Review Results

Comment

The only change is a pkgver bump in .SRCINFO from one git snapshot to a newer commit hash. There are no changes to source URLs, checksums, install scripts, permissions, dependencies, or packaging logic in the provided diff. On its face this is a routine version update with no security red flags visible in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = plymouth-git
 	pkgdesc = Graphical boot splash screen (git version)
-	pkgver = 26.134.222.r557.g9dd7c370
+	pkgver = 26.134.222.r570.g3704037f
 	pkgrel = 1
 	url = https://www.freedesktop.org/wiki/Software/Plymouth/
 	arch = i686

Comment

The change only adds a new local patch source (`tests.patch`) and its checksum to .SRCINFO, alongside a pkgver refresh. I inspected the PKGBUILD and the patch: the patch merely relaxes a test compiler warning (`-Wno-unused-result`) and does not introduce network access, privilege escalation, persistence, or packaging changes outside the normal build flow. The source remains the official upstream GitLab repo over HTTPS, and the new artifact is a local patch with a pinned checksum. No security-relevant red flags are present in this diff.

@@ -37,12 +37,14 @@ pkgbase = plymouth-git
 	source = plymouth.initcpio_install
 	source = plymouth-shutdown.initcpio_install
 	source = plymouthd.conf.patch
+	source = tests.patch
 	source = 50-plymouth.conf
 	b2sums = SKIP
 	b2sums = afb2449b542aa3e971eab6b953c907347fdf4e499b4140a5e6736a7c99557c0d8d2fed28dbee56d84c8c619335c59bd382457d85e51145884ad0616e9095f232
 	b2sums = bd5569458817a29c300de2fb4abcd2e8cd4f57bdebca47cfed7644b548b36b48b0acc80931ae67e32b7b1feb6dad058dacb8b046ad67a734821d753af40c921e
 	b2sums = 1af3f8317ac34f2c080f2624a26784019cf12bf2e08ebb5f017762bdb82e4236b469b64e0bf4bfcde27a5dfb6a90cee416af0285548dd45e6c7ba0db8af85e45
 	b2sums = 9cef4b4f67389904c183352c4d71e31dbf64dc5ccffab8857b782c4c7d5189ac44e09396271921e71908b301afc6cc0b32cf6d781c57c68d96f27a473735b49f
+	b2sums = b2223fed8fb59266e19bdbef2eb8d495b7b931f3b9b94055b1f9ce01ef0728107132e309a80e4ed39778005db25d2cf297a282839d88fd9b1f3e8d15079b507f
 	b2sums = 5ab47942d222c311b495d056f24bdd9d08438162fef1ca6e51982fc00018acbf0c31e4c61164b40950fe2511e17ba2a4635894d145d83a9b349e5a8a83f8c026
 
 pkgname = plymouth-git

Comment

The change only bumps pkgver in PKGBUILD from one git snapshot to a newer git snapshot. No source URLs, build steps, install scripts, permissions, or packaging logic changed in the provided diff, so there is no new security concern visible here. I did not identify any integrity or persistence red flags from this hunk alone.

@@ -5,7 +5,7 @@
 
 pkgname=plymouth-git
 _pkgname=plymouth
-pkgver=26.134.222.r557.g9dd7c370
+pkgver=26.134.222.r570.g3704037f
 pkgrel=1
 pkgdesc='Graphical boot splash screen (git version)'
 arch=('i686' 'x86_64')

Comment

The change adds a local patch file to the source array and applies it during prepare(). The patch only relaxes compiler diagnostics for the tests build by adding -Wno-unused-result, which is a build-time warning suppression and does not introduce network access, privilege escalation, persistence, or packaging outside $pkgdir. The patch content is small, readable, and does not hide any suspicious behavior. Overall this looks low risk.

@@ -49,6 +49,7 @@ source=(
   plymouth.initcpio_install
   plymouth-shutdown.initcpio_install
   plymouthd.conf.patch
+  tests.patch
   50-plymouth.conf
 )
 b2sums=('SKIP'

Comment

The change only adds one new b2sum entry to PKGBUILD, which is consistent with updating the checksum list for an existing source artifact. There are no new sources, no build-script logic changes, no network or privilege-related behavior, and no packaging/install script modifications. Based on the provided diff hunk alone, this appears low risk.

@@ -56,6 +57,7 @@ b2sums=('SKIP'
         'bd5569458817a29c300de2fb4abcd2e8cd4f57bdebca47cfed7644b548b36b48b0acc80931ae67e32b7b1feb6dad058dacb8b046ad67a734821d753af40c921e'
         '1af3f8317ac34f2c080f2624a26784019cf12bf2e08ebb5f017762bdb82e4236b469b64e0bf4bfcde27a5dfb6a90cee416af0285548dd45e6c7ba0db8af85e45'
         '9cef4b4f67389904c183352c4d71e31dbf64dc5ccffab8857b782c4c7d5189ac44e09396271921e71908b301afc6cc0b32cf6d781c57c68d96f27a473735b49f'
+        'b2223fed8fb59266e19bdbef2eb8d495b7b931f3b9b94055b1f9ce01ef0728107132e309a80e4ed39778005db25d2cf297a282839d88fd9b1f3e8d15079b507f'
         '5ab47942d222c311b495d056f24bdd9d08438162fef1ca6e51982fc00018acbf0c31e4c61164b40950fe2511e17ba2a4635894d145d83a9b349e5a8a83f8c026')
 
 pkgver() {

Comment

The change adds a new local patch source (tests.patch) and applies it during prepare(). I inspected the patch: it only adds '-Wno-unused-result' to the test build flags, which is a narrow build-fix and does not introduce execution, persistence, privilege escalation, or network behavior. The PKGBUILD still sources the patch locally with a checksum, and there are no suspicious install-time actions in this diff. Risk is low, though the change does weaken compiler diagnostics for tests slightly.

@@ -73,7 +75,10 @@ prepare() {
   patch -p1 -i $srcdir/plymouthd.conf.patch
   
   # ignore tests for now, the build keeps failing...
-  sed -i "s/^subdir('tests')/# subdir('tests')/" ./meson.build
+  # need to patch tests/meson.build to add '-Wno-unused-result' to silence failing error
+  patch -p1 -i $srcdir/tests.patch
+  #sed -i "s/^subdir('tests')/# subdir('tests')/" ./meson.build
+
 
   # Switch from Cantarell to Adwaita Sans; set monospace font to Adwaita Mono
   sed -i 's/Cantarell/Adwaita Sans/

Comment

The change only adds -Wno-unused-result to the test build flags in tests.patch. This suppresses a compiler diagnostic for the test suite and does not introduce new code execution, network access, privilege changes, or packaging/install behavior. It slightly reduces warning coverage, but there is no direct security impact evident from this patch alone.

@@ -0,0 +1,10 @@
+--- plymouth.src/tests/meson.build
++++ plymouth.patch/tests/meson.build
+@@ -18,6 +18,7 @@
+ test_c_args = [
+   '-Wall',
+   '-Wextra',
+   '-Werror',
++  '-Wno-unused-result',
+   '-Wno-unused-parameter',
+ ]