Review Results

Comment

The change is low risk. It updates the package to a new upstream Proton-GE release, adds the corresponding aarch64 architecture entry, and refreshes the source URL/checksum metadata. The only integrity concern is that the tarball source is now marked with SKIP in .SRCINFO, but the authoritative PKGBUILD still pins the release tarball URL and includes a checksum entry for the remaining source files; this appears to be a metadata regeneration artifact rather than a new trust boundary or execution path. No new scripts, install hooks, or build-time network behavior were introduced by this diff.

@@ -1,12 +1,13 @@
 pkgbase = proton-ge-custom-bin
 	pkgdesc = A fancy custom distribution of Valves Proton with various patches
-	pkgver = GE_Proton10_34
+	pkgver = GE_Proton11_5
 	pkgrel = 1
 	epoch = 1
 	url = https://github.com/GloriousEggroll/proton-ge-custom
 	install = pleasenote.install
 	changelog = changelog.md
 	arch = x86_64
+	arch = aarch64
 	license = BSD
 	license = LGPL
 	license = zlib

Comment

The change only adds an optional dependency entry in .SRCINFO for lib32-vulkan-icd-loader with a descriptive note. This is metadata-only, does not alter build steps, sources, install scripts, or shipped artifacts, and introduces no obvious security risk by itself.

@@ -17,6 +18,7 @@ pkgbase = proton-ge-custom-bin
 	optdepends = vulkan-icd-loader
 	optdepends = lib32-openal
 	optdepends = lib32-vkd3d
+	optdepends = lib32-vulkan-icd-loader: dxvk dependency for 32bit prefixes
 	optdepends = lib32-libva
 	optdepends = lib32-speex
 	optdepends = lib32-libtheora

Comment

The change updates the package to a newer upstream Proton-GE release and adds a new conflict with proton-ge-bin. The only notable integrity regression is that the main source tarball checksum is replaced with SKIP, which removes verification of a prebuilt binary download from GitHub. That weakens supply-chain integrity and would allow a tampered release asset to be accepted, but there is no evidence in this diff of additional malicious behavior, build-time code execution, or persistence mechanisms. Overall this is a moderate trust/integrity concern rather than a high-severity backdoor.

@@ -35,24 +37,24 @@ pkgbase = proton-ge-custom-bin
 	optdepends = zenity: GNOME splash dialog support
 	optdepends = python-kivy: splash dialog support (big picture mode)
 	optdepends = steam: use proton with steam like intended
-	optdepends = lib32-vulkan-icd-loader: dxvk dependency for 32bit prefixes
 	optdepends = vulkan-driver: driver to be used by dxvk
 	optdepends = winetricks: protonfixes backend - highly recommended
 	optdepends = wine: support for 32bit prefixes
 	optdepends = xboxdrv: gamepad driver service
 	provides = proton
-	provides = proton-ge-custom=GE.Proton10_34
+	provides = proton-ge-custom=GE.Proton11_5
 	conflicts = proton-ge-custom
+	conflicts = proton-ge-bin
 	options = !strip
 	options = emptydirs
 	backup = usr/share/steam/compatibilitytools.d/proton-ge-custom/user_settings.py
-	source = GE-Proton10-34_1.tar.gz::https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton10-34/GE-Proton10-34.tar.gz
+	source = GE-Proton11-5_1.tar.gz::https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton11-5/GE-Proton11-5-x86_64.tar.gz
 	source = user_settings.py
 	source = launcher.sh
 	source = proton-ge-custom-bin.conf
 	source = pam_limits.conf
-	sha512sums = 9fd0b2cfbd501c0b5c892239c392c7283a029b5e5d5a77d3f85b0ce190d555456241a18eebca16b53f094b403499201c13550a3f0b9b365e1a5eb5737cbb7303
-	sha512sums = 09b6523516b07ec40b895867ef3cdb5dfb1eda6b188d0edf0acea9c3141583f43b2b5c1a396f4d52eb2ddb3ae6f111b4a7bc6409c003f09ff8c505b81f2a7297
+	sha512sums = SKIP
+	sha512sums = 5d1a841d3f8f65f9e62742f84eeccfb198a0292a97ba9109f377a550a4de0e2913d1e17b3d90ecd37ac09411dc67e54662dc1be301554ce05fd128d842252deb
 	sha512sums = 78ede6d50f9c43407da511c8b37dcf60aae2ddbd461c0081f0d0ce3de08ace3a84dee86e9253acbac829b47c5818ef4e1a354ccb05feaa9853ce279dc3f903fd
 	sha512sums = ac2bd634838ffe6b90f2637e229013f0993fc1013271dbeefd216dc262a8bb79e4a5ce15a75cbfcb0c3b521d32f4ebe1ed25a6b066b99cc327b60bd6d7212e6f
 	sha512sums = 60bcb1ad899d108fca9c6267321d11871feae96b696e44607ef533becc6decb493e93cbe699382e8163ad83f35cfa003a059499c37278f31afeba4700be6e356

Comment

The change only adds `.idea` to `.gitignore`, which is a benign repository hygiene update to ignore JetBrains IDE metadata. It does not affect build logic, sources, packaging, install scripts, or runtime behavior, and introduces no security-relevant execution or integrity risk.

@@ -5,3 +5,4 @@ src/
 .trunk/
 .vscode/
 .shellcheckrc
+.idea
\ No newline at end of file

Comment

The change is low risk. It updates package metadata only: version bump, adds aarch64 support, and expands conflicts/optdepends. I did not see any new build-time code execution, network fetches, privilege escalation, install scripts, or shipped binaries/units introduced by this hunk. The only noteworthy point is the new aarch64 architecture declaration for a prebuilt binary package, which could be a packaging-quality concern if upstream artifacts are not actually available for that architecture, but it is not a security issue by itself.

@@ -1,30 +1,28 @@
-## Maintainer:     Jaja <jaja@mailbox.org>
-## Co-Maintainer:  floriplum <floriplum@mailbox.org>
-## Co-Maintainer:  various people submitting to 'chaotic-aur' repo
-## Credits:        barfin (aka RogueGirl) <barfin@protonmail.com>
-
-## Linted using:
-##   $ shellcheck PKGBUILD -e SC2034,SC2148,SC2154
-## Formated using:
-##   $ shfmt -w PKGBUILD
+# Maintainer: Thomas Ludwig <business at tludwig dot dev>
+# Contributor:     Jaja <jaja@mailbox.org>
+# Contributor:  floriplum <floriplum@mailbox.org>
+# Contributor:  various people submitting to 'chaotic-aur' repo
+# Contributor:        barfin (aka RogueGirl) <barfin@protonmail.com>
 
 ## pkginfo
 pkgdesc='A fancy custom distribution of Valves Proton with various patches'
 pkgname=proton-ge-custom-bin
-pkgver=GE_Proton10_34
+pkgver=GE_Proton11_5
 pkgrel=1
 epoch=1
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 license=('BSD' 'LGPL' 'zlib' 'MIT' 'MPL' 'custom')
 changelog=changelog.md
 provides=('proton' "proton-ge-custom=${pkgver/_/.}")
-conflicts=('proton-ge-custom')
+conflicts=('proton-ge-custom' 'proton-ge-bin')
 
 ## dependencies
 depends=('python')
-optdepends=('vulkan-icd-loader'
+optdepends=(
+  'vulkan-icd-loader'
   'lib32-openal'
   'lib32-vkd3d'
+  'lib32-vulkan-icd-loader: dxvk dependency for 32bit prefixes'
   # libav support #
   'lib32-libva'
   'lib32-speex'

Comment

The change is a trivial PKGBUILD metadata edit: it removes one optional dependency entry and reflows the optdepends array formatting. No build logic, source URLs, install scripts, permissions, or package contents are affected. I found no security-relevant behavior introduced by this diff.

@@ -47,11 +45,11 @@ optdepends=('vulkan-icd-loader'
   'zenity: GNOME splash dialog support'
   'python-kivy: splash dialog support (big picture mode)'
   'steam: use proton with steam like intended'
-  'lib32-vulkan-icd-loader: dxvk dependency for 32bit prefixes'
   'vulkan-driver: driver to be used by dxvk'
   'winetricks: protonfixes backend - highly recommended'
   'wine: support for 32bit prefixes'
-  'xboxdrv: gamepad driver service')
+  'xboxdrv: gamepad driver service'
+)
 
 ## makepkg options
 options=(!strip emptydirs)

Comment

Risk is low. The change only adjusts the upstream release asset path and extracted source directory to be architecture-specific, and adds aarch64 support. I do note that the new source checksum is set to SKIP, which weakens integrity verification for the downloaded release tarball, but this package already relies on upstream release artifacts and the change does not introduce new execution paths, scripts, or privilege-sensitive behavior. No suspicious network fetches, install-script changes, or persistence mechanisms are present in this diff.

@@ -60,7 +58,7 @@ install=pleasenote.install
 ## fix naming conventions, matching upstream
 _pkgname=${pkgname//-bin/}
 _pkgver=${pkgver//_/-}
-_srcdir=${_pkgver}
+_srcdir="${_pkgver}-${CARCH}"
 
 ## paths and files
 _protondir=usr/share/steam/compatibilitytools.d/${_pkgname}

Comment

The change switches the upstream release asset from a generic tarball to an architecture-specific tarball and updates the expected checksum for one of the shipped helper files. I do not see any new code execution, privilege escalation, install-script behavior, or network fetches beyond the existing release download. The source remains on the official GitHub release page over HTTPS, and the package still only installs the expected Proton payload and helper scripts. The main security impact is reduced integrity assurance for the main archive because its checksum is now SKIP, but that is a packaging trust issue rather than an introduced exploit in this diff. Overall this looks low risk.

@@ -73,13 +71,13 @@ backup=("$_protoncfg")
 
 ## sources
 url='https://github.com/GloriousEggroll/proton-ge-custom'
-source=("${_pkgver}_${pkgrel}.tar.gz::${url}/releases/download/${_pkgver}/${_pkgver}.tar.gz"
+source=("${_pkgver}_${pkgrel}.tar.gz::${url}/releases/download/${_pkgver}/${_pkgver}-${CARCH}.tar.gz"
   'user_settings.py'
   'launcher.sh'
   'proton-ge-custom-bin.conf'
   'pam_limits.conf')
-sha512sums=('9fd0b2cfbd501c0b5c892239c392c7283a029b5e5d5a77d3f85b0ce190d555456241a18eebca16b53f094b403499201c13550a3f0b9b365e1a5eb5737cbb7303'
-  '09b6523516b07ec40b895867ef3cdb5dfb1eda6b188d0edf0acea9c3141583f43b2b5c1a396f4d52eb2ddb3ae6f111b4a7bc6409c003f09ff8c505b81f2a7297'
+sha512sums=('SKIP'
+  '5d1a841d3f8f65f9e62742f84eeccfb198a0292a97ba9109f377a550a4de0e2913d1e17b3d90ecd37ac09411dc67e54662dc1be301554ce05fd128d842252deb'
   '78ede6d50f9c43407da511c8b37dcf60aae2ddbd461c0081f0d0ce3de08ace3a84dee86e9253acbac829b47c5818ef4e1a354ccb05feaa9853ce279dc3f903fd'
   'ac2bd634838ffe6b90f2637e229013f0993fc1013271dbeefd216dc262a8bb79e4a5ce15a75cbfcb0c3b521d32f4ebe1ed25a6b066b99cc327b60bd6d7212e6f'
   '60bcb1ad899d108fca9c6267321d11871feae96b696e44607ef533becc6decb493e93cbe699382e8163ad83f35cfa003a059499c37278f31afeba4700be6e356')

Comment

The change only adds/adjusts commented-out example Proton environment variables in user_settings.py, with no executable code, no build/install behavior, and no privilege/network/persistence impact. The new entries are documentation-only and remain disabled, so there is no security-relevant runtime effect in the packaged artifact.

@@ -2,6 +2,8 @@
 
 user_settings = {
     ###### Proton GE flags ######
+    # preserve ps4 dualsense layout and identity to show the correct symbols ingame.
+#    "PROTON_SONY_DUALSENSE_AS_DUALSHOCK4": "1",
 
     #Disables DX12.
 #    "PROTON_NO_D3D12": "1",

Comment

The change only adds two commented-out example settings in user_settings.py and fixes a comment syntax typo. No executable code, no network activity, no privilege changes, and no packaging/install behavior are introduced. This is effectively documentation/example-only and does not alter runtime behavior unless a user manually edits the file later.

@@ -94,7 +96,13 @@ user_settings = {
 #    "PROTON_PREFER_SDL": "1",
 
     #Tells Proton to use the winegstreamer backend instead of winedmo. Winedmo was introduced in Proton 10. Useful for games that regressed from Proton 9 to Proton 10
-#   "PROTON_MEDIA_USE_GST"  "1",
+#   "PROTON_MEDIA_USE_GST":  "1",
+
+    # Enable Proton Discord Bridge
+#   "PROTON_DISCORD_BRIDGE": "1",
+
+    # Enable Translation Layer for DLSS to FSR
+#   "PROTON_USE_OPTISCALER": "1",
 
     ###### DXVK flags ######
 

Comment

The change only adds commented-out example entries to user_settings.py, with no executable code, no new sources, no build-time network access, and no packaging/persistence impact. It does mention additional Proton/Wine environment flags, but they are disabled by default and merely document optional user configuration. No security-relevant behavior is introduced by this diff.

@@ -145,4 +153,12 @@ user_settings = {
     #or, verbose converter logging (may impact playback performance):
 #    "GST_DEBUG": "4,WINE:7,protonaudioconverter:7,protonaudioconverterbin:7,protonvideoconverter:7",
 #    "GST_DEBUG_NO_COLOR": "1",
+
+    ###### Wine flags ######
+
+    # Enable spacial downmix override for winealsa.
+    #    "WINEALSA_SPACIAL": "1",
+
+    # Finetune the Audio Channels for winealsa (2 to disable spatial, 4 for 2 front 2 rear, 6 for 5.1 8 for 7.1).
+    #    "WINEALSA_CHANNELS": "2",
 }