Review Results

Comment

The .SRCINFO change is limited to a version bump and dependency/makedepends reordering plus two added runtime deps (cabextract, gamemode). There is no evidence here of malicious behavior, build-time code execution, network fetching, privilege escalation, or suspicious sources. Since .SRCINFO is metadata only, this diff by itself does not introduce an exploitable change; the added dependencies are plausible for Bottles and do not imply a security issue on their own.

@@ -1,20 +1,20 @@
 pkgbase = bottles
 	pkgdesc = Easily manage wine and proton prefix
-	pkgver = 64.1
+	pkgver = 66.7
 	pkgrel = 1
 	epoch = 2
 	url = https://github.com/bottlesdevs/Bottles
 	arch = any
 	license = GPL-3.0-only
-	makedepends = meson
-	makedepends = ninja
+	makedepends = appstream-glib
 	makedepends = blueprint-compiler
-	makedepends = gobject-introspection
 	makedepends = desktop-file-utils
-	makedepends = appstream-glib
 	makedepends = gettext
 	makedepends = glib2-devel
+	makedepends = meson
+	depends = cabextract
 	depends = fvs2
+	depends = gamemode
 	depends = gtk4
 	depends = gtksourceview5
 	depends = hicolor-icon-theme

Comment

The change only removes one runtime dependency entry from .SRCINFO: python-orjson. There is no evidence of added code execution, network access, privilege escalation, or packaging integrity issues in this diff. At most this may reflect a dependency metadata adjustment, but by itself it does not introduce a security risk.

@@ -30,7 +30,6 @@ pkgbase = bottles
 	depends = python-gobject
 	depends = python-idna
 	depends = python-markdown
-	depends = python-orjson
 	depends = python-pathvalidate
 	depends = python-pefile
 	depends = python-pycurl

Comment

The .SRCINFO change is low risk. It updates the upstream tarball from Bottles 64.1 to 66.7 on GitHub over HTTPS and removes the local patch entry, but there is no evidence in this diff of a malicious source, build-time network fetch, privilege escalation, or install-script persistence. The optdepends additions are consistent with new runtime features (32-bit runner support, wine/umu integration, proxy support) and do not themselves introduce execution risk. Since only metadata changed here and the source remains pinned to a release tarball with a checksum, I see no high-confidence security issue in this hunk.

@@ -39,17 +38,26 @@ pkgbase = bottles
 	depends = python-yaml
 	depends = python-yara
 	depends = vkbasalt-cli
-	optdepends = vulkan-tools: vkcube test / Vulkan info
-	optdepends = xorg-xdpyinfo: display info detection
+	optdepends = 7zip: extract 7z archives
+	optdepends = gamescope: gamescope session integration
 	optdepends = imagemagick: icon/image conversion
-	optdepends = vmtouch: preload bottle files into memory
+	optdepends = lib32-alsa-lib: 32-bit ALSA for downloaded runners
+	optdepends = lib32-fontconfig: 32-bit font rendering for downloaded runners
+	optdepends = lib32-glibc: 32-bit support for downloaded runners
+	optdepends = lib32-gnutls: 32-bit TLS for downloaded runners
+	optdepends = lib32-libglvnd: 32-bit OpenGL/X11 for downloaded runners
+	optdepends = lib32-libpulse: 32-bit PulseAudio for downloaded runners
+	optdepends = lib32-vulkan-driver: 32-bit Vulkan driver (DXVK) for downloaded runners
+	optdepends = lib32-vulkan-icd-loader: 32-bit Vulkan loader (DXVK) for downloaded runners
 	optdepends = mangohud: performance overlay
-	optdepends = gamemode: feral gamemode integration
-	optdepends = gamescope: gamescope session integration
+	optdepends = python-pysocks: SOCKS proxy support
+	optdepends = umu-launcher: manage UMU Launcher prefixes
+	optdepends = vmtouch: preload bottle files into memory
+	optdepends = vulkan-tools: vkcube test / Vulkan info
+	optdepends = wine: use system installed wine as runner for bottles
+	optdepends = xorg-xdpyinfo: display info detection
 	optdepends = xterm: fallback terminal for "Run executable in terminal"
-	source = Bottles-64.1.tar.gz::https://github.com/bottlesdevs/Bottles/archive/refs/tags/64.1.tar.gz
-	source = remove-flatpak-checks.patch
-	sha256sums = 8d81cc6a3f25675ef15f7ec35fadba247f17634b016be7eead6af536aee8c536
-	sha256sums = 5b4a8818bdac2bfb46615959f02ef4dc94cfcc30768357ed56e91d15842d0ea7
+	source = Bottles-66.7.tar.gz::https://github.com/bottlesdevs/Bottles/archive/refs/tags/66.7.tar.gz
+	sha256sums = 607994bbc29d7e8f3b0d3cd852b7a97a0f1e2c90e4dcacefc2e8ce632709e8db
 
 pkgname = bottles

Comment

The change is mostly a version bump plus dependency/packaging updates, but the new prepare() logic is security-relevant. It patches upstream code to force `CPAK_CONTAINER_ID=1` into the environment and changes `globals.py` to always return `False` for the flatpak/container check. That is a behavioral override of upstream sandbox detection, not just a build fix. While I don’t see an obvious direct backdoor or network/persistence mechanism in this diff, it does intentionally alter runtime environment detection in a way that could weaken isolation assumptions or change code paths in a non-obvious manner. The rest of the diff (source URL, checksum, build system switch, dependency updates) looks routine.

@@ -3,7 +3,7 @@
 
 pkgname=bottles
 _pkgname=Bottles
-pkgver=64.1
+pkgver=66.7
 pkgrel=1
 epoch=2
 pkgdesc='Easily manage wine and proton prefix'

Comment

The change is low risk from a supply-chain perspective. It does not add new sources, network fetches, privileged operations, or install-time scripts. The only substantive changes are dependency list updates and build-time source edits that patch upstream behavior to avoid flatpak/container checks and set an environment variable. Those edits are unusual but remain confined to the package build and do not introduce persistence, privilege escalation, or external code execution. I do note the package now depends on additional runtime libraries (cabextract, gamemode) and removes python-orjson, but that is a packaging decision rather than a security issue in this diff.

@@ -11,7 +11,9 @@ arch=(any)
 url="https://github.com/bottlesdevs/Bottles"
 license=(GPL-3.0-only)
 depends=(
+  cabextract
   fvs2
+  gamemode
   gtk4
   gtksourceview5
   hicolor-icon-theme

Comment

The change is low risk. It removes a runtime dependency (python-orjson) and updates the package to a newer upstream release, while also replacing an external patch file with inline sed edits. I do not see any added network fetches, privilege escalation, persistence mechanisms, or suspicious install-time behavior in the provided diff. The main security-relevant concern is that the PKGBUILD now mutates upstream source files during prepare(), but the edits are narrowly scoped to disabling flatpak/sandbox checks and setting an environment variable, which is consistent with packaging behavior rather than a backdoor.

@@ -27,7 +29,6 @@ depends=(
   python-gobject
   python-idna
   python-markdown
-  python-orjson
   python-pathvalidate
   python-pefile
   python-pycurl

Comment

The change is mostly packaging cleanup, but it also removes a patch and replaces it with in-tree source edits that force Bottles to believe it is never running in Flatpak/CPAK/container contexts. Specifically, prepare() now rewrites runtime checks in bottles.py, cli.py, and backend/globals.py to set CPAK_CONTAINER_ID and make the container-detection function always return False. That is a behavioral bypass of upstream environment/sandbox detection, which could disable safety-related code paths or alter how the app handles sandboxed execution. I did not find evidence of network fetches, privilege escalation, or install-script persistence in this diff, so the risk is moderate rather than severe.

@@ -38,48 +39,64 @@ depends=(
   vkbasalt-cli
 )
 makedepends=(
-  meson
-  ninja
+  appstream-glib
   blueprint-compiler
-  gobject-introspection
   desktop-file-utils
-  appstream-glib
   gettext
   glib2-devel
+  meson
 )
 optdepends=(
-  'vulkan-tools: vkcube test / Vulkan info'
-  'xorg-xdpyinfo: display info detection'
+  '7zip: extract 7z archives'
+  'gamescope: gamescope session integration'
   'imagemagick: icon/image conversion'
-  'vmtouch: preload bottle files into memory'
+  'lib32-alsa-lib: 32-bit ALSA for downloaded runners'
+  'lib32-fontconfig: 32-bit font rendering for downloaded runners'
+  'lib32-glibc: 32-bit support for downloaded runners'
+  'lib32-gnutls: 32-bit TLS for downloaded runners'
+  'lib32-libglvnd: 32-bit OpenGL/X11 for downloaded runners'
+  'lib32-libpulse: 32-bit PulseAudio for downloaded runners'
+  'lib32-vulkan-driver: 32-bit Vulkan driver (DXVK) for downloaded runners'
+  'lib32-vulkan-icd-loader: 32-bit Vulkan loader (DXVK) for downloaded runners'
   'mangohud: performance overlay'
-  'gamemode: feral gamemode integration'
-  'gamescope: gamescope session integration'
+  'python-pysocks: SOCKS proxy support'
+  'umu-launcher: manage UMU Launcher prefixes'
+  'vmtouch: preload bottle files into memory'
+  'vulkan-tools: vkcube test / Vulkan info'
+  'wine: use system installed wine as runner for bottles'
+  'xorg-xdpyinfo: display info detection'
   'xterm: fallback terminal for "Run executable in terminal"'
 )
 source=(
   "${_pkgname}-${pkgver}.tar.gz::https://github.com/bottlesdevs/Bottles/archive/refs/tags/${pkgver}.tar.gz"
-  remove-flatpak-checks.patch
 )
 sha256sums=(
-  8d81cc6a3f25675ef15f7ec35fadba247f17634b016be7eead6af536aee8c536
-  5b4a8818bdac2bfb46615959f02ef4dc94cfcc30768357ed56e91d15842d0ea7
+  "607994bbc29d7e8f3b0d3cd852b7a97a0f1e2c90e4dcacefc2e8ce632709e8db"
 )
 
 prepare() {
-  # Fix warning about flatpak and sandbox environment
-  patch --forward --directory="${srcdir}/${_pkgname}-${pkgver}" --strip=1 --input="${srcdir}/remove-flatpak-checks.patch"
+  cd "${srcdir}/${_pkgname}-${pkgver}"
+
+  grep -q "fs.is_file('/' + '.flatpak-info')" bottles/frontend/meson.build
+  sed -i "s|fs.is_file('/' + '.flatpak-info')|fs.is_file(meson.current_source_dir() / 'meson.build')|" \
+    bottles/frontend/meson.build
+
+  grep -q '^import os$' bottles/frontend/bottles.py bottles/frontend/cli/cli.py
+  sed -i '/^import os$/a os.environ.setdefault("CPAK_CONTAINER_ID", "1")' \
+    bottles/frontend/bottles.py bottles/frontend/cli/cli.py
+
+  grep -q 'return "FLATPAK_ID" in os.environ or is_cpak()' bottles/backend/globals.py
+  sed -i 's|return "FLATPAK_ID" in os.environ or is_cpak()|return False|' \
+    bottles/backend/globals.py
 }
 
 build() {
-  cd "${srcdir}/${_pkgname}-${pkgver}"
-  meson setup --prefix='/usr' build
-  ninja -C build
+  arch-meson "${_pkgname}-${pkgver}" build
+  meson compile -C build
 }
 
 package() {
-  cd "${srcdir}/${_pkgname}-${pkgver}"
-  DESTDIR="${pkgdir}" ninja -C build install
+  meson install -C build --destdir "${pkgdir}"
 }
 
 # vim: set ft=sh ts=2 sw=2 et: