Review Results

Comment

The .SRCINFO change is low risk overall. It removes the old RPM-based sources and switches to GitHub-hosted tarballs plus a raw GitHub icon asset, all over HTTPS with pinned release version 1.6.7 and matching checksums. The added noextract entry is consistent with shipping an upstream tarball, and the dependency changes (electron-related runtime libs replaced by alsa-lib/gtk3/nss plus optional libnotify/xdg-utils) look like a packaging adjustment rather than a security issue. One minor concern is that the icon source is fetched from the upstream main branch on raw.githubusercontent.com rather than a tagged release, which is less ideal for reproducibility and supply-chain integrity, but it is still checksum-pinned in .SRCINFO and does not by itself indicate malicious behavior.

@@ -1,23 +1,31 @@
 pkgbase = vesktop-bin
-	pkgdesc = A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.(Prebuilt version.Use system-wide electron)
+	pkgdesc = A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.
 	pkgver = 1.6.7
-	pkgrel = 2
+	pkgrel = 3
 	url = https://vesktop.dev/
 	arch = aarch64
 	arch = x86_64
 	license = GPL-3.0-or-later
-	depends = electron43
-	depends = debugedit
+	depends = alsa-lib
+	depends = gtk3
+	depends = nss
 	optdepends = speech-dispatcher: High-level device independent layer for speech synthesis interface
+	optdepends = libnotify: Notifications
+	optdepends = xdg-utils: Open links, files, etc
 	provides = vesktop=1.6.7
 	provides = vencord-desktop=1.6.7
 	conflicts = vesktop
 	conflicts = vencord-desktop
+	noextract = vesktop-1.6.7.tar.gz
 	source = vesktop.sh
-	sha256sums = a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d
-	source_aarch64 = vesktop-1.6.7-aarch64.rpm::https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7.aarch64.rpm
-	sha256sums_aarch64 = 642473098904feb424aafc0d97d33d20d8c2596186cdfc6e9866fa6bfc6d531d
-	source_x86_64 = vesktop-1.6.7-x86_64.rpm::https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7.x86_64.rpm
-	sha256sums_x86_64 = 0569c8a8956f161a28b82c6fba667e7ee6828df8856247f5c08f18c1b1b0b8fc
+	source = vesktop.desktop
+	source = https://raw.githubusercontent.com/Vencord/Vesktop/refs/heads/main/build/icon.svg
+	sha256sums = 49d5f14ead3caa2b5ec11ae2496c053866d873eedcb14c1424b32132b0cd109b
+	sha256sums = 455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46
+	sha256sums = 7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f
+	source_aarch64 = vesktop-1.6.7.tar.gz::https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7-arm64.tar.gz
+	sha256sums_aarch64 = 152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66
+	source_x86_64 = https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7.tar.gz
+	sha256sums_x86_64 = 152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66
 
 pkgname = vesktop-bin

Comment

The change only adds a .gitignore with standard build-artifact exclusions (/pkg/, /src/, *.tar.*, icon.svg). This does not affect the package build, install scripts, sources, or runtime behavior, and it introduces no execution, network, privilege, or persistence risk. No security concerns identified from this diff alone.

@@ -0,0 +1,4 @@
+/pkg/
+/src/
+*.tar.*
+icon.svg

Comment

The change is limited to maintainer metadata and a pkgrel bump from 2 to 3. No source URLs, build steps, install scripts, permissions, or package contents were altered in the provided diff hunk. I see no security-relevant behavior introduced by this change.

@@ -1,11 +1,13 @@
-# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
+# Maintainer: Vendicated <vendicated@riseup.net>
+# Maintainer: Kylie C <kyliepc@proton.me>
+# Contributor: zxp19821005 <zxp19821005 at 163 dot com>
 # Contributor: HentaiShiroYuki <hentaishiroyuki at gmail dot com>
 # Contributor: Sofia Lima
 pkgname=vesktop-bin
 _pkgname=vesktop
 _appname=vencord-desktop
 pkgver=1.6.7
-pkgrel=2
+pkgrel=3
 pkgdesc="A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed."
 arch=(
     'aarch64'

Comment

The change only updates checksum values in PKGBUILD to match the current upstream release artifacts and adds per-architecture checksums for the tarballs. I did not see any new sources, build-time network access, script execution, privilege escalation, or packaging behavior changes. The source URLs remain HTTPS and point to the official Vesktop/Vencord GitHub/raw locations. This is a low-risk integrity update, not a security concern by itself.

@@ -37,9 +39,11 @@ source=(
     "https://raw.githubusercontent.com/Vencord/Vesktop/refs/heads/main/build/icon.svg"
 )
 noextract=("${_pkgname}-${pkgver}.tar.gz")
-sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
-sha256sums_aarch64=('642473098904feb424aafc0d97d33d20d8c2596186cdfc6e9866fa6bfc6d531d')
-sha256sums_x86_64=('0569c8a8956f161a28b82c6fba667e7ee6828df8856247f5c08f18c1b1b0b8fc')
+sha256sums=('49d5f14ead3caa2b5ec11ae2496c053866d873eedcb14c1424b32132b0cd109b'
+            '455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46'
+            '7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f')
+sha256sums_aarch64=('152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66')
+sha256sums_x86_64=('152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66')
 
 prepare() {
     sed -i -e "

Comment

The change only removes environment-variable setup from vesktop.sh: CHROME_DESKTOP is no longer exported, and the ELECTRON_TRASH helper selection by desktop environment is deleted. This does not introduce any new execution, persistence, network, privilege, or integrity risk. The impact is functional/regression-only (taskbar grouping and trash integration may degrade), but there is no security concern in the diff itself.

@@ -1,26 +1,6 @@
 #!/bin/sh
 set -e
 
-# 1. Desktop Environment (DE) Compatibility
-# Set CHROME_DESKTOP to match the .desktop file for correct taskbar icon grouping
-export CHROME_DESKTOP="@appname@.desktop"
-
-# Fix for Electron's trash implementation on different DEs
-case "${XDG_CURRENT_DESKTOP}" in
-    KDE)
-        export ELECTRON_TRASH="kioclient5"
-        ;;
-    GNOME)
-        export ELECTRON_TRASH="gio"
-        ;;
-    XFCE)
-        export ELECTRON_TRASH="gvfs-trash"
-        ;;
-    *)
-        # Default fallback
-        ;;
-esac
-
 # 2. Load user-defined flags
 # The script checks for flags in the following order (later files override/append to earlier ones):
 # 1. System-wide Electron flags: $XDG_CONFIG_HOME/electron-flags.conf