Review Results

Comment

The .SRCINFO update is low risk. It only bumps the VCS-derived pkgver, resets pkgrel, removes the install script entry, and adds ninja to makedepends. There are no signs of malicious source changes, network fetches, privilege escalation, or suspicious metadata like typosquatting or replacement of another package. The only notable change is the removal of plymouth.install from .SRCINFO, but without evidence of a corresponding malicious install script in this diff, this alone is not enough to indicate a security issue in the reviewed change.

@@ -1,9 +1,8 @@
 pkgbase = plymouth-git
 	pkgdesc = Graphical boot splash screen (git version)
-	pkgver = 26.134.222.r6.g96f5c010
-	pkgrel = 2
+	pkgver = 26.134.222.r309.gd3281c67
+	pkgrel = 1
 	url = https://www.freedesktop.org/wiki/Software/Plymouth/
-	install = plymouth.install
 	arch = i686
 	arch = x86_64
 	license = GPL-2.0-or-later

Comment

The change only adds `ninja` to makedepends in .SRCINFO. This is a normal build dependency for a Meson-based package and does not introduce any new runtime behavior, network access, privilege escalation, or packaging integrity concerns. No security issue is evident from this diff hunk alone.

@@ -11,6 +10,7 @@ pkgbase = plymouth-git
 	makedepends = git
 	makedepends = gtk3
 	makedepends = meson
+	makedepends = ninja
 	depends = adwaita-fonts
 	depends = bash
 	depends = cairo

Comment

The change is low risk. It only bumps pkgver/pkgrel and adjusts the build to use a newer upstream commit, adds an explicit ninja makedepend, disables meson tests by commenting out subdir('tests'), and passes -D docs=false. There are no new sources, no network-at-build additions, no privilege/persistence changes, and no suspicious install script or unit modifications in this diff. The only security-relevant concern is reduced assurance from removing tests, but that is a quality/regression risk rather than a direct supply-chain or privilege-escalation issue.

@@ -5,8 +5,8 @@
 
 pkgname=plymouth-git
 _pkgname=plymouth
-pkgver=26.134.222.r6.g96f5c010
-pkgrel=2
+pkgver=26.134.222.r309.gd3281c67
+pkgrel=1
 pkgdesc='Graphical boot splash screen (git version)'
 arch=('i686' 'x86_64')
 url='https://www.freedesktop.org/wiki/Software/Plymouth/'

Comment

The change only adds `ninja` to `makedepends`. This is a normal build dependency for Meson-based projects and does not introduce any new source, execution, privilege, or packaging risks. No suspicious scripts, network fetches, or install-time behavior are affected by this diff.

@@ -34,6 +34,7 @@ makedepends=(
   git
   gtk3
   meson
+  ninja
 )
 optdepends=('gtk3: x11 renderer')
 provides=('plymouth')

Comment

The change removes the .install script from the package metadata, which reduces post-install execution risk rather than adding it. No new sources, build steps, permissions changes, or persistence mechanisms are introduced in the shown diff. Based on this hunk alone, there is no security concern.

@@ -42,7 +43,6 @@ backup=(
   etc/logrotate.d/bootlog
   etc/plymouth/plymouthd.conf
 )
-install='plymouth.install'
 source=(
   "git+https://gitlab.freedesktop.org/$_pkgname/$_pkgname.git"
   plymouth.initcpio_hook

Comment

Risk is low. The change only disables the upstream tests by commenting out `subdir('tests')` in `meson.build`, adds `ninja` as an explicit makedepend, and disables docs in the Meson build. There are no new network fetches, privilege changes, install-script changes, or suspicious payloads. The main security impact is reduced assurance from skipping tests, but that is a build-quality/regression concern rather than a direct supply-chain or persistence risk in this diff.

@@ -71,6 +71,9 @@ prepare() {
 
   # Patch config file
   patch -p1 -i $srcdir/plymouthd.conf.patch
+  
+  # ignore tests for now, the build keeps failing...
+  sed -i "s/^subdir('tests')/# subdir('tests')/" ./meson.build
 
   # Switch from Cantarell to Adwaita Sans; set monospace font to Adwaita Mono
   sed -i 's/Cantarell/Adwaita Sans/

Comment

The change is low risk from a supply-chain/security perspective. It only disables building docs and removes the check() test phase, plus a prepare() sed that comments out the upstream tests subdir. There are no new network fetches, privilege changes, install-script additions, or suspicious sources. The main concern is reduced assurance because tests are now skipped, but that is a quality/regression risk rather than a direct security issue in the package contents.

@@ -79,17 +82,14 @@ prepare() {
 
 build() {
   arch-meson $_pkgname build \
-    -D logo=/usr/share/pixmaps/archlinux-logo.png
+    -D logo=/usr/share/pixmaps/archlinux-logo.png \
+    -D docs=false
   meson compile -C build
 
   # Convert logo for the spinner theme
   rsvg-convert '/usr/share/pixmaps/archlinux-logo-text-dark.svg' -o archlinux-logo-text-dark.png
 }
 
-check() {
-  meson test -C build --print-errorlogs
-}
-
 package() {
   meson install -C build --destdir "$pkgdir"
   rm -r "$pkgdir/run"