Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 0.5.0 to 0.7.0. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the provided diff. On its face this is a routine upstream version update with no security red flags visible in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = xevd
 	pkgdesc = MPEG-5 EVC (Essential Video Coding) decoder
-	pkgver = 0.5.0
+	pkgver = 0.7.0
 	pkgrel = 1
 	url = https://github.com/mpeg5/xevd/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from xevd 0.5.0 to 0.7.0 with updated checksums. The source remains the official GitHub upstream archive over HTTPS, and the accompanying patch checksums were updated accordingly. No new sources, build-time downloads, install scripts, or privilege-related artifacts are introduced by this diff. Based on the provided hunk alone, this appears low risk.

@@ -8,11 +8,11 @@ pkgbase = xevd
 	makedepends = cmake
 	depends = glibc
 	options = !emptydirs
-	source = https://github.com/mpeg5/xevd/archive/v0.5.0/xevd-0.5.0.tar.gz
+	source = https://github.com/mpeg5/xevd/archive/v0.7.0/xevd-0.7.0.tar.gz
 	source = 010-xevd-disable-werror.patch
 	source = 020-xevd-fix-pkg-config.patch
-	sha256sums = 8d55c7ec1a9ad4e70fe91fbe129a1d4dd288bce766f466cba07a29452b3cecd8
-	sha256sums = 2a7eff2690c0d4d441df97ad37fd7a0e3e0a03705665dad12201f8d8d997f191
+	sha256sums = febfdb532819bbf36b1b04e74d3ef328ad0f0f2db6224ddb7640fce6bd0014f4
+	sha256sums = a7a22d26772657046475b1e664cbab3331355aef847f51bbb74d0bede25462f2
 	sha256sums = 28e46788d188dbbd27c0b47d2c4510029491f434cccfa41967b60d94def36d4a
 
 pkgname = xevd

Comment

The patch only removes `-Werror` from the project's CMake compiler flags. This reduces build strictness but does not introduce new code execution, network access, privilege escalation, persistence, or packaging integrity issues. The change is limited to build configuration and is a common compatibility fix for newer toolchains.

@@ -1,11 +1,11 @@
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -105,7 +105,7 @@ elseif( UNIX OR MINGW )
-         set(OPT_DBG "-DNDEBUG") # disable assert
+@@ -136,7 +136,7 @@ elseif( UNIX OR MINGW )
      endif()
  
--    set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -${OPT_LV} ${OPT_DBG} -fomit-frame-pointer -Wall -Wno-unused-function -Wno-unused-but-set-variable -Wno-unused-variable -Wno-attributes -Werror -Wno-unknown-pragmas -Wno-stringop-overflow -std=c99")
-+    set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -${OPT_LV} ${OPT_DBG} -fomit-frame-pointer -Wall -Wno-unused-function -Wno-unused-but-set-variable -Wno-unused-variable -Wno-attributes -Wno-unknown-pragmas -Wno-stringop-overflow -std=c99")
-     set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-pointer-sign -pthread -Wno-pointer-to-int-cast -Wno-maybe-uninitialized")
+     set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -${OPT_LV} ${OPT_DBG} -fomit-frame-pointer -pthread -std=c99")
+-    set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Werror -Wno-pointer-sign -Wno-pointer-to-int-cast -Wno-maybe-uninitialized -Wno-unused-function -Wno-unused-but-set-variable -Wno-unused-variable -Wno-attributes -Wno-unknown-pragmas -Wno-stringop-overflow")
++    set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wno-pointer-sign -Wno-pointer-to-int-cast -Wno-maybe-uninitialized -Wno-unused-function -Wno-unused-but-set-variable -Wno-unused-variable -Wno-attributes -Wno-unknown-pragmas -Wno-stringop-overflow")
      set (CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -lm")
  endif()
+ 

Comment

Low risk. The change is limited to a version bump, updated source/checksums, and a minor CMake warning flag change. The source remains an HTTPS GitHub release tarball pinned by version, and there are no new build-time downloads, privilege changes, install-script additions, or suspicious packaging behaviors. The only noteworthy functional change is replacing -Wno-dev with -Wno-author, which affects CMake warning suppression but does not introduce code execution or persistence concerns.

@@ -1,20 +1,22 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=xevd
-pkgver=0.5.0
+pkgver=0.7.0
 pkgrel=1
 pkgdesc='MPEG-5 EVC (Essential Video Coding) decoder'
 arch=('x86_64')
 url='https://github.com/mpeg5/xevd/'
 license=('BSD-3-Clause')
-depends=('glibc')
-makedepends=('cmake')
+depends=(
+    'glibc')
+makedepends=(
+    'cmake')
 options=('!emptydirs')
 source=("https://github.com/mpeg5/xevd/archive/v${pkgver}/${pkgname}-${pkgver}.tar.gz"
         '010-xevd-disable-werror.patch'
         '020-xevd-fix-pkg-config.patch')
-sha256sums=('8d55c7ec1a9ad4e70fe91fbe129a1d4dd288bce766f466cba07a29452b3cecd8'
-            '2a7eff2690c0d4d441df97ad37fd7a0e3e0a03705665dad12201f8d8d997f191'
+sha256sums=('febfdb532819bbf36b1b04e74d3ef328ad0f0f2db6224ddb7640fce6bd0014f4'
+            'a7a22d26772657046475b1e664cbab3331355aef847f51bbb74d0bede25462f2'
             '28e46788d188dbbd27c0b47d2c4510029491f434cccfa41967b60d94def36d4a')
 
 prepare() {

Comment

The change only replaces a CMake warning flag in build() from -Wno-dev to -Wno-author. This does not introduce network access, privilege escalation, persistence, or packaging integrity issues. The rest of the PKGBUILD remains a standard source build from an HTTPS GitHub release tarball with checksums. No security-relevant behavior is added by this diff.

@@ -29,7 +31,7 @@ build() {
         -DCMAKE_BUILD_TYPE:STRING='None' \
         -DCMAKE_INSTALL_PREFIX:PATH='/usr' \
         -DXEVD_APP_STATIC_BUILD:BOOL='OFF' \
-        -Wno-dev
+        -Wno-author
     cmake --build build
 }