Review Results

Comment

The change only updates the upstream source URL in .SRCINFO from an old GNOME FTP mirror to the official GitLab archive tarball for the same tagged release, and refreshes the corresponding b2sum. This does not introduce new build steps, scripts, privileges, or runtime behavior. The new source is HTTPS and pinned to a specific release archive, so there is no obvious supply-chain or integrity regression in this diff.

@@ -18,7 +18,7 @@ pkgbase = esound
 	conflicts = esd
 	options = !libtool
 	backup = etc/esd.conf
-	source = https://ftp.gnome.org/pub/GNOME/sources/esound/0.2/esound-0.2.41.tar.bz2
+	source = esound-0.2.41.tar.bz2::https://gitlab.gnome.org/Archive/esound/-/archive/ESOUND_0_2_41/esound-ESOUND_0_2_41.tar.bz2
 	source = esound-system.service
 	source = esound-user.service
 	source = 0001-alsa-drain-hang.patch

Comment

The change only updates the upstream source URL from an old GNOME FTP mirror to the official GitLab archive tarball and refreshes the corresponding B2 checksum in .SRCINFO. This is a supply-chain hygiene improvement, not an execution or privilege-risk change. No new sources, scripts, build steps, or packaging behaviors are introduced in the reviewed hunk.

@@ -29,7 +29,7 @@ pkgbase = esound
 	source = 0006-revert-close-file-descriptors.patch
 	source = 0007-fix-wrong-micro-version.patch
 	source = 0008-move-nobeeps-option.patch
-	b2sums = 39403985557f44b99a6615e42f6772a31b8555cc3bf252140e36f55c812b4728ca7af519267ff1c8f4bd53604d82edbf682d07b16e98158ca39bbe8663bbaadd
+	b2sums = db1945ee0b5514bb2d5b98e295e71bcf368124c607c7bf3b34189e36d8212da13eed819cc7aa15bf7c876677b6a48a1d1afa1312c6ab9cfb675a33e452acb13d
 	b2sums = 1b55880c8212f2e85312c632ab79f1ff36d527c7463aa16fb932f324c496a5a67d109372aff657b59812b9fabe8c5978434e078e7a91868298731ab11ea48f2d
 	b2sums = b84310149765ca3caa7b0b93298af758b0ffbb04b16c3946b3fc8e0ad4e559d7f6221a956dd30a8f01a5e60d85386431078619b683e0d6a447bc1c9363a00e27
 	b2sums = 9fdfe5d289261a8bd9df6cca99e996df5ad066e7d7c0a9027e6e3387162ed5651f947b24cd1fcb3803b27e49a187896511288efe6350a1fb620a60872a3c79a6

Comment

The change is low risk. It switches the upstream source tarball from GNOME FTP to the project’s GitLab archive URL, which is HTTPS and still tied to the official upstream repository. The new filename/tag mapping is consistent with the package version, and the checksum was updated accordingly. The rest of the diff only changes the extracted directory name and adds autotools regeneration commands in prepare(); while those commands execute build-time tooling, they are standard for rebuilding from source and do not introduce obvious network fetches, privilege escalation, or persistence mechanisms. The shipped systemd units are unchanged and do not add suspicious behavior in this diff.

@@ -19,7 +19,7 @@ provides=("esd=${pkgver}")
 conflicts=('esd')
 options=(!libtool)
 backup=('etc/esd.conf')
-source=("https://ftp.gnome.org/pub/GNOME/sources/${pkgname}/${pkgver%.*}/${pkgname}-${pkgver}.tar.bz2"
+source=("${pkgname}-${pkgver}.tar.bz2::${url}/-/archive/ESOUND_${pkgver//./_}/${pkgname}-ESOUND_${pkgver//./_}.tar.bz2"
         'esound-system.service'
         'esound-user.service'
         '0001-alsa-drain-hang.patch'

Comment

The change switches the source from an official GNOME tarball to a GitLab auto-generated archive URL on the upstream project, and updates the checksum accordingly. That is not inherently malicious, but it does introduce a less stable source format and, more importantly, adds multiple autotools regeneration commands in prepare() (aclocal, libtoolize, autoreconf, automake, autoreconf) that execute build-time tooling beyond the unpacked source. This is a supply-chain hygiene regression because it increases reliance on the local build environment and can alter generated build scripts, though there is no direct evidence of network fetches, privilege escalation, or payload installation outside pkgdir. Overall this looks low risk but worth scrutiny due to the expanded build-time code execution surface.

@@ -30,7 +30,7 @@ source=("https://ftp.gnome.org/pub/GNOME/sources/${pkgname}/${pkgver%.*}/${pkgna
         '0006-revert-close-file-descriptors.patch'
         '0007-fix-wrong-micro-version.patch'
         '0008-move-nobeeps-option.patch')
-b2sums=('39403985557f44b99a6615e42f6772a31b8555cc3bf252140e36f55c812b4728ca7af519267ff1c8f4bd53604d82edbf682d07b16e98158ca39bbe8663bbaadd'
+b2sums=('db1945ee0b5514bb2d5b98e295e71bcf368124c607c7bf3b34189e36d8212da13eed819cc7aa15bf7c876677b6a48a1d1afa1312c6ab9cfb675a33e452acb13d'
         '1b55880c8212f2e85312c632ab79f1ff36d527c7463aa16fb932f324c496a5a67d109372aff657b59812b9fabe8c5978434e078e7a91868298731ab11ea48f2d'
         'b84310149765ca3caa7b0b93298af758b0ffbb04b16c3946b3fc8e0ad4e559d7f6221a956dd30a8f01a5e60d85386431078619b683e0d6a447bc1c9363a00e27'
         '9fdfe5d289261a8bd9df6cca99e996df5ad066e7d7c0a9027e6e3387162ed5651f947b24cd1fcb3803b27e49a187896511288efe6350a1fb620a60872a3c79a6'

Comment

The change is low risk. It switches the source tarball from the old GNOME FTP release to the upstream GitLab archive for the same project/tag and updates the build directory name accordingly. The added autoreconf/autotools regeneration is a normal packaging adjustment for a source tree that now comes from a VCS-style archive, and there are no signs of network fetches during build, privilege escalation, install-script abuse, or suspicious payloads. The only notable change is that the package now builds from an upstream archive snapshot rather than the old release tarball, but the URL is official and pinned to a specific tag, so integrity risk is limited.

@@ -43,7 +43,7 @@ b2sums=('39403985557f44b99a6615e42f6772a31b8555cc3bf252140e36f55c812b4728ca7af51
         '9c582773f7d754a54af4035c31edf504b78406048d2ef1cfea462f3e34dacbee9b67d10d2e028c58c5bd1765034534b7f61cc07d9e6692bbdfe0a3c7ed070f62')
 
 prepare() {
-  cd "esound-${pkgver}"
+  cd "${pkgname}-ESOUND_${pkgver//./_}"
 
   patch -t -Np1 -i ../0001-alsa-drain-hang.patch
   patch -t -Np1 -i ../0002-undeclared-variable.patch

Comment

The change switches the source from the official GNOME tarball to a GitLab archive snapshot and adds an autoreconf/bootstrap sequence in prepare(). I do not see direct malicious behavior, but this does increase supply-chain risk because the build now depends on generated autotools files from the fetched archive and runs multiple code-generation tools during build. The source is still HTTPS and points to the upstream project, and there are no obvious curl|bash, privilege escalation, or install-script red flags in this diff. The build directory rename appears consistent with the new archive naming. Overall this is a moderate integrity/regression risk rather than a clear security issue.

@@ -53,10 +53,16 @@ prepare() {
   patch -t -Np1 -i ../0006-revert-close-file-descriptors.patch
   patch -t -Np1 -i ../0007-fix-wrong-micro-version.patch
   patch -t -Np1 -i ../0008-move-nobeeps-option.patch
+
+  aclocal
+  libtoolize --no-warnings
+  autoreconf --install
+  automake --add-missing
+  autoreconf
 }
 
 build() {
-  cd "esound-${pkgver}"
+  cd "${pkgname}-ESOUND_${pkgver//./_}"
 
   ./configure --prefix=/usr \
     --sysconfdir=/etc \

Comment

The change is low risk. It switches the source tarball from the old GNOME FTP release to the GitLab archive for the same upstream project, with a matching checksum update. The build/package directory names are adjusted to match the new archive layout, and the added autotools regeneration commands are standard for building from an archive snapshot. I do not see any network fetches outside source=(), privilege escalation, suspicious install-script behavior, or other backdoor/persistence indicators in this diff.

@@ -68,11 +74,11 @@ build() {
     --disable-static \
     --disable-artstest
 
-  make CFLAGS="${CFLAGS} -lm"
+  make
 }
 
 package() {
-  cd "esound-${pkgver}"
+  cd "${pkgname}-ESOUND_${pkgver//./_}"
 
   make DESTDIR="${pkgdir}" install