Review Results

Comment

The change only trims and annotates optional dependencies in .SRCINFO, removing several optdepends and adding a short description for vulkan-icd-loader. This is metadata-only and does not affect build scripts, sources, permissions, or runtime behavior. No security-relevant red flags are introduced by this diff.

@@ -15,22 +15,8 @@ pkgbase = proton-ge-custom-bin
 	license = MPL
 	license = custom
 	depends = python
-	optdepends = vulkan-icd-loader
-	optdepends = lib32-vkd3d
+	optdepends = vulkan-icd-loader: dxvk dependency
 	optdepends = lib32-vulkan-icd-loader: dxvk dependency for 32bit prefixes
-	optdepends = lib32-libva
-	optdepends = lib32-libtheora
-	optdepends = lib32-libvdpau
-	optdepends = gst-plugins-bad-libs
-	optdepends = lib32-gst-plugins-base-libs
-	optdepends = libjpeg-turbo
-	optdepends = graphene
-	optdepends = lib32-libjpeg-turbo
-	optdepends = lib32-libgudev
-	optdepends = lib32-mpg123
-	optdepends = libsoup
-	optdepends = lib32-openssl
-	optdepends = lib32-libusb
 	optdepends = kdialog: KDE splash dialog support
 	optdepends = zenity: GNOME splash dialog support
 	optdepends = python-kivy: splash dialog support (big picture mode)

Comment

The change only adds two optional dependencies in .SRCINFO: lapack and lib32-lapack for Vosk speech recognition support. This is metadata-only, does not alter build steps, install scripts, permissions, or package contents, and introduces no new execution or persistence mechanism. No security concern is evident from this diff alone.

@@ -39,6 +25,8 @@ pkgbase = proton-ge-custom-bin
 	optdepends = winetricks: protonfixes backend - highly recommended
 	optdepends = wine: support for 32bit prefixes
 	optdepends = xboxdrv: gamepad driver service
+	optdepends = lapack: Vosk speech recognition support
+	optdepends = lib32-lapack: Vosk speech recognition support for 32bit applications
 	provides = proton
 	provides = proton-ge-custom=GE.Proton11_5
 	conflicts = proton-ge-custom

Comment

The change is a one-line comment addition in PKGBUILD crediting a cleanup gist. It does not alter sources, build steps, package contents, permissions, or any install/runtime behavior. No security-relevant impact is evident from this diff alone.

@@ -3,6 +3,7 @@
 # Contributor:  floriplum <floriplum@mailbox.org>
 # Contributor:  various people submitting to 'chaotic-aur' repo
 # Contributor:        barfin (aka RogueGirl) <barfin@protonmail.com>
+# Credits:            felipec (thanks for your cleanup gist https://gist.github.com/felipec/86dcbe352d9f01bdc43c89bb5846e1bd)
 
 ## pkginfo
 pkgdesc='A fancy custom distribution of Valves Proton with various patches'

Comment

The change is limited to PKGBUILD metadata: formatting the depends array and pruning/annotating optdepends while adding lapack/lib32-lapack as optional Vosk support. I do not see any new sources, build-time downloads, privilege escalation, install-script changes, or packaging actions that would affect system integrity. The removed optdepends are not a security concern, and the added dependencies are standard Arch packages. Overall this looks like a benign metadata cleanup.

@@ -17,28 +18,13 @@ provides=('proton' "proton-ge-custom=${pkgver/_/.}")
 conflicts=('proton-ge-custom' 'proton-ge-bin')
 
 ## dependencies
-depends=('python')
+depends=(
+  'python'
+)
+
 optdepends=(
-  'vulkan-icd-loader'
-  'lib32-vkd3d'
+  'vulkan-icd-loader: dxvk dependency'
   'lib32-vulkan-icd-loader: dxvk dependency for 32bit prefixes'
-  # libav support #
-  'lib32-libva'
-  'lib32-libtheora'
-  'lib32-libvdpau'
-  # gstreamer support #
-  'gst-plugins-bad-libs'
-  'lib32-gst-plugins-base-libs'
-  'libjpeg-turbo'
-  'graphene'
-  'lib32-libjpeg-turbo'
-  'lib32-libgudev'
-  'lib32-mpg123'
-  'libsoup'
-  # other libs #
-  'lib32-openssl'
-  'lib32-libusb'
-  # other #
   'kdialog: KDE splash dialog support'
   'zenity: GNOME splash dialog support'
   'python-kivy: splash dialog support (big picture mode)'

Comment

The change only adds two optional dependencies for Vosk speech recognition support (lapack and lib32-lapack). This does not introduce code execution, privilege escalation, network access, or packaging integrity issues. It is a benign metadata update to optdepends and does not affect the build or install behavior of the package.

@@ -47,6 +33,8 @@ optdepends=(
   'winetricks: protonfixes backend - highly recommended'
   'wine: support for 32bit prefixes'
   'xboxdrv: gamepad driver service'
+  'lapack: Vosk speech recognition support'
+  'lib32-lapack: Vosk speech recognition support for 32bit applications'
 )
 
 ## makepkg options

Comment

The change is a no-op formatting/comment tweak in add-to-changelog.sh: it removes a blank comment line before set -euo pipefail. No executable logic, sources, downloads, privilege changes, or packaging behavior are altered. Based on the provided diff hunk, there is no security impact.

@@ -13,7 +13,7 @@
 #
 # Usage:
 #   ./add-to-changelog.sh
-#
+
 set -euo pipefail
 
 # Check prerequisites

Comment

The change is low risk. It only exports a default CARCH when the script is run outside makepkg, then sources PKGBUILD and reads _pkgver directly instead of using eval echo. That removes an eval-based expansion path rather than adding one, and the new uname -m fallback is local-only with no network, privilege, or persistence impact. I don’t see any new supply-chain, execution, or packaging red flags in this hunk.

@@ -39,12 +39,16 @@ if [[ ! -f changelog.md ]]; then
   exit 1
 fi
 
+# PKGBUILDs normally get CARCH from makepkg.
+# Define it here so the PKGBUILD can also be sourced directly.
+export CARCH="${CARCH:-$(uname -m)}"
+
 # Source the PKGBUILD to evaluate variables
 # shellcheck disable=SC1091
 source PKGBUILD
 
-# Get the actual version (may need expansion)
-version=$(eval echo "${_pkgver}")
+# Get the resolved upstream version
+version="${_pkgver}"
 
 if [[ -z "$version" ]]; then
   echo "Error: Could not determine version from PKGBUILD" >&2

Comment

The change is low risk. It tightens error handling for the GitHub API fetch (`curl -f` and empty-body handling), prevents duplicate changelog entries, and slightly improves quoting/line-ending handling. There are no new network destinations, no privilege changes, no persistence mechanisms, and no evidence of command injection or unsafe file writes beyond the existing local `changelog.md` update. The only notable behavior change is that the script now fails if the version header already exists, which is a safe integrity check.

@@ -55,20 +59,28 @@ echo "Fetching release notes for $version..."
 
 # Fetch release data from GitHub API
 api_url="https://api.github.com/repos/GloriousEggroll/proton-ge-custom/releases/tags/$version"
-release_body=$(curl -sL "$api_url" | jq -r '.body')
+release_body=$(curl -fsSL "$api_url" | jq -r '.body // empty')
 
-if [[ "$release_body" == "null" || -z "$release_body" ]]; then
+if [[ -z "$release_body" ]]; then
   echo "Error: Could not fetch release notes for version $version" >&2
   echo "Check that the release exists: https://github.com/GloriousEggroll/proton-ge-custom/releases/tag/$version" >&2
   exit 1
 fi
 
+# Avoid adding the same release twice
+if grep -Fxq "## $version" changelog.md; then
+  echo "Error: $version already exists in changelog.md" >&2
+  exit 1
+fi
+
 {
   echo "## $version"
   echo
-  echo "$release_body" | tr -d '\r' # DOS line endings to Unix
+  printf '%s\n' "$release_body" | tr -d '\r'
   echo
   cat changelog.md
-} > changelog.md.tmp && mv changelog.md.tmp changelog.md
+} > changelog.md.tmp
+
+mv changelog.md.tmp changelog.md
 
-echo "✓ Added $version release notes to changelog.md"
+echo "✓ Added $version release notes to changelog.md"
\ No newline at end of file

Comment

The change only adds a changelog entry announcing a hotfix for Easy-Anticheat loading. It does not modify build scripts, sources, install hooks, systemd units, permissions, or any executable content. No security-relevant behavior is introduced by this documentation-only edit.

@@ -1,3 +1,7 @@
+## GE-Proton11-5
+
+HOTFIX: Fix broken Easy-Anticheat loading.
+
 ## GE-Proton10-34
 
 Proton: