Review Results

Comment

The change is limited to bumping pkgver/pkgrel in .SRCINFO from 1.0.7-3 to 1.0.8-1. No sources, checksums, build commands, install scripts, or package metadata affecting execution/persistence were changed in the provided hunk. On its face this is a routine version update with no direct security red flags in the diff shown.

@@ -1,7 +1,7 @@
 pkgbase = fritzing
 	pkgdesc = PCB layout prototyping application
-	pkgver = 1.0.7
-	pkgrel = 3
+	pkgver = 1.0.8
+	pkgrel = 1
 	url = http://fritzing.org
 	install = fritzing.install
 	arch = aarch64

Comment

The change only adjusts runtime dependency metadata in .SRCINFO, replacing gcc-libs with its split runtime components libgcc and libstdc++. This is a packaging metadata update with no code execution, no new sources, no install script changes, and no privilege or persistence implications. I see no security impact from this diff alone.

@@ -12,9 +12,10 @@ pkgbase = fritzing
 	makedepends = git
 	makedepends = patchelf
 	makedepends = qt6-tools
-	depends = gcc-libs
 	depends = glibc
+	depends = libgcc
 	depends = libgit2
+	depends = libstdc++
 	depends = polyclipping
 	depends = qt6-base
 	depends = qt6-serialport

Comment

The change is a routine metadata refresh in .SRCINFO: it bumps pkgver/pkgrel, updates two pinned git commit sources to newer upstream revisions, and adjusts runtime dependency names from gcc-libs to libgcc/libstdc++ for the new build. The sources remain HTTPS and pinned to specific commits, with no new untrusted URLs, scripts, or build-time network behavior introduced by this diff. No obvious supply-chain or persistence red flags are present in the reviewed hunk.

@@ -22,8 +23,8 @@ pkgbase = fritzing
 	depends = quazip-qt6
 	depends = ngspice
 	depends = zlib
-	source = git+https://github.com/fritzing/fritzing-app.git#commit=394a8bb4791424ffd99f99ebc330264d4becea63
-	source = git+https://github.com/fritzing/fritzing-parts.git#commit=70a1773402e8c76a77795637de482a83db3ca6d7
+	source = git+https://github.com/fritzing/fritzing-app.git#commit=5aa56a510183c23084990a6b4481708cad24c15b
+	source = git+https://github.com/fritzing/fritzing-parts.git#commit=27535f2fd02097be9bed229b75aa8e9be282a4a0
 	source = svgpp-1.3.1.tar.gz::https://github.com/svgpp/svgpp/archive/refs/tags/v1.3.1.tar.gz
 	source = 0001-Quick-Dirty-patch-to-allow-finding-quazip-qt6-on-Arc.patch
 	source = 0002-Quick-Dirty-patch-to-allow-finding-ngspice-on-Arch-L.patch

Comment

The change is a routine version bump and dependency adjustment. Sources remain pinned to HTTPS GitHub commits, and there are no new build-time network fetches, scripts, patches, or privilege-related changes in the reviewed hunk. The dependency swap from gcc-libs to libgcc/libstdc++ is packaging hygiene, not a security concern. No evidence of malicious behavior in this diff.

@@ -10,8 +10,8 @@ pkgname=fritzing
 # We drop the "b" at the end of the version number. It probably means beta
 # while there is also "d" for development versions. This would not be correctly
 # parsed by `pkgver` anyway (d > b), so let's leave out the b suffix entirely.
-pkgver=1.0.7
-pkgrel=3
+pkgver=1.0.8
+pkgrel=1
 
 # Tag version can be obtained from github release page. Sometimes this is the
 # version number itself, sometimes some CD-magicnumber thing. There can be

Comment

The change is low risk. It only updates pinned upstream revisions for the app and parts repositories and adjusts runtime dependencies from gcc-libs to the split libgcc/libstdc++ packages, which is a normal packaging change on Arch. The source URLs remain HTTPS and pinned to specific commits; there are no new build-time downloads, scripts, or privilege-related changes in the diff. I did not see any suspicious install-script or unit-file modifications associated with this change.

@@ -20,7 +20,7 @@ pkgrel=3
 #_tagver=0.9.8
 
 # This is probably close to what has been released
-_gitrev=394a8bb4791424ffd99f99ebc330264d4becea63
+_gitrev=5aa56a510183c23084990a6b4481708cad24c15b
 
 # Parts come from a different respository and are not versioned anymore since
 # 2016. Sometimes we can get the revision by downloading the release build,

Comment

The change only updates the pinned fritzing-parts revision hash in PKGBUILD. This is a source integrity change, but there is no evidence in the diff of added build-time execution, network fetching outside source arrays, privilege escalation, or packaging changes. I did not see any suspicious URL or script additions in the provided hunk. Risk is low because the package now points at a different upstream parts snapshot, which could affect contents, but the change itself is a straightforward revision bump with no direct security red flags.

@@ -28,7 +28,7 @@ _gitrev=394a8bb4791424ffd99f99ebc330264d4becea63
 # release build seems to be hidden behind a paywall. Then we need to guess
 # based on the master branch of the fritzing-parts repository and the date when
 # the release archive was created.
-_partsrev=70a1773402e8c76a77795637de482a83db3ca6d7
+_partsrev=27535f2fd02097be9bed229b75aa8e9be282a4a0
 
 pkgdesc='PCB layout prototyping application'
 arch=('aarch64' 'i686' 'x86_64')

Comment

The change is low risk and only adjusts runtime dependencies from the meta-package gcc-libs to its split components libgcc and libstdc++. The source URLs remain pinned to GitHub commits over HTTPS, and there are no new build-time downloads, scripts, or packaging behaviors introduced by this diff. No persistence, privilege escalation, or integrity concerns are evident from this change alone.

@@ -36,7 +36,7 @@ url=http://fritzing.org
 license=('GPL-3.0-only AND CC-BY-SA-3.0 AND BSL-1.0') # fritzing, fritzing-parts, svgpp
 install=fritzing.install
 makedepends=('boost' 'git' 'patchelf' 'qt6-tools')
-depends=('gcc-libs' 'glibc' 'libgit2' 'polyclipping' 'qt6-base' 'qt6-serialport' 'qt6-svg' 'quazip-qt6' 'ngspice' 'zlib')
+depends=('glibc' 'libgcc' 'libgit2' 'libstdc++' 'polyclipping' 'qt6-base' 'qt6-serialport' 'qt6-svg' 'quazip-qt6' 'ngspice' 'zlib')
 source=("git+https://github.com/fritzing/fritzing-app.git#commit=${_gitrev}"
         "git+https://github.com/fritzing/fritzing-parts.git#commit=${_partsrev}"
         svgpp-1.3.1.tar.gz::https://github.com/svgpp/svgpp/archive/refs/tags/v1.3.1.tar.gz