-move-nobeeps-option.patch')
+        '0001-alsa-drain-hang.patch'
+        '0002-undeclared-variable.patch'
+        '0003-fix-audsp-crash.patch'
+        '0004-link-to-libm.patch'
+        '0005-missing-declaration-GCC-15.patch'
+        '0006-revert-close-file-descriptors.patch'
+        '0007-fix-wrong-micro-version.patch'
+        '0008-move-nobeeps-option.patch')
 b2sums=('39403985557f44b99a6615e42f6772a31b8555cc3bf252140e36f55c812b4728ca7af519267ff1c8f4bd53604d82edbf682d07b16e98158ca39bbe8663bbaadd'
         '1b55880c8212f2e85312c632ab79f1ff36d527c7463aa16fb932f324c496a5a67d109372aff657b59812b9fabe8c5978434e078e7a91868298731ab11ea48f2d'
         'b84310149765ca3caa7b0b93298af758b0ffbb04b16c3946b3fc8e0ad4e559d7f6221a956dd30a8f01a5e60d85386431078619b683e0d6a447bc1c9363a00e27'

Comment

The change only renames local patch filenames in source=() and the corresponding patch invocations in prepare(). The patches remain pinned by b2sums, and there is no new code execution, network access, privilege escalation, or packaging behavior change. I also checked the full PKGBUILD context: the source URL is HTTPS and points to the upstream GNOME archive, and the rest of the build/install steps are unchanged. This is a low-risk housekeeping change.

@@ -45,14 +45,14 @@ b2sums=('39403985557f44b99a6615e42f6772a31b8555cc3bf252140e36f55c812b4728ca7af51
 prepare() {
   cd "esound-${pkgver}"
 
-  patch -t -Np1 -i ../esound-0001-alsa-drain-hang.patch
-  patch -t -Np1 -i ../esound-0002-undeclared-variable.patch
-  patch -t -Np1 -i ../esound-0003-fix-audsp-crash.patch
-  patch -t -Np1 -i ../esound-0004-link-to-libm.patch
-  patch -t -Np1 -i ../esound-0005-missing-declaration-GCC-15.patch
-  patch -t -Np1 -i ../esound-0006-revert-close-file-descriptors.patch
-  patch -t -Np1 -i ../esound-0007-fix-wrong-micro-version.patch
-  patch -t -Np1 -i ../esound-0008-move-nobeeps-option.patch
+  patch -t -Np1 -i ../0001-alsa-drain-hang.patch
+  patch -t -Np1 -i ../0002-undeclared-variable.patch
+  patch -t -Np1 -i ../0003-fix-audsp-crash.patch
+  patch -t -Np1 -i ../0004-link-to-libm.patch
+  patch -t -Np1 -i ../0005-missing-declaration-GCC-15.patch
+  patch -t -Np1 -i ../0006-revert-close-file-descriptors.patch
+  patch -t -Np1 -i ../0007-fix-wrong-micro-version.patch
+  patch -t -Np1 -i ../0008-move-nobeeps-option.patch
 }
 
 build() {

Comment

The change only renames patch filenames in REUSE.toml to match the actual files in the package directory. It does not alter any build logic, source URLs, permissions, install scripts, or shipped binaries. No security-relevant behavior is introduced by this metadata-only update.

@@ -14,28 +14,28 @@ SPDX-License-Identifier = "0BSD"
 
 [[annotations]]
 path = [
-  "esound-0005-missing-declaration-GCC-15.patch",
-  "esound-0006-revert-close-file-descriptors.patch",
-  "esound-0007-fix-wrong-micro-version.patch",
-  "esound-0008-move-nobeeps-option.patch",
+  "0005-missing-declaration-GCC-15.patch",
+  "0006-revert-close-file-descriptors.patch",
+  "0007-fix-wrong-micro-version.patch",
+  "0008-move-nobeeps-option.patch",
 ]
 SPDX-FileCopyrightText = "Arch Linux contributors"
 SPDX-License-Identifier = "GPL-2.0-or-later AND LGPL-2.0-or-later"
 
 [[annotations]]
-path = "esound-0003-fix-audsp-crash.patch"
+path = "0003-fix-audsp-crash.patch"
 SPDX-FileCopyrightText = "Debian contributors"
 SPDX-License-Identifier = "GPL-2.0-or-later AND LGPL-2.0-or-later"
 
 [[annotations]]
 path = [
-  "esound-0001-alsa-drain-hang.patch",
-  "esound-0004-link-to-libm.patch",
+  "0001-alsa-drain-hang.patch",
+  "0004-link-to-libm.patch",
 ]
 SPDX-FileCopyrightText = "Fedora contributors"
 SPDX-License-Identifier = "GPL-2.0-or-later AND LGPL-2.0-or-later"
 
 [[annotations]]
-path = "esound-0002-undeclared-variable.patch"
+path = "0002-undeclared-variable.patch"
 SPDX-FileCopyrightText = "Gentoo contributors"
 SPDX-License-Identifier = "GPL-2.0-or-later AND LGPL-2.0-or-later"