Review Results

Comment

The change only bumps pkgrel from 2 to 3 in .SRCINFO. This is a metadata-only packaging revision with no impact on sources, build steps, dependencies, install scripts, or shipped artifacts. No security-relevant behavior changes are present in the provided diff.

@@ -1,7 +1,7 @@
 pkgbase = python-steam
 	pkgdesc = Python package for interacting with Steam
 	pkgver = 2.0.0.alpha1
-	pkgrel = 2
+	pkgrel = 3
 	url = https://github.com/solsticegamestudios/steam
 	arch = any
 	license = MIT

Comment

The change only bumps pkgrel from 2 to 3 in PKGBUILD without altering sources, build steps, dependencies, install scripts, or package contents. No security-relevant behavior changes are introduced in the provided diff hunk.

@@ -3,7 +3,7 @@ pkgname=python-steam
 _name=${pkgname#python-}
 _pkgver=2.0.0-alpha1
 pkgver=${_pkgver//-/.}
-pkgrel=2
+pkgrel=3
 pkgdesc="Python package for interacting with Steam"
 arch=('any')
 url="https://github.com/solsticegamestudios/steam"

Comment

The change replaces a no-op test step with creating an isolated venv, installing the built wheel into it, and running pytest against that installed artifact while skipping two failing tests. I do not see any new network access, privilege escalation, persistence, or writes outside the build directory. The use of --system-site-packages is somewhat unusual because it exposes system Python packages to the test environment, but in this context it is only used during check() and does not by itself create a packaging or supply-chain risk. Overall this is a low-risk change with no clear security issue in the diff provided.

@@ -66,7 +66,11 @@ build() {
 
 check() {
   cd "$_name-${_pkgver}"
-  pytest || :
+  python -m venv --clear --without-pip --system-site-packages test-env
+  test-env/bin/python -m installer dist/*.whl
+
+  # Skip failing tests
+  test-env/bin/python -I -m pytest -k "not test_core_cm and not test_utils"
 }
 
 package() {