Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2. No sources, checksums, build steps, dependencies, install scripts, or runtime artifacts are altered, so there is no new security-relevant behavior to assess from this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = git-cola
 	pkgdesc = The highly caffeinated Git GUI
 	pkgver = 4.19.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://git-cola.gitlab.io
 	arch = any
 	license = GPL-2.0-or-later

Comment

The .SRCINFO change only updates declared build/runtime metadata: adds a few makedepends (rst.linker, sphinx-furo, rsync) and adjusts optdepends descriptions plus one extra optional dependency (python-pyqt6-webengine). There are no source URL changes, no new install scripts, no package() logic, and no evidence of network-fetching or privilege-related behavior in this diff. This looks like a routine metadata refresh for documentation/build support, with no security red flags visible in the provided hunk.

@@ -11,19 +11,24 @@ pkgbase = git-cola
 	checkdepends = python-pytest
 	makedepends = python-build
 	makedepends = python-installer
+	makedepends = python-rst.linker
 	makedepends = python-setuptools-scm
 	makedepends = python-sphinx
+	makedepends = python-sphinx-furo
 	makedepends = python-wheel
+	makedepends = rsync
 	depends = git
 	depends = hicolor-icon-theme
 	depends = python-numpy
 	depends = python-polib
 	depends = python-pyqt6
 	depends = python-qtpy
-	optdepends = hunspell: Spell checking support
+	optdepends = aspell: Aspell based spell checking support
+	optdepends = hunspell: Hunspell based checking support
 	optdepends = python-notify2: Enables desktop notifications
 	optdepends = python-pygments: Syntax highlighting
 	optdepends = python-pyinotify: Enable file system change monitoring
+	optdepends = python-pyqt6-webengine
 	optdepends = python-send2trash: Enables "Send to Trash" functionality
 	optdepends = tk: Fallback built-in ssh-askpass handler
 	optdepends = x11-ssh-askpass: Default askpass credential helper

Comment

The change is a trivial metadata-only PKGBUILD update: it adds a contributor line and bumps pkgrel from 1 to 2. No sources, checksums, build steps, install scripts, permissions, or dependencies are modified. There are no new network fetches, privilege changes, persistence mechanisms, or packaging integrity concerns introduced by this diff.

@@ -1,9 +1,10 @@
 # Maintainer: Paul Weingardt <paulweingardt@web.de>
 # Co-Maintainer: Mark Wagie <mark dot wagie at proton dot me>
 # Contributor: TDY <tdy@gmx.com>
+# Contributor: Ivan Shapovalov <intelfx@intelfx.name>
 pkgname=git-cola
 pkgver=4.19.0
-pkgrel=1
+pkgrel=2
 pkgdesc="The highly caffeinated Git GUI"
 arch=('any')
 url="https://git-cola.gitlab.io"

Comment

The change is low risk overall. It only enables previously commented-out build-time dependencies and adjusts the build/test/package steps to use local tooling and avoid rebuilding docs/manpages. I do not see any new network fetches, privilege escalation, suspicious scripts, or installation outside $pkgdir. The only notable behavior change is running documentation generation and tests more explicitly, but these still operate within the package build context and do not introduce obvious supply-chain or persistence concerns.

@@ -19,12 +20,12 @@ depends=(
 makedepends=(
   'python-build'
   'python-installer'
-#  'python-rst.linker'
+  'python-rst.linker'
   'python-setuptools-scm'
   'python-sphinx'
-#  'python-sphinx-furo'
+  'python-sphinx-furo'
   'python-wheel'
-#  'rsync'
+  'rsync'
 )
 checkdepends=(
   'appstream'

Comment

The change is low risk overall. It only adjusts packaging metadata and build steps: adds optional dependencies, restores a few makedepends, removes vendored copies of polib/qtpy from the source tree during prepare(), and changes build/test/package commands to use local documentation targets. I did not see any network fetches, privilege escalation, sudo usage, suspicious external sources, or installation outside $pkgdir. The new check() git config is confined to the build environment and the package() changes still install into DESTDIR. The only notable concern is that removing vendored qtpy/polib assumes the package build uses the system-provided libraries correctly, but that is a normal packaging change rather than a security issue.

@@ -33,10 +34,12 @@ checkdepends=(
   'python-pytest'
 )
 optdepends=(
-  'hunspell: Spell checking support'
+  'aspell: Aspell based spell checking support'
+  'hunspell: Hunspell based checking support'
   'python-notify2: Enables desktop notifications'
   'python-pygments: Syntax highlighting'
   'python-pyinotify: Enable file system change monitoring'
+  'python-pyqt6-webengine'
   'python-send2trash: Enables "Send to Trash" functionality'
   'tk: Fallback built-in ssh-askpass handler'
   'x11-ssh-askpass: Default askpass credential helper'

Comment

The change is low risk overall. It removes additional vendored Python packages (qtpy/polib) from the source tree during prepare(), which is a packaging hygiene improvement rather than a security concern. The other PKGBUILD edits are dependency/build/test adjustments: enabling documented build dependencies, switching tests to use a local git config, and splitting doc/man installation into explicit make invocations. I do not see any new network fetches, privilege escalation, suspicious scripts, or installation outside $pkgdir in the provided diff. The only minor concern is that the new rm -rv commands are broader than before, but they still target vendored directories inside the source tree and do not introduce an obvious attack surface.

@@ -51,7 +54,10 @@ prepare() {
   make clean
 
   # Remove vendorized polib.py
-  rm -v cola/polib.py
+  rm -rv cola/polib.py extras/polib
+
+  # Remove vendored qtpy
+  rm -rv qtpy extras/qtpy
 }
 
 build() {

Comment

Low-risk packaging change. The diff only adjusts build/test/package steps and dependencies: it removes vendored qtpy/polib, adds documentation-related makedepends, and changes doc installation to use local build targets. I do not see any network fetches, privilege escalation, shell injection, or writes outside $pkgdir. The only notable behavior change is in check(): it now sets a local GIT_CONFIG_GLOBAL and writes a git config in the build directory before running tests, which is confined to the build environment and not a persistence or escalation issue. Overall this looks like a benign maintenance update.

@@ -59,7 +65,8 @@ build() {
   export SETUPTOOLS_SCM_PRETEND_VERSION=$pkgver
   python -m build --wheel --no-isolation
 
-#  make doc
+  # Limit to 1 job to avoid build failure
+  make -j1 doc
 }
 
 check() {

Comment

The change is low risk overall. The only security-relevant modification in the provided hunk is in check(): it sets GIT_CONFIG_GLOBAL to a local file and writes a few benign git defaults (init.defaultBranch, user.name, user.email) before running the test suite. This is confined to the build environment and does not introduce network access, privilege escalation, persistence, or writes outside the package build tree. The rest of the diff is packaging/build hygiene (dependency adjustments, vendored code removal, doc/man install changes) and does not show malicious behavior in the reviewed hunk.

@@ -67,7 +74,12 @@ check() {
   desktop-file-validate share/applications/*.desktop
   appstreamcli validate --no-net share/metainfo/*.appdata.xml || :
 
-  make test || :
+  # Use local git config
+  export GIT_CONFIG_GLOBAL="$PWD/git.config"
+  git config --global init.defaultBranch main
+  git config --global user.name "Git Cola"
+  git config --global user.email "git-cola@localhost"
+  make test
 }
 
 package() {

Comment

The change is low risk. It only alters packaging/build behavior to avoid rebuilding docs/manpages during package(), and the new commands still install into $pkgdir with DESTDIR set. I do not see any network fetches, privilege escalation, suspicious scripts, or writes outside the package directory. The added build-time dependencies and check() git config changes are not security issues in this context. The source remains pinned to a signed tag over HTTPS.

@@ -78,8 +90,11 @@ package() {
     install-desktop-files \
     install-icons \
     install-htmldocs \
-    install-metainfo \
-    install-man
+    install-metainfo
+
+  # Don't rebuild man pages & docs
+  make -C docs -o man prefix=/usr DESTDIR="$pkgdir" install-man
+  make -C docs -o html prefix=/usr DESTDIR="$pkgdir" install-html
 
   install -Dm644 "contrib/_${pkgname}" -t "$pkgdir/usr/share/zsh/site-functions/"
   install -Dm644 "contrib/$pkgname-completion.bash" \