Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump for the VCS package from 32.1.2.r109.g84b8d16 to 32.2.2.r4.g1bf1379. There are no changes to source URLs, checksums, build logic, install scripts, permissions, or package metadata that would introduce a security concern. This appears to be a routine version update with no evident malicious behavior in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = obs-studio-git
 	pkgdesc = Free, open source software for live streaming and recording
-	pkgver = 32.1.2.r109.g84b8d16
+	pkgver = 32.2.2.r4.g1bf1379
 	pkgrel = 1
 	url = https://github.com/obsproject/obs-studio
 	arch = i686

Comment

The change is a straightforward dependency rename in .SRCINFO from mbedtls to mbedtls3. This does not introduce new code execution, network access, privilege changes, or packaging behavior changes; it only updates metadata to match the current dependency name. No security red flags are evident from this diff alone.

@@ -34,7 +34,7 @@ pkgbase = obs-studio-git
 	depends = librist
 	depends = libvpl
 	depends = libxcomposite
-	depends = mbedtls
+	depends = mbedtls3
 	depends = pciutils
 	depends = qrcodegencpp-cmake
 	depends = qt6-svg

Comment

The change is limited to .SRCINFO metadata and does not introduce new executable code or build-time behavior. The notable updates are a version bump, a dependency rename from mbedtls to mbedtls3, and source/provides/conflicts metadata adjustments. The source URLs remain HTTPS and point to the official OBS GitHub repositories and OBS CDN. I do not see evidence of supply-chain risk, privilege escalation, or persistence mechanisms in this diff alone. The added conflict with obs-studio-plugin-browser appears to be packaging metadata only and is not inherently suspicious.

@@ -54,11 +54,12 @@ pkgbase = obs-studio-git
 	optdepends = sndio: sndio input client
 	optdepends = v4l2loopback-dkms: virtual camera support
 	optdepends = vlc: VLC Media Source
-	provides = obs-studio=32.1.2.r109
+	provides = obs-studio=32.2.2.r4
 	conflicts = obs-studio
+	conflicts = obs-studio-plugin-browser
 	options = !lto
 	options = !strip
-	source = obs-studio-git::git+https://github.com/obsproject/obs-studio.git#branch=master
+	source = obs-studio::git+https://github.com/obsproject/obs-studio.git#branch=master
 	source = git+https://github.com/obsproject/obs-browser.git
 	source = git+https://github.com/obsproject/obs-websocket.git
 	source = cef_binary_6533_linux_x86_64_v6.tar.xz::https://cdn-fastly.obsproject.com/downloads/cef_binary_6533_linux_x86_64_v6.tar.xz

Comment

The change only bumps the pkgver string in PKGBUILD from one git-derived version to another. No source URLs, build steps, dependencies, install scripts, permissions, or packaging logic changed. Based on the provided diff, there are no new security concerns introduced by this update.

@@ -8,7 +8,7 @@
 
 _pkgname="obs-studio"
 pkgname="$_pkgname-git"
-pkgver=32.1.2.r109.g84b8d16
+pkgver=32.2.2.r4.g1bf1379
 pkgrel=1
 pkgdesc="Free, open source software for live streaming and recording"
 url="https://github.com/obsproject/obs-studio"

Comment

The only substantive change in this hunk is switching the dependency from `mbedtls` to `mbedtls3` and wiring CMake to the corresponding include/library paths. This is a straightforward dependency update to match the newer upstream build and does not introduce new code execution, network access, privilege changes, or packaging red flags. The rest of the diff shown in the full PKGBUILD is unrelated to this hunk and does not affect the risk assessment here.

@@ -25,7 +25,7 @@ depends=(
   'librist'
   'libvpl'
   'libxcomposite'
-  'mbedtls'
+  'mbedtls3'
   'pciutils'
   'qrcodegencpp-cmake'
   'qt6-svg'

Comment

The change is low risk. It only updates the package version, switches the build to use the renamed source directory variable consistently, adds a new conflict with the browser plugin package, and adjusts build flags/library paths for mbedtls3. There are no new network fetches, no shell execution patterns, no privilege changes, and no install-script or unit-file changes in this diff. The only notable packaging concern is the added conflict with 'obs-studio-plugin-browser', which is a metadata choice rather than a security issue.

@@ -73,13 +73,16 @@ else
 fi
 
 provides=("$_pkgname=${pkgver%%.g*}")
-conflicts=("$_pkgname")
+conflicts=(
+  "$_pkgname"
+  'obs-studio-plugin-browser'
+)
 
 options=('!lto' '!strip')
 
 _source_main() {
   source=(
-    "$pkgname::git+https://github.com/obsproject/obs-studio.git#branch=master"
+    "$_pkgname::git+https://github.com/obsproject/obs-studio.git#branch=master"
     "git+https://github.com/obsproject/obs-browser.git"
     "git+https://github.com/obsproject/obs-websocket.git"
   )

Comment

The change is low risk. It fixes an internal packaging bug by using the actual source directory name ($_pkgname) instead of the package name (pkgname) in pkgver()/prepare()/build(), which is necessary because the source is checked out into a directory named obs-studio. The other edits are dependency/version updates and a conflict addition; there is no new network fetch beyond the existing CEF metadata download, no privilege escalation, and no suspicious install-time behavior introduced by this diff. One note: the PKGBUILD still performs a build-time curl to upstream metadata, but that pre-existed this change and is outside the reviewed hunk's security impact.

@@ -116,7 +119,7 @@ _source_main
 _source_cef
 
 pkgver() {
-  cd "$pkgname"
+  cd "$_pkgname"
   local _version=$(git tag | grep -Ev '.*[a-z]{2}.*' | sort -rV | head -1)
   local _revision=$(git rev-list --count --cherry-pick "$_version"...HEAD)
   local _hash=$(git rev-parse --short=7 HEAD)

Comment

The change is low risk. It only updates the package to a newer upstream git revision, switches the build to mbedtls3 with explicit include/library paths, and removes a local Qt 6.10 workaround that is no longer needed. I do not see any added network fetches, privilege escalation, install-script changes, or suspicious packaging behavior in the reviewed hunk. The only notable change is replacing -Wno-dev with -Wno-author, which affects CMake warning suppression but not package behavior.

@@ -124,22 +127,13 @@ pkgver() {
 }
 
 prepare() {
-  cd "$pkgname"
+  cd "$_pkgname"
   local gitconf="protocol.file.allow=always"
 
   git rm -r deps/libdshowcapture/src
   git config submodule.plugins/obs-browser.url $srcdir/obs-browser
   git config submodule.plugins/obs-websocket.url $srcdir/obs-websocket
   git -c $gitconf submodule update
-
-  # fix for Qt 6.10
-  sed -e 's&Qt::GuiPrivate&&' \
-    -i frontend/cmake/os-freebsd.cmake frontend/cmake/os-linux.cmake
-
-  sed -e '/GuiPrivate/d' \
-    -i plugins/aja-output-ui/CMakeLists.txt \
-    plugins/decklink-output-ui/CMakeLists.txt \
-    plugins/frontend-tools/CMakeLists.txt
 }
 
 build() (

Comment

The change is low risk. It only updates the tracked upstream git revision/version, switches the package dependency from mbedtls to mbedtls3, adds an explicit conflict with obs-studio-plugin-browser, and adjusts CMake flags/paths to point at the mbedtls3 system libraries. The removed Qt 6.10 workaround sed edits are a build-compatibility change, not a security concern. I do not see any new network fetches, privilege escalation, install-script changes, or suspicious payloads in this diff.

@@ -149,17 +143,23 @@ build() (
 
   local _cmake_options=(
     -B build
-    -S "$pkgname"
+    -S "$_pkgname"
     -G Ninja
     -DCMAKE_BUILD_TYPE=None
     -DCMAKE_INSTALL_PREFIX='/usr'
     -DCMAKE_INSTALL_LIBDIR='lib'
+    -Wno-author
+
+    -DMbedTLS_INCLUDE_DIR="/usr/include/mbedtls3"
+    -DMbedtls_LIBRARY="/usr/lib/mbedtls3/libmbedtls.so"
+    -DMbedcrypto_LIBRARY="/usr/lib/mbedtls3/libmbedcrypto.so"
+    -DMbedx509_LIBRARY="/usr/lib/mbedtls3/libmbedx509.so"
+
     -DCEF_ROOT_DIR="$srcdir/$_cef_src"
     -DOBS_VERSION_OVERRIDE="${pkgver%%.r*}"
     -DOBS_COMPILE_DEPRECATION_AS_WARNING=ON
     -DENABLE_BROWSER=ON # qrcodegencpp-cmake
     -DENABLE_LIBFDK=ON
-    -Wno-dev
 
     -DENABLE_AJA="${_plugin_aja:?}"
     -DENABLE_JACK=ON