Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2, with no changes to sources, checksums, dependencies, install scripts, or build logic. By itself this is a metadata-only rebuild indicator and does not introduce any new security risk.

@@ -1,7 +1,7 @@
 pkgbase = opencv4
 	pkgdesc = Open Source Computer Vision Library (version 4.x)
 	pkgver = 4.14.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://github.com/opencv/opencv
 	arch = x86_64
 	license = Apache-2.0

Comment

The change is limited to .SRCINFO metadata and updates the listed patch set/checksums for an opencv4 rebuild. The new patches are local source patches: one adapts OpenCV to FFmpeg 9 API changes, and the other is a small C++ std::cout fix in viz code. I did not see any signs of network fetches, embedded binaries, privilege escalation, install-script changes, or other persistence mechanisms in this diff. Risk is low because the only effect is to refresh package metadata and patch references for a new release of the same upstream source tree.

@@ -59,11 +59,13 @@ pkgbase = opencv4
 	source = opencv_contrib-4.14.0.tar.gz::https://github.com/opencv/opencv_contrib/archive/refs/tags/4.14.0.tar.gz
 	source = vtk9.patch
 	source = fix-cuda-flags.patch
-	source = fix-std.patch
+	source = ffmpeg-9.patch
+	source = contrib-fix-std.patch
 	sha256sums = ee8fb9b30eb60850431b4656447080e3737b56e45719c92b67f245950609f86e
 	sha256sums = 4f17abd1bc7f88e19c3380c8de7cbf2d863aced5b5ee8d8934cc7902b67d42c9
 	sha256sums = f35a2d4ea0d6212c7798659e59eda2cb0b5bc858360f7ce9c696c77d3029668e
 	sha256sums = 95472ecfc2693c606f0dd50be2f012b4d683b7b0a313f51484da4537ab8b2bfe
+	sha256sums = 6246d08c2e272bc30bfcd8bc576e04504f238404823927f98f4def7d212eed74
 	sha256sums = c05fe7572ee5193cf3de7f02a500f446f3457ec20c315590a326bf1bfb5552cc
 
 pkgname = opencv4

Comment

The change only bumps pkgrel from 1 to 2 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or packaging behavior. No security-relevant functionality is introduced by this diff.

@@ -3,7 +3,7 @@
 _pkgname="opencv4"
 pkgname="$_pkgname"
 pkgver="4.14.0"
-pkgrel=1
+pkgrel=2
 pkgdesc="Open Source Computer Vision Library (version 4.x)"
 url="https://github.com/opencv/opencv"
 license=('Apache-2.0')

Comment

The change is low risk. It only reorders how existing local patch files are applied in prepare(), adds one new patch already shipped in source with a matching checksum, and renames the std patch for the contrib tree. The new loop still applies only local .patch files from srcdir to the expected source trees; there is no network access, privilege escalation, or installation behavior change. The only notable packaging change is replacing -Wno-dev with -Wno-author in the CMake invocation, which affects warning suppression only. I did inspect the added patches: ffmpeg-9.patch and contrib-fix-std.patch are straightforward source compatibility fixes, not execution or persistence mechanisms.

@@ -71,28 +71,37 @@ _pkgext="tar.gz"
 source=(
   "$_pkgsrc.$_pkgext"::"$url/archive/refs/tags/$pkgver.$_pkgext"
   "$_pkgsrc_contrib.$_pkgext"::"${url}_contrib/archive/refs/tags/$pkgver.$_pkgext"
-  vtk9.patch
-  fix-cuda-flags.patch
-  fix-std.patch
+  vtk9.patch           # Don't require all vtk optdepends
+  fix-cuda-flags.patch # pass CXXFLAGS through CUDAFLAGS
+  ffmpeg-9.patch
+  contrib-fix-std.patch
 )
 sha256sums=('ee8fb9b30eb60850431b4656447080e3737b56e45719c92b67f245950609f86e'
             '4f17abd1bc7f88e19c3380c8de7cbf2d863aced5b5ee8d8934cc7902b67d42c9'
             'f35a2d4ea0d6212c7798659e59eda2cb0b5bc858360f7ce9c696c77d3029668e'
             '95472ecfc2693c606f0dd50be2f012b4d683b7b0a313f51484da4537ab8b2bfe'
+            '6246d08c2e272bc30bfcd8bc576e04504f238404823927f98f4def7d212eed74'
             'c05fe7572ee5193cf3de7f02a500f446f3457ec20c315590a326bf1bfb5552cc')
 
 # https://gitlab.archlinux.org/archlinux/packaging/packages/kdenlive/-/issues/8
 options=('!lto')
 
 prepare() {
-  # Don't require all vtk optdepends
-  patch -d "$_pkgsrc" -Np1 -F100 -i ../vtk9.patch
-
-  # OpenCV passes all CXXFLAGS to nvcc through -Xcompiler, which does not work for '-Wp,something' flags
-  # We remove the -Xcompiler and pass our CXXFLAGS through cmake's CUDAFLAGS
-  patch -d "$_pkgsrc" -Np1 -F100 -i ../fix-cuda-flags.patch
-
-  patch -d "$_pkgsrc_contrib" -Np1 -F100 -i ../fix-std.patch
+  local src _path
+  for src in "${source[@]}"; do
+    src="${src%%::*}"
+    src="${src##*/}"
+    src="${src%.zst}"
+    if [[ $src == *.patch ]]; then
+      _path="$_pkgsrc"
+      if [[ $src == contrib-* ]]; then
+        _path="$_pkgsrc_contrib"
+      fi
+
+      printf '\nApplying patch: %s\n' "$src"
+      patch -d "$_path" -Np1 -F100 -i "${srcdir:?}/$src"
+    fi
+  done
 }
 
 build() {

Comment

The change is low risk. It only replaces a hardcoded CMake warning-suppression flag (-Wno-dev) with another warning-suppression flag (-Wno-author) and does not alter sources, downloads, install targets, permissions, or privilege-related behavior. The surrounding PKGBUILD diff shows only patch list/prepare-loop refactoring and a patch update, with no evidence of network fetches, shell execution, or persistence mechanisms. The new patch files are local and checksum-pinned. I do not see a security impact from this specific flag change.

@@ -105,7 +114,7 @@ build() {
     -DCMAKE_INSTALL_PREFIX=/usr
     -DCMAKE_INSTALL_LIBDIR="lib/$_pkgname"
     -DCMAKE_CXX_STANDARD=17
-    -Wno-dev
+    -Wno-author
 
     -DBUILD_EXAMPLES=OFF
     -DINSTALL_C_EXAMPLES=OFF

Comment

The patch is a minimal C++ namespace fix in OpenCV viz sources: it adds <iostream> and qualifies cout as std::cout in two logging statements. There are no changes to package build logic, no new sources, no network access, no privilege/persistence mechanisms, and no suspicious artifacts. This is a low-risk, benign compile fix.

@@ -0,0 +1,42 @@
+diff --git a/modules/viz/src/vtk/vtkVizInteractorStyle.cpp b/modules/viz/src/vtk/vtkVizInteractorStyle.cpp
+index e2d33806..1fa823d0 100644
+--- a/modules/viz/src/vtk/vtkVizInteractorStyle.cpp
++++ b/modules/viz/src/vtk/vtkVizInteractorStyle.cpp
+@@ -43,6 +43,7 @@
+ //
+ //M*/
+
++#include <iostream>
+ #include "../precomp.hpp"
+
+ namespace cv { namespace viz
+@@ -96,7 +97,7 @@ void cv::viz::vtkVizInteractorStyle::saveScreenshot(const String &file)
+     snapshot_writer->SetFileName(file.c_str());
+     snapshot_writer->Write();
+
+-    cout << "Screenshot successfully captured (" << file.c_str() << ")" << endl;
++    std::cout << "Screenshot successfully captured (" << file.c_str() << ")" << endl;
+ }
+
+ //////////////////////////////////////////////////////////////////////////////////////////////
+@@ -118,7 +119,7 @@ void cv::viz::vtkVizInteractorStyle::exportScene(const String &file)
+     exporter->SetInput(Interactor->GetRenderWindow());
+     exporter->Write();
+
+-    cout << "Scene successfully exported (" << file.c_str() << ")" << endl;
++    std::cout << "Scene successfully exported (" << file.c_str() << ")" << endl;
+ }
+
+ void cv::viz::vtkVizInteractorStyle::exportScene()
+diff --git a/modules/viz/src/widget.cpp b/modules/viz/src/widget.cpp
+index b46d3d1c..f483f42e 100644
+--- a/modules/viz/src/widget.cpp
++++ b/modules/viz/src/widget.cpp
+@@ -43,6 +43,7 @@
+ //
+ //M*/
+
++#include <iostream>
+ #include "precomp.hpp"
+
+ ///////////////////////////////////////////////////////////////////////////////////////////////

Comment

The patch is a narrow compatibility update for newer FFmpeg APIs: it replaces direct access to deprecated codec fields (`pix_fmts`, `supported_framerates`) with `avcodec_get_supported_config(...)` while preserving the same selection logic. I do not see any added network access, privilege changes, persistence, or packaging-side execution. The only risk is functional compatibility if the new API behaves differently across FFmpeg versions, but that is a correctness concern rather than a security issue.

@@ -0,0 +1,37 @@
+diff --git a/modules/videoio/src/cap_ffmpeg_hw.hpp b/modules/videoio/src/cap_ffmpeg_hw.hpp
+index 65045a2bc7..3ed33d32a3 100644
+--- a/modules/videoio/src/cap_ffmpeg_hw.hpp
++++ b/modules/videoio/src/cap_ffmpeg_hw.hpp
+@@ -757,9 +757,12 @@ AVCodec *hw_find_codec(AVCodecID id, AVHWDeviceType hw_type, int (*check_categor
+ #endif
+             if (hw_type == AV_HWDEVICE_TYPE_CUDA) // CUDA encoders don't support avcodec_get_hw_config()
+                 hw_native_fmt = AV_PIX_FMT_CUDA;
+-            if (av_codec_is_encoder(c) && hw_native_fmt != AV_PIX_FMT_NONE && c->pix_fmts) {
+-                for (int i = 0; c->pix_fmts[i] != AV_PIX_FMT_NONE; i++) {
+-                    if (c->pix_fmts[i] == hw_native_fmt) {
++            const AVPixelFormat* c_pix_fmts = nullptr;
++            avcodec_get_supported_config(nullptr, c, AV_CODEC_CONFIG_PIX_FORMAT, 0,
++                                         (const void**)&c_pix_fmts, nullptr);
++            if (av_codec_is_encoder(c) && hw_native_fmt != AV_PIX_FMT_NONE && c_pix_fmts) {
++                for (int i = 0; c_pix_fmts[i] != AV_PIX_FMT_NONE; i++) {
++                    if (c_pix_fmts[i] == hw_native_fmt) {
+                         *hw_pix_fmt = hw_native_fmt;
+                         if (hw_check_codec(c, hw_type, disabled_codecs))
+                             return c;
+diff --git a/modules/videoio/src/cap_ffmpeg_impl.hpp b/modules/videoio/src/cap_ffmpeg_impl.hpp
+index 3dd42ecfd1..005d048d95 100644
+--- a/modules/videoio/src/cap_ffmpeg_impl.hpp
++++ b/modules/videoio/src/cap_ffmpeg_impl.hpp
+@@ -2629,8 +2629,10 @@ static AVCodecContext * icv_configure_video_stream_FFMPEG(AVFormatContext *oc,
+     c->time_base.den = frame_rate;
+     c->time_base.num = frame_rate_base;
+     /* adjust time base for supported framerates */
+-    if(codec && codec->supported_framerates){
+-        const AVRational *p= codec->supported_framerates;
++    const AVRational *p = nullptr;
++    avcodec_get_supported_config(nullptr, codec, AV_CODEC_CONFIG_FRAME_RATE, 0,
++                                 (const void**)&p, nullptr);
++    if(codec && p){
+         AVRational req = {frame_rate, frame_rate_base};
+         const AVRational *best=NULL;
+         AVRational best_error= {INT_MAX, 1};