Review Results

Comment

The .SRCINFO update is a routine version bump and metadata refresh for the Ubuntu fontconfig package. The sources remain HTTPS Launchpad tarballs with updated checksums, and there are no new build-time downloads, scripts, or privilege-related changes introduced by this diff. The added install file reference and provides/conflicts/replaces entries are consistent with packaging the docs split and do not by themselves indicate a security issue. No obvious supply-chain, persistence, or integrity red flags are present in this change alone.

@@ -1,47 +1,39 @@
 pkgbase = fontconfig-ubuntu
 	pkgdesc = A library for configuring and customizing font access (with Ubuntu patches)
-	pkgver = 2.15.0
-	pkgrel = 3
+	pkgver = 2.17.1
+	pkgrel = 1
 	url = https://launchpad.net/ubuntu/+source/fontconfig
+	install = fontconfig-ubuntu.install
 	arch = x86_64
-	license = LicenseRef-custom
-	checkdepends = unzip
-	makedepends = autoconf-archive
+	license = HPND AND Unicode-DFS-2016
 	makedepends = docbook-sgml
 	makedepends = docbook-utils
-	makedepends = expat
-	makedepends = freetype2
 	makedepends = gperf
-	makedepends = json-c
-	makedepends = lynx
+	makedepends = meson
 	makedepends = perl-sgmls
-	makedepends = python-lxml
-	makedepends = python-six
-	makedepends = texlive-formatsextra>=2017
-	makedepends = texlive-latexrecommended
-	source = https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/fontconfig/2.15.0-2.3ubuntu1/fontconfig_2.15.0.orig.tar.xz
-	source = https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/fontconfig/2.15.0-2.3ubuntu1/fontconfig_2.15.0-2.3ubuntu1.debian.tar.xz
-	source = fontconfig-ubuntu.hook
-	source = 40-fontconfig-config.hook
-	source = 40-fontconfig-config.script
-	sha256sums = 63a0658d0e06e0fa886106452b58ef04f21f58202ea02a94c39de0d3335d7c0e
-	sha256sums = dc8764d9fd779ae9185685f320a3b0ef8e796e2195346510c46d934dfd3b3350
-	sha256sums = fd7b6ce8ce178107f2e0b52462ebf186b6051c6eec945770107fda57048c9f34
-	sha256sums = 44f12491c9fd7eff825853846a2b3b8df2b96fc6520be5cb31ce7f37a160ff02
-	sha256sums = 7a9d50bccc709eb15db6ba8e13f69bc9d79b0bf354f1d17c1a5b2748edff3c33
-
-pkgname = fontconfig-ubuntu
-	install = fontconfig-ubuntu.install
 	depends = bash
 	depends = expat
-	depends = glibc
 	depends = freetype2
-	provides = fontconfig=2.15.0
+	depends = glibc
+	provides = fontconfig=2.17.1
 	provides = libfontconfig.so
+	provides = fontconfig-ubuntu-docs
+	provides = fontconfig-docs
 	conflicts = fontconfig
+	conflicts = fontconfig-ubuntu-docs
+	conflicts = fontconfig-docs
+	replaces = fontconfig-ubuntu-docs<2.17.1
 	options = !emptydirs
 	backup = etc/fonts/fonts.conf
+	source = https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/fontconfig/2.17.1-5ubuntu1/fontconfig_2.17.1.orig.tar.gz
+	source = https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/fontconfig/2.17.1-5ubuntu1/fontconfig_2.17.1-5ubuntu1.debian.tar.xz
+	source = fontconfig-ubuntu.hook
+	source = 40-fontconfig-config.hook
+	source = 40-fontconfig-config.script
+	sha256sums = f07504cef87f171ee1748352e2df9b9f125352f620fa0d03a9284306ea2c40a4
+	sha256sums = 0391e1a792af12272a0feee090bdcefea485a4eb25a1225ed93d28548870441b
+	sha256sums = fd7b6ce8ce178107f2e0b52462ebf186b6051c6eec945770107fda57048c9f34
+	sha256sums = 44f12491c9fd7eff825853846a2b3b8df2b96fc6520be5cb31ce7f37a160ff02
+	sha256sums = 7a9d50bccc709eb15db6ba8e13f69bc9d79b0bf354f1d17c1a5b2748edff3c33
 
-pkgname = fontconfig-ubuntu-docs
-	pkgdesc = A library for configuring and customizing font access (with Ubuntu patches) (documentation)
-	arch = any
+pkgname = fontconfig-ubuntu

Comment

The change is low risk overall. It updates the package to a newer Ubuntu release, switches from autotools to meson, and adjusts the source URLs/checksums accordingly. I did not find any suspicious build-time network fetches, shell-eval, privilege escalation, or install-script behavior beyond the expected fontconfig cache/configuration hooks. The main security-relevant change is that the package now provides/conflicts with the upstream `fontconfig` package and ships the library under the same SONAME, but that is an intentional replacement pattern for a distro-patched compatibility package rather than an obvious backdoor. No malicious content was present in the reviewed PKGBUILD diff or the associated .install/.hook/script files.

@@ -7,41 +7,39 @@
 # http://zipcon.net/~swhite/docs/computers/browsers/fonttest.html
 # http://getemoji.com/
 
-pkgbase=fontconfig-ubuntu
-pkgname=(
-    'fontconfig-ubuntu'
-    'fontconfig-ubuntu-docs')
-pkgver=2.15.0
-_uburel=2
-_ubuver=3ubuntu1
-pkgrel=3
+pkgname=fontconfig-ubuntu
+pkgver=2.17.1
+_ubuver=5ubuntu1
+_commit=6d0a98982ec351c165c9224c8b7dbdfca3010e47
+pkgrel=1
 pkgdesc='A library for configuring and customizing font access (with Ubuntu patches)'
 arch=('x86_64')
 url='https://launchpad.net/ubuntu/+source/fontconfig'
-license=('LicenseRef-custom')
+license=('HPND AND Unicode-DFS-2016')
+depends=(
+    'bash'
+    'expat'
+    'freetype2'
+    'glibc')
 makedepends=(
-    'autoconf-archive'
     'docbook-sgml'
     'docbook-utils'
-    'expat'
-    'freetype2'
     'gperf'
-    'json-c'
-    'lynx'
-    'perl-sgmls'
-    'python-lxml'
-    'python-six'
-    'texlive-formatsextra>=2017'
-    'texlive-latexrecommended')
-checkdepends=(
-    'unzip')
-source=("https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/fontconfig/${pkgver}-${_uburel}.${_ubuver}/fontconfig_${pkgver}.orig.tar.xz"
-        "https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/fontconfig/${pkgver}-${_uburel}.${_ubuver}/fontconfig_${pkgver}-${_uburel}.${_ubuver}.debian.tar.xz"
+    'meson'
+    'perl-sgmls')
+provides=("fontconfig=${pkgver}" 'libfontconfig.so' 'fontconfig-ubuntu-docs' 'fontconfig-docs')
+conflicts=('fontconfig' 'fontconfig-ubuntu-docs' 'fontconfig-docs')
+replaces=('fontconfig-ubuntu-docs<2.17.1')
+options=('!emptydirs')
+backup=('etc/fonts/fonts.conf')
+install=fontconfig-ubuntu.install
+source=("https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/fontconfig/${pkgver}-${_ubuver}/fontconfig_${pkgver}.orig.tar.gz"
+        "https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/fontconfig/${pkgver}-${_ubuver}/fontconfig_${pkgver}-${_ubuver}.debian.tar.xz"
         'fontconfig-ubuntu.hook'
         '40-fontconfig-config.hook'
         '40-fontconfig-config.script')
-sha256sums=('63a0658d0e06e0fa886106452b58ef04f21f58202ea02a94c39de0d3335d7c0e'
-            'dc8764d9fd779ae9185685f320a3b0ef8e796e2195346510c46d934dfd3b3350'
+sha256sums=('f07504cef87f171ee1748352e2df9b9f125352f620fa0d03a9284306ea2c40a4'
+            '0391e1a792af12272a0feee090bdcefea485a4eb25a1225ed93d28548870441b'
             'fd7b6ce8ce178107f2e0b52462ebf186b6051c6eec945770107fda57048c9f34'
             '44f12491c9fd7eff825853846a2b3b8df2b96fc6520be5cb31ce7f37a160ff02'
             '7a9d50bccc709eb15db6ba8e13f69bc9d79b0bf354f1d17c1a5b2748edff3c33')

Comment

The change is a packaging refactor from autotools to meson and updates the upstream source/version. I do not see any obvious supply-chain red flags in the diff: sources remain HTTPS from Launchpad, no new build-time network fetches, no shell-eval/curl|bash patterns, and the package still installs into $pkgdir. The only notable risk is that the package metadata now collapses the previous docs split into a single package and changes provides/conflicts/replaces, which could affect package replacement behavior, but that is not inherently malicious. Based on the provided diff, this looks low risk.

@@ -53,40 +51,26 @@ prepare() {
     do
         [ "$_patch" = '0001-Make-the-cache-filenames-determinstic.patch' ] && continue
         printf '%s\n' "  -> Applying Ubuntu patch: ${_patch}"
-        patch -d "fontconfig-${pkgver}" -Np1 -i "${srcdir}/debian/patches/${_patch}"
+        patch -d "fontconfig-${pkgver}-${_commit}" -Np1 -i "${srcdir}/debian/patches/${_patch}"
     done < <(sed '/^[[:space:]]*#/d' debian/patches/series)
 }
 
 build() {
-    cd "fontconfig-${pkgver}"
-    ./configure \
-        --prefix='/usr' \
-        --sysconfdir='/etc' \
-        --with-templatedir='/usr/share/fontconfig/conf.avail' \
-        --localstatedir='/var' \
-        --disable-static \
-        --with-default-fonts='/usr/share/fonts' \
-        --with-add-fonts='/usr/local/share/fonts'
-    make
+    arch-meson "fontconfig-${pkgver}-${_commit}" build \
+        -Dbitmap-conf='noinstall' \
+        -Ddefault-sub-pixel-rendering='noinstall' \
+        -Ddoc-html='enabled' \
+        -Ddoc-pdf='disabled' \
+        -Ddoc-txt='disabled'
+    meson compile -C build
 }
 
 check() {
-    make -C "fontconfig-${pkgver}" -k check
+    meson test -C build --print-errorlogs
 }
 
 package_fontconfig-ubuntu() {
-    depends=(
-        'bash'
-        'expat'
-        'glibc'
-        'freetype2')
-    provides=("fontconfig=${pkgver}" 'libfontconfig.so')
-    conflicts=('fontconfig')
-    options=('!emptydirs')
-    backup=('etc/fonts/fonts.conf')
-    install=fontconfig-ubuntu.install
-    
-    make -C "fontconfig-${pkgver}" DESTDIR="$pkgdir" install
+    meson install -C build --destdir "$pkgdir"
     
     # handle conf.d using the hook to avoid overwriting the symlinks on upgrade
     local _file

Comment

The change is low risk. It removes the split docs subpackage and switches the package to install documentation directly into the main package, while updating the source path to the new extracted directory name. I did not see any added network access, privilege escalation, suspicious scripts, or other execution red flags in the diff. The only notable packaging change is the new meson-based build and the updated source URLs/checksums, but those are standard for a version bump and use HTTPS with pinned release artifacts. The diff itself does not introduce a security issue.

@@ -100,19 +84,5 @@ package_fontconfig-ubuntu() {
     install -D -m644 *.hook -t "${pkgdir}/usr/share/libalpm/hooks"
     install -D -m755 40-fontconfig-config.script "${pkgdir}/usr/share/libalpm/scripts/40-fontconfig-config"
     install -D -m644 debian/changelog -t "${pkgdir}/usr/share/doc/${pkgname}"
-    install -D -m644 "fontconfig-${pkgver}/COPYING" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
-    
-    # split docs
-    [ -d 'docs' ] && rm -rf docs
-    mkdir -p docs/share/man
-    mv "${pkgdir}/usr/share/doc" docs/share
-    mv "${pkgdir}/usr/share/man/man3" docs/share/man
-}
-
-package_fontconfig-ubuntu-docs() {
-    pkgdesc+=' (documentation)'
-    arch=('any')
-    
-    mv docs "${pkgdir}/usr"
-    install -D -m644 "fontconfig-${pkgver}/COPYING" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+    install -D -m644 "fontconfig-${pkgver}-${_commit}/COPYING" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }