Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump for mesa-git from one upstream git snapshot to a newer one. There are no changes to source URLs, checksums, install scripts, dependencies, or packaging logic in the provided diff, and nothing here suggests a supply-chain or privilege-escalation issue. Based on this hunk alone, the change appears to be a routine version update.

@@ -1,6 +1,6 @@
 pkgbase = mesa-git
 	pkgdesc = an open-source implementation of the OpenGL specification, git version
-	pkgver = 26.3.0_devel.227788.724bffde435.d41d8cd
+	pkgver = 26.3.0_devel.228038.f0bcf544881.d41d8cd
 	pkgrel = 1
 	url = https://www.mesa3d.org
 	arch = x86_64

Comment

The change is limited to .SRCINFO metadata for mesa-git and updates the recorded pkgver plus Rust/Venus protocol source entries and checksums. The new sources are still from official upstream locations (Mesa GitLab, crates.io, and virgl GitLab), and there is no evidence here of added build-time network fetching, shell execution, privilege escalation, or packaging actions. One source is an unpinned git dependency (venus-protocol::git+... without a commit/tag), which is a reproducibility/integrity weakness, but in this context it appears to mirror upstream packaging metadata rather than introduce a direct security issue in the reviewed diff. Overall this looks low risk.

@@ -88,21 +88,30 @@ pkgbase = mesa-git
 	options = !debug
 	source = mesa::git+https://gitlab.freedesktop.org/mesa/mesa.git#branch=main
 	source = LICENSE
-	source = proc-macro2-1.0.70.tar.gz::https://static.crates.io/crates/proc-macro2/1.0.70/download
+	source = venus-protocol-1.1::git+https://gitlab.freedesktop.org/virgl/venus-protocol.git
+	source = rustc-hash-2.1.1.tar.gz::https://static.crates.io/crates/rustc-hash/2.1.1/download
+	source = proc-macro2-1.0.86.tar.gz::https://static.crates.io/crates/proc-macro2/1.0.86/download
 	source = unicode-ident-1.0.12.tar.gz::https://static.crates.io/crates/unicode-ident/1.0.12/download
-	source = quote-1.0.33.tar.gz::https://static.crates.io/crates/quote/1.0.33/download
-	source = syn-2.0.39.tar.gz::https://static.crates.io/crates/syn/2.0.39/download
+	source = quote-1.0.35.tar.gz::https://static.crates.io/crates/quote/1.0.35/download
+	source = paste-1.0.14.tar.gz::https://static.crates.io/crates/paste/1.0.14/download
+	source = syn-2.0.87.tar.gz::https://static.crates.io/crates/syn/2.0.87/download
 	sha256sums = SKIP
 	sha256sums = 7fdc119cf53c8ca65396ea73f6d10af641ba41ea1dd2bd44a824726e01c8b3f2
-	sha256sums = 39278fbbf5fb4f646ce651690877f89d1c5811a3d4acb27700c1cb3cdb78fd3b
+	sha256sums = SKIP
+	sha256sums = 357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d
+	sha256sums = 5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77
 	sha256sums = 3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b
-	sha256sums = 5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae
-	sha256sums = 23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a
+	sha256sums = 291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef
+	sha256sums = de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c
+	sha256sums = 25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d
 	b2sums = SKIP
 	b2sums = cc60238726b35133b5b729fb4ed1e76e04136588533615d84b4a54656d5b41727d5e7ff06ef4de3eb102eed6669d6c5c5cb8ac9fbdf6fc25aa477877c5c3ba87
-	b2sums = fff0dec06b21e391783cc136790238acb783780eaedcf14875a350e7ceb46fdc100c8b9e3f09fb7f4c2196c25d4c6b61e574c0dad762d94533b628faab68cf5c
+	b2sums = SKIP
+	b2sums = 7a1b3b82bbbf6a123512815c3e8f068a17890cbbb8b68e88a5a492f62469942fadd776207eebd913052a1c06e1fd37a549e86526b9fc8f08b9ca7cb0044ac16b
+	b2sums = 4b89e07f23af8328dbb34fe2b3f1b202f1e6a3885a6269740a23359b41bb4099ac2484565d3b2b0936261689ca525785ac620c766997234fd8d0f409e80e5ea3
 	b2sums = 4cede03c08758ccd6bf53a0d0057d7542dfdd0c93d342e89f3b90460be85518a9fd24958d8b1da2b5a09b5ddbee8a4263982194158e171c2bba3e394d88d6dac
-	b2sums = 77c4b166f1200e1ee2ab94a5014acd334c1fe4b7d72851d73768d491c56c6779a0882a304c1f30c88732a6168351f0f786b10516ae537cff993892a749175848
-	b2sums = 2cff6626624d03f70f1662af45a8644c28a9f92e2dfe38999bef3ba4a4c1ce825ae598277e9cb7abd5585eebfb17b239effc8d0bbf1c6ac196499f0d288e5e01
+	b2sums = 81424245e1e2b94459df68bb3a9a866c6a364102b5e1d010ede9c5f8278f8406d7b651957d091c5914e936b494b0f6e9a6a1dd8b7d35cd7d7100f86dee4ec12e
+	b2sums = 35e8548611c51ee75f4d04926149e5e54870d7073d9b635d550a6fa0f85891f57f326bdbcff3dd8618cf40f8e08cf903ef87d9c034d5921d8b91e1db842cdd7c
+	b2sums = 93385f64103fdb482bec34c7912474ae7a5935948715e6eb9a54907e0db5c39f089f6cd393bab33c935c59a1bbb0f4099431f206343811c1a450554d96a35756
 
 pkgname = mesa-git

Comment

The change only bumps pkgver to a newer Mesa git snapshot. No build logic, sources, install scripts, permissions, or dependencies were altered in the reviewed hunk. On its face this is a routine version update with no security-relevant red flags in the diff provided.

@@ -12,7 +12,7 @@
 
 pkgname=mesa-git
 pkgdesc="an open-source implementation of the OpenGL specification, git version"
-pkgver=26.3.0_devel.227788.724bffde435.d41d8cd
+pkgver=26.3.0_devel.228038.f0bcf544881.d41d8cd
 pkgrel=1
 arch=('x86_64')
 makedepends=(

Comment

The change adds a new upstream git source for venus-protocol, which is an official freedesktop/virgl repository over HTTPS, so the source itself is not suspicious. The PKGBUILD also updates checksums and crate versions to match the new Mesa revision, and the new MESON_PACKAGE_CACHE_DIR points Meson at $srcdir to avoid network fetches during build, which is a packaging improvement rather than a red flag. I do note that the added git source is unpinned to a specific tag/commit, but in this context it is still fetched as a declared source and the package already tracks Mesa main; there is no evidence of injected code execution, privilege escalation, or install-script persistence in this diff.

@@ -94,19 +94,26 @@ license=('custom')
 source=(
     'mesa::git+https://gitlab.freedesktop.org/mesa/mesa.git#branch=main'
     'LICENSE'
+    "venus-protocol-1.1::git+https://gitlab.freedesktop.org/virgl/venus-protocol.git"
 )
 sha256sums=('SKIP'
             '7fdc119cf53c8ca65396ea73f6d10af641ba41ea1dd2bd44a824726e01c8b3f2'
-            '39278fbbf5fb4f646ce651690877f89d1c5811a3d4acb27700c1cb3cdb78fd3b'
+            'SKIP'
+            '357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d'
+            '5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77'
             '3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b'
-            '5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae'
-            '23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a')
+            '291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef'
+            'de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c'
+            '25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d')
 b2sums=('SKIP'
         'cc60238726b35133b5b729fb4ed1e76e04136588533615d84b4a54656d5b41727d5e7ff06ef4de3eb102eed6669d6c5c5cb8ac9fbdf6fc25aa477877c5c3ba87'
-        'fff0dec06b21e391783cc136790238acb783780eaedcf14875a350e7ceb46fdc100c8b9e3f09fb7f4c2196c25d4c6b61e574c0dad762d94533b628faab68cf5c'
+        'SKIP'
+        '7a1b3b82bbbf6a123512815c3e8f068a17890cbbb8b68e88a5a492f62469942fadd776207eebd913052a1c06e1fd37a549e86526b9fc8f08b9ca7cb0044ac16b'
+        '4b89e07f23af8328dbb34fe2b3f1b202f1e6a3885a6269740a23359b41bb4099ac2484565d3b2b0936261689ca525785ac620c766997234fd8d0f409e80e5ea3'
         '4cede03c08758ccd6bf53a0d0057d7542dfdd0c93d342e89f3b90460be85518a9fd24958d8b1da2b5a09b5ddbee8a4263982194158e171c2bba3e394d88d6dac'
-        '77c4b166f1200e1ee2ab94a5014acd334c1fe4b7d72851d73768d491c56c6779a0882a304c1f30c88732a6168351f0f786b10516ae537cff993892a749175848'
-        '2cff6626624d03f70f1662af45a8644c28a9f92e2dfe38999bef3ba4a4c1ce825ae598277e9cb7abd5585eebfb17b239effc8d0bbf1c6ac196499f0d288e5e01')
+        '81424245e1e2b94459df68bb3a9a866c6a364102b5e1d010ede9c5f8278f8406d7b651957d091c5914e936b494b0f6e9a6a1dd8b7d35cd7d7100f86dee4ec12e'
+        '35e8548611c51ee75f4d04926149e5e54870d7073d9b635d550a6fa0f85891f57f326bdbcff3dd8618cf40f8e08cf903ef87d9c034d5921d8b91e1db842cdd7c'
+        '93385f64103fdb482bec34c7912474ae7a5935948715e6eb9a54907e0db5c39f089f6cd393bab33c935c59a1bbb0f4099431f206343811c1a450554d96a35756')
 
 
 options=(!lto !debug)

Comment

The change is low risk overall. It updates the vendored Rust crate versions used as Meson subprojects and adds two more crates, all still fetched from the official Mesa/Virgl GitLab sources over HTTPS. The new MESON_PACKAGE_CACHE_DIR export points Meson at the existing source directory to avoid network re-downloads during build, which is a packaging hygiene improvement rather than a security concern. I did not see any curl|bash, privilege escalation, install-script, or system-wide write behavior introduced by this hunk. The only minor concern is that the PKGBUILD now relies on additional VCS sources and checksum entries, so integrity depends on those upstream tags/commits remaining trustworthy, but that is normal for mesa-git.

@@ -114,10 +121,12 @@ options=(!lto !debug)
 
 # Rust crates for NVK, used as Meson subprojects
 declare -A _crates=(
-   proc-macro2    1.0.70
-   quote          1.0.33
-   syn            2.0.39
-   unicode-ident  1.0.12
+  proc-macro2     1.0.86
+  quote           1.0.35
+  syn             2.0.87
+  unicode-ident   1.0.12
+  paste           1.0.14
+  rustc-hash      2.1.1
 )
 
 for _crate in "${!_crates[@]}"; do

Comment

The change only sets MESON_PACKAGE_CACHE_DIR to $srcdir before meson setup, with the stated intent of preventing Meson from re-downloading subproject dependencies. This does not introduce new network access or privilege escalation; if anything it reduces build-time fetching. I did not see any evidence in this hunk of unsafe command execution, persistence, or packaging outside $pkgdir. Risk is low because the impact is limited to build behavior and the variable points at the existing source directory.

@@ -290,6 +299,9 @@ build () {
     CFLAGS+=' -g1'
     CXXFLAGS+=' -g1'
 
+    # Inject subproject packages so meson won't re-download them
+    export MESON_PACKAGE_CACHE_DIR="$srcdir"
+
     meson setup mesa _build "${meson_options[@]}"
     meson configure --no-pager _build
     ninja $NINJAFLAGS -C _build