Review Results

Comment

The only change in this diff is a version bump in .SRCINFO from 0.5.1 to 0.7.0. No source URLs, checksums, build steps, install scripts, or packaging logic are modified here, so there is no new security-relevant behavior introduced by this change alone. Based on the provided hunk, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = xeve
 	pkgdesc = MPEG-5 EVC (Essential Video Coding) encoder
-	pkgver = 0.5.1
+	pkgver = 0.7.0
 	pkgrel = 1
 	url = https://github.com/mpeg5/xeve/
 	arch = x86_64

Comment

The change only updates the upstream release tarball from xeve 0.5.1 to 0.7.0 and refreshes the corresponding checksum in .SRCINFO. The source remains an HTTPS GitHub release archive from the official upstream project, with no new build-time downloads, scripts, or packaging logic introduced in this diff. The existing patch sources are unchanged. Based on the provided hunk, this is a routine version bump with no evident security red flags.

@@ -8,11 +8,11 @@ pkgbase = xeve
 	makedepends = cmake
 	depends = glibc
 	options = !emptydirs
-	source = https://github.com/mpeg5/xeve/archive/v0.5.1/xeve-0.5.1.tar.gz
+	source = https://github.com/mpeg5/xeve/archive/v0.7.0/xeve-0.7.0.tar.gz
 	source = 010-xeve-disable-werror.patch
 	source = 020-xeve-fix-pkg-config.patch
-	sha256sums = 238c95ddd1a63105913d9354045eb329ad9002903a407b5cf1ab16bad324c245
-	sha256sums = 8c4b607f34a5d39e824f86d00ab101849595cb49a2f67eed131487d658ec7206
+	sha256sums = f60950d063f52adf11ed7196c0bbb0503fa107b0e43af06bdc81fecc24f2a62e
+	sha256sums = 0579f036b5f1543306c177054f749360740ac798bd2cbc20938d2717c8cd7ea2
 	sha256sums = 68ae77132ec2b3dd8de641d16f3d7cc0de819ddb116484809445666b4d215187
 
 pkgname = xeve

Comment

The patch only removes -Werror from the project's CMake compiler flags and keeps the rest of the warning suppressions intact. This is a build-behavior change, not a runtime or packaging change, and it does not introduce network access, privilege escalation, persistence, or embedded binaries. The added 'Unknown compiler' branch is benign. Overall low risk.

@@ -1,11 +1,11 @@
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -103,7 +103,7 @@ elseif( UNIX OR MINGW )
-         set(OPT_DBG "-DNDEBUG") # disable assert
-     endif()
+@@ -137,7 +137,7 @@ elseif( UNIX OR MINGW )
  
--    set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${OPT_DBG} -${OPT_LV} -fomit-frame-pointer -Wall -Wno-unused-function -Wno-unused-but-set-variable -Wno-unused-variable -Wno-attributes -Werror -Wno-strict-overflow -Wno-unknown-pragmas -Wno-stringop-overflow -std=c99")
-+    set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${OPT_DBG} -${OPT_LV} -fomit-frame-pointer -Wall -Wno-unused-function -Wno-unused-but-set-variable -Wno-unused-variable -Wno-attributes -Wno-strict-overflow -Wno-unknown-pragmas -Wno-stringop-overflow -std=c99")
-     set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-pointer-sign -pthread -Wno-pointer-to-int-cast -Wno-maybe-uninitialized")
+     set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${OPT_DBG} -${OPT_LV} -fomit-frame-pointer -pthread -std=c99")
+     #TODO: fix suppressed problems
+-    set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Werror -Wno-pointer-sign -Wno-unused-function -Wno-unused-but-set-variable -Wno-unused-variable -Wno-attributes -Wno-strict-overflow -Wno-unknown-pragmas -Wno-stringop-overflow -Wno-pointer-to-int-cast -Wno-maybe-uninitialized")
++    set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wno-pointer-sign -Wno-unused-function -Wno-unused-but-set-variable -Wno-unused-variable -Wno-attributes -Wno-strict-overflow -Wno-unknown-pragmas -Wno-stringop-overflow -Wno-pointer-to-int-cast -Wno-maybe-uninitialized")
      set (CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -lm")
- endif()
+ else()
+     message("Unknown compiler")

Comment

The change is low risk. It only bumps the upstream release tarball from 0.5.1 to 0.7.0 and updates the corresponding checksums, with no new sources, no build-time network access, no privilege escalation, and no install-script or service changes. The only behavioral change in the PKGBUILD is removing a local CFLAGS workaround and switching a CMake warning flag from -Wno-dev to -Wno-author; neither introduces a security concern. The included patches are small and benign (disabling -Werror and fixing pkg-config linkage).

@@ -1,20 +1,22 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=xeve
-pkgver=0.5.1
+pkgver=0.7.0
 pkgrel=1
 pkgdesc='MPEG-5 EVC (Essential Video Coding) encoder'
 arch=('x86_64')
 url='https://github.com/mpeg5/xeve/'
 license=('BSD-3-Clause')
-depends=('glibc')
-makedepends=('cmake')
+depends=(
+    'glibc')
+makedepends=(
+    'cmake')
 options=('!emptydirs')
 source=("https://github.com/mpeg5/xeve/archive/v${pkgver}/${pkgname}-${pkgver}.tar.gz"
         '010-xeve-disable-werror.patch'
         '020-xeve-fix-pkg-config.patch')
-sha256sums=('238c95ddd1a63105913d9354045eb329ad9002903a407b5cf1ab16bad324c245'
-            '8c4b607f34a5d39e824f86d00ab101849595cb49a2f67eed131487d658ec7206'
+sha256sums=('f60950d063f52adf11ed7196c0bbb0503fa107b0e43af06bdc81fecc24f2a62e'
+            '0579f036b5f1543306c177054f749360740ac798bd2cbc20938d2717c8cd7ea2'
             '68ae77132ec2b3dd8de641d16f3d7cc0de819ddb116484809445666b4d215187')
 
 prepare() {

Comment

The change is low risk. It removes a manual CFLAGS override that disabled AVX, which could affect runtime compatibility/performance but is not a security issue, and changes a CMake warning flag from -Wno-dev to -Wno-author. The package still fetches the upstream tarball over HTTPS with pinned checksums, applies only local patches, and does not introduce new build-time network access, privilege escalation, persistence, or suspicious install actions. No security-relevant behavior is added by this diff.

@@ -24,14 +26,11 @@ prepare() {
 }
 
 build() {
-    # https://github.com/mpeg5/xeve/issues/108
-    export CFLAGS+=' -mno-avx'
-    
     cmake -B build -S "${pkgname}-${pkgver}" \
         -G 'Unix Makefiles' \
         -DCMAKE_BUILD_TYPE:STRING='None' \
         -DCMAKE_INSTALL_PREFIX:PATH='/usr' \
-        -Wno-dev
+        -Wno-author
     cmake --build build
 }