Review Results

Comment

The change is limited to .SRCINFO metadata for a version bump from 1.29.0 to 1.30.0 and the addition of runtime dependencies (GTK stack, glibc, sh, icon theme). There are no new sources, no build-time network fetches, no install scripts, and no privilege/persistence mechanisms introduced in this diff. The added dependencies are plausible for a GUI installer and do not by themselves indicate malicious behavior. Based on the provided hunk alone, this looks low risk.

@@ -1,11 +1,19 @@
 pkgbase = itch-setup-bin
 	pkgdesc = Installer for the itch.io desktop app
-	pkgver = 1.29.0
+	pkgver = 1.30.0
 	pkgrel = 1
 	url = https://itch.io/
 	arch = x86_64
 	license = MIT
+	depends = cairo
+	depends = fontconfig
+	depends = gdk-pixbuf2
+	depends = glib2
+	depends = glibc
 	depends = gtk3
+	depends = hicolor-icon-theme
+	depends = pango
+	depends = sh
 	provides = itch-setup
 	conflicts = itch-setup
 	conflicts = itch

Comment

The change only updates the x86_64 source filename timestamp in .SRCINFO while keeping the same HTTPS upstream download URL and checksum entry. This is a routine metadata refresh for a new upstream binary release and does not introduce new sources, scripts, or packaging behavior. No additional integrity or execution concerns are evident from this diff alone.

@@ -17,7 +25,7 @@ pkgbase = itch-setup-bin
 	sha256sums = d50905ab2e78d6ed3773959d6fb3c1c2fee724cf497f1c441cacb3765eac30ff
 	sha256sums = 57e1c8ad285b89f3380cd028aa51e8083a8e4327cc5763d396caf607e905efcf
 	sha256sums = 985cf842686598dd7e4e153f6fd7c9ee901fd200403893235e2974b108653bcf
-	source_x86_64 = itch-setup-2026-06-09-00-amd64::https://itch.io/app/download?platform=linux
+	source_x86_64 = itch-setup-2026-08-13-22-amd64::https://itch.io/app/download?platform=linux
 	sha256sums_x86_64 = 16e87c1ea4704724e9e07a950ce122990f5c5dc8db269ae342c34919aca1074b
 
 pkgname = itch-setup-bin

Comment

The change is low risk. It only updates pkgver and expands depends to include runtime libraries that the packaged binary likely already needs (GTK stack, hicolor-icon-theme, sh). No new sources, no build-time network changes, no install script, and no privilege/persistence mechanisms were introduced. The only minor concern is the addition of `sh` as a dependency, which is unusual but not inherently malicious here because the package ships an `itch.sh` wrapper; there is no evidence of command execution changes in this diff.

@@ -3,13 +3,23 @@
 # Contributor: Amos Wenger <amos@itch.io>
 
 pkgname=itch-setup-bin
-pkgver=1.29.0
+pkgver=1.30.0
 pkgrel=1
 pkgdesc="Installer for the itch.io desktop app"
 arch=(x86_64)
 url="https://itch.io/"
 license=(MIT)
-depends=(gtk3)
+depends=(
+    cairo
+    fontconfig
+    gdk-pixbuf2
+    glib2
+    glibc
+    gtk3
+    hicolor-icon-theme
+    pango
+    sh
+    )
 _itchver=26.13.0
 source=("itch-${_itchver}.tar.gz::https://github.com/itchio/itch/archive/refs/tags/v${_itchver}.tar.gz"
         "itch-setup-LICENSE::https://raw.githubusercontent.com/itchio/itch-setup/master/LICENSE"