Review Results

Comment

The change only adds `python-build` to makedepends in `.SRCINFO`. This is a metadata-only update that affects build-time dependency resolution, not runtime behavior. I see no evidence of network fetches, install-script changes, privilege escalation, or other security-relevant behavior in the provided diff hunk.

@@ -11,6 +11,7 @@ pkgbase = libselinux
 	license = libselinux-1.0
 	makedepends = pkgconf
 	makedepends = python
+	makedepends = python-build
 	makedepends = python-pip
 	makedepends = python-setuptools
 	makedepends = ruby

Comment

The change only adds `python-build` to makedepends. This is a standard build dependency for Python packaging and does not introduce new sources, network fetches, privilege changes, install-time scripts, or packaging behavior changes. No security-relevant issues are evident in this diff hunk.

@@ -16,7 +16,7 @@ arch=('i686' 'x86_64' 'armv6h' 'aarch64')
 url='https://github.com/SELinuxProject/selinux'
 license=('libselinux-1.0')
 groups=('selinux')
-makedepends=('pkgconf' 'python' 'python-pip' 'python-setuptools' 'ruby' 'xz' 'swig')
+makedepends=('pkgconf' 'python' 'python-build' 'python-pip' 'python-setuptools' 'ruby' 'xz' 'swig')
 depends=('libsepol>=3.10' 'pcre2')
 optdepends=('python: python bindings'
             'ruby: ruby bindings')

Comment

Low-risk packaging-only change. The new prepare() step performs a narrow in-tree sed substitution to keep the Python bindings building against newer SWIG by replacing PyString_FromString with PyUnicode_FromString in a single upstream source file. There are no new downloads, no network access, no privilege changes, and no installation-time persistence mechanisms. The change is transparent and limited to build-time source patching; the only caveat is that it mutates upstream sources in-place rather than shipping a formal patch, but the edit is straightforward and not suspicious.

@@ -32,6 +32,17 @@ sha256sums=('1ef216c5b56fb7e0a51cd2909787a175a17ee391e0467894807873539ebe766b'
             'SKIP'
             'afe23890fb2e12e6756e5d81bad3c3da33f38a95d072731c0422fbeb0b1fa1fc')
 
+prepare() {
+  cd "${pkgname}-${pkgver}"
+
+  # SWIG 4.5.0 dropped the PyString_* Python 2 compat macros from its
+  # runtime header, breaking the Python bindings build. Fixed upstream
+  # after the 3.11 tag:
+  # https://github.com/SELinuxProject/selinux/commit/fb518ff492cd6a286f35b415cbd7fd0f6e3faedb
+  # TODO: Remove this patch when updating to 3.12 or later.
+  sed -i 's/PyString_FromString/PyUnicode_FromString/g' src/selinuxswig_python.i
+}
+
 build() {
   cd "${pkgname}-${pkgver}"