Review Results

Comment

The change is a build-system tweak that forces the compiler to prefer headers from /usr/include/mbedtls3, presumably to avoid using the bundled/alternate mbedtls include path. There is no evidence of network access, privilege escalation, persistence, or installation outside pkgdir. However, the CXXFLAGS line appears to overwrite the existing CXXFLAGS entirely instead of appending, which is a correctness/regression issue rather than a security problem. Overall this looks low risk from a security perspective.

@@ -141,6 +141,10 @@ build() (
   CFLAGS="${CFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=2}"
   CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=2}"
 
+  # ensure extra/mbedtls is not used
+  CFLAGS+=" -I/usr/include/mbedtls3"
+  CXXFLAGS=" -I/usr/include/mbedtls3"
+
   local _cmake_options=(
     -B build
     -S "$_pkgname"