Review Results

Comment

The only change in this diff is a pkgrel bump from 1 to 2 in .SRCINFO. This is a metadata-only packaging revision with no source, dependency, install-script, or build logic changes, so it does not introduce a security concern by itself.

@@ -1,7 +1,7 @@
 pkgbase = octopi
 	pkgdesc = A powerful Pacman frontend using Qt libs
 	pkgver = 0.19.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://github.com/aarnt/octopi
 	arch = x86_64
 	license = GPL-2.0-or-later

Comment

The change is low risk. It only updates .SRCINFO metadata: reorders optdepends, adds an explicit `options = !lto`, and pins the `alpm_octopi_utils` VCS source to a specific commit with a corresponding checksum instead of `SKIP`. This improves integrity/reproducibility rather than introducing new execution paths, network fetches, privilege changes, or suspicious install behavior. No evidence of malicious packaging behavior in this diff.

@@ -18,18 +18,19 @@ pkgbase = octopi
 	optdepends = inxi: for SysInfo log
 	optdepends = lsb-release: for SysInfo log
 	optdepends = mhwd: for SysInfo log
-	optdepends = pacaur: for AUR support
+	optdepends = systemd: for SysInfo log
 	optdepends = pacmanlogviewer: to view pacman log files
+	optdepends = pacaur: for AUR support
 	optdepends = paru: for AUR support
 	optdepends = pikaur: for AUR support
-	optdepends = systemd: for SysInfo log
 	optdepends = trizen: for AUR support
 	optdepends = yay: for AUR support
 	conflicts = alpm_octopi_utils
+	options = !lto
 	source = octopi-0.19.0.tar.gz::https://github.com/aarnt/octopi/archive/refs/tags/v0.19.0.tar.gz
-	source = alpm_octopi_utils::git+https://github.com/aarnt/alpm_octopi_utils.git#commit=789ba9acc52b7b0624fb08de9f4756b5d51c10f1
+	source = alpm_octopi_utils::git+https://github.com/aarnt/alpm_octopi_utils.git#commit=0ed2a8bd6b869f40683cf7a79727dc64d7da274e
 	sha256sums = bf2f6e2ab6208a020fd34fa6d88eaad5268132c4e38369818fd74267c0c54525
-	sha256sums = SKIP
+	sha256sums = 25c8f9ce3f24f5f9bf271c1acbf4935ee3ed1ff12bd66e9f3115b9d40c53bebe
 
 pkgname = octopi
 	depends = qt6-base

Comment

The change is low risk. It updates the pinned commit for the `alpm` submodule/source and removes an unused checksum variable, with no new code execution paths, network fetches, privilege changes, or packaging/install-script changes. The only substantive effect is sourcing a different upstream revision, which would warrant a deeper review of the fetched content itself, but this diff alone does not introduce a clear security issue.

@@ -2,14 +2,12 @@
 # Contributor: Mark Wagie <mark dot wagie at proton dot me>
 # Contributor: MatMoul <matmoul at the google email domain which is .com>
 
-: ${_commit_alpm=789ba9acc52b7b0624fb08de9f4756b5d51c10f1}
-
-: ${_cksum_octopi=bf2f6e2ab6208a020fd34fa6d88eaad5268132c4e38369818fd74267c0c54525}
+: ${_commit_alpm=0ed2a8bd6b869f40683cf7a79727dc64d7da274e}
 
 _pkgname="octopi"
 pkgname="$_pkgname"
 pkgver=0.19.0
-pkgrel=1
+pkgrel=2
 pkgdesc="A powerful Pacman frontend using Qt libs"
 url="https://github.com/aarnt/octopi"
 license=('GPL-2.0-or-later')

Comment

The change is low risk. It only restructures the PKGBUILD to use static source arrays and build both components in a single build() function, while keeping the same upstream HTTPS source and the same git dependency. The only notable behavior change is adding a conditional SKIP checksum for the optional pinned commit of alpm_octopi_utils, which is standard for VCS sources and does not introduce new network fetches or privilege escalation. No suspicious install scripts, systemd units, or post-install actions are introduced by this diff.

@@ -33,80 +31,66 @@ optdepends=(
   'inxi: for SysInfo log'
   'lsb-release: for SysInfo log'
   'mhwd: for SysInfo log'
-  'pacaur: for AUR support'
+  'systemd: for SysInfo log'
   'pacmanlogviewer: to view pacman log files'
+  'pacaur: for AUR support'
   'paru: for AUR support'
   'pikaur: for AUR support'
-  'systemd: for SysInfo log'
   'trizen: for AUR support'
   'yay: for AUR support'
 )
 
-_source_octopi() {
-  _pkgsrc_octopi="$_pkgname-$pkgver"
-  local _pkgext="tar.gz"
-  source+=("$_pkgsrc_octopi.$_pkgext"::"$url/archive/refs/tags/v$pkgver.$_pkgext")
-  sha256sums+=("${_cksum_octopi:-SKIP}")
-
-  _prepare_octopi() (
-    :
-  )
-
-  _build_octopi() (
-    local _cmake_options=(
-      -B build_octopi
-      -S "$_pkgsrc_octopi"
-      -G Ninja
-      -DCMAKE_BUILD_TYPE=None
-      -DCMAKE_INSTALL_PREFIX='/usr'
-      -Dalpm_octopi_utils_DIR="'$srcdir/fakeinstall/usr/lib/cmake/alpm_octopi_utils/'"
-      -Wno-dev
-    )
-
-    cmake "${_cmake_options[@]}"
-    cmake --build build_octopi
-  )
-}
+conflicts=('alpm_octopi_utils')
 
-_source_alpm_utils() {
-  conflicts+=('alpm_octopi_utils')
+options=('!lto')
 
-  _pkgsrc_alpm_utils="alpm_octopi_utils"
-  source+=("$_pkgsrc_alpm_utils"::"git+https://github.com/aarnt/alpm_octopi_utils.git${_commit_alpm:+#commit=$_commit_alpm}")
-  sha256sums+=('SKIP')
+_pkgsrc_octopi="$_pkgname-$pkgver"
+_pkgsrc_alpm_utils="alpm_octopi_utils"
+_pkgext="tar.gz"
 
-  _prepare_alpm_utils() {
-    :
-  }
+source=(
+  "$_pkgsrc_octopi.$_pkgext"::"$url/archive/refs/tags/v$pkgver.$_pkgext"
+  "$_pkgsrc_alpm_utils"::"git+https://github.com/aarnt/alpm_octopi_utils.git${_commit_alpm:+#commit=$_commit_alpm}"
+)
+sha256sums=(
+  'bf2f6e2ab6208a020fd34fa6d88eaad5268132c4e38369818fd74267c0c54525'
+  '25c8f9ce3f24f5f9bf271c1acbf4935ee3ed1ff12bd66e9f3115b9d40c53bebe'
+)
 
-  _build_alpm_utils() (
-    local _cmake_options=(
-      -B build_alpm
-      -S "$_pkgsrc_alpm_utils"
-      -G Ninja
-      -DCMAKE_BUILD_TYPE=None
-      -DCMAKE_INSTALL_PREFIX='/usr'
-      -Wno-dev
-    )
+if [ -z "$_commit_alpm" ]; then
+  sha256sums[1]='SKIP'
+fi
 
-    cmake "${_cmake_options[@]}"
-    cmake --build build_alpm
+build() {
+  local _cmake_common=(
+    -G Ninja
+    -DCMAKE_BUILD_TYPE=None
+    -DCMAKE_INSTALL_PREFIX='/usr'
+    -DCMAKE_SKIP_RPATH=ON
+    -Wno-author
+  )
 
-    DESTDIR="fakeinstall" cmake --install build_alpm
+  echo "Building alpm_utils..."
+  local _cmake_alpm=(
+    -B build_alpm
+    -S "$_pkgsrc_alpm_utils"
   )
-}
 
-_source_octopi
-_source_alpm_utils
+  cmake "${_cmake_common[@]}" "${_cmake_alpm[@]}"
+  cmake --build build_alpm
 
-prepare() {
-  _prepare_octopi
-  _prepare_alpm_utils
-}
+  DESTDIR="fakeinstall" cmake --install build_alpm
 
-build() {
-  _build_alpm_utils
-  _build_octopi
+  echo "Building octopi..."
+  local _cmake_octopi=(
+    -B build_octopi
+    -S "$_pkgsrc_octopi"
+    -Dalpm_octopi_utils_DIR="$srcdir/fakeinstall/usr/lib/cmake/alpm_octopi_utils/"
+    -DUSE_KF6NOTIFICATIONS=OFF
+  )
+
+  cmake "${_cmake_common[@]}" "${_cmake_octopi[@]}"
+  cmake --build build_octopi
 }
 
 package() {

Comment

The change only relocates an installed SVG icon from the 48x48 hicolor directory to the scalable hicolor directory during package() and creates the destination directory. This is a packaging fix, not a code-execution or privilege-related change. It does not introduce new sources, network access, install scripts, or system-wide side effects beyond the package payload itself. The only risk is a potential packaging mistake if the source file path is wrong, but that would be a build-time failure or missing icon, not a security issue.

@@ -121,6 +105,11 @@ package() {
   # library
   install -Dm644 "fakeinstall/usr/lib/libalpm_octopi_utils.so" -t "$pkgdir/usr/lib/"
 
+  # fix svg path
+  local _svg_path="usr/share/icons/hicolor/scalable/apps"
+  mkdir -pm755 "$pkgdir/$_svg_path"
+  mv "$pkgdir/usr/share/icons/hicolor/48x48/apps/octopi.svg" "$pkgdir/$_svg_path/"
+
   # not needed for standard licenses
   rm -rf "$pkgdir/usr/share/licenses/"
 }