Review Results

Comment

The change only adds a runtime dependency on `cpio` in `.SRCINFO`. This does not introduce any new source, build step, install script, or privilege-related behavior, and `.SRCINFO` is metadata only. I see no security impact from this diff alone.

@@ -20,6 +20,7 @@ pkgbase = unityhub
 	depends = zip
 	depends = unzip
 	depends = tar
+	depends = cpio
 	conflicts = unityhub-beta
 	options = !strip
 	source = unityhub-3.20.0.deb::https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/unityhub_3.20.0_amd64.deb

Comment

The change only adds a contributor comment line in PKGBUILD metadata. It does not alter sources, build steps, dependencies, install scripts, permissions, or any executable packaging logic. No security-relevant behavior is introduced by this diff hunk.

@@ -2,6 +2,7 @@
 # Contributor: Oscar Morante <oscar@mooistudios.com>
 # Contributor: sinasio <synasius@gmail.com>
 # Contributor: Marius Glo <marius@mgl.dev>
+# Contributor: Léo <aur@salut-c-leo.fr>
 
 pkgname=unityhub
 pkgver=3.20.0

Comment

The change only adds `cpio` to depends(). This is a normal packaging dependency for extracting the upstream .deb payload and does not introduce new code execution, network access, privilege escalation, or persistence behavior. The source URL remains HTTPS and unchanged. No security-relevant concerns are evident from this diff hunk alone.

@@ -10,7 +11,7 @@ pkgdesc="The Unity Hub is a standalone application that streamlines the way you 
 url="https://unity.com/"
 arch=('x86_64')
 license=('custom')
-depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'libdrm' 'xdg-utils' 'libxcb' 'at-spi2-core' 'util-linux-libs' 'libsecret' 'zip' 'unzip' 'tar')
+depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'libdrm' 'xdg-utils' 'libxcb' 'at-spi2-core' 'util-linux-libs' 'libsecret' 'zip' 'unzip' 'tar' 'cpio')
 source=(
   "$pkgname-$pkgver.deb::https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/unityhub_${pkgver}_amd64.deb"
   'license.txt'