Review Results

Comment

The change is limited to .SRCINFO metadata: pkgrel increments from 4 to 5 and the license fields are corrected from a generic 'custom' to BSD-2-Clause and BSD-3-Clause. There are no source, build, install-script, or packaging behavior changes, and no security-relevant execution paths are introduced. This looks like a benign metadata update with no apparent risk.

@@ -1,11 +1,12 @@
 pkgbase = libusrsctp
 	pkgdesc = A portable SCTP userland stack
 	pkgver = 0.9.5.0
-	pkgrel = 4
+	pkgrel = 5
 	url = https://github.com/sctplab/usrsctp
 	arch = i686
 	arch = x86_64
-	license = custom
+	license = BSD-2-Clause
+	license = BSD-3-Clause
 	makedepends = automake
 	makedepends = autoconf
 	depends = glibc

Comment

The change is low risk. It only updates pkgrel and corrects the declared license metadata from a generic custom license to the upstream BSD-2-Clause/BSD-3-Clause identifiers, while also removing a manual LICENSE.md install step. There are no new sources, no build-time network access, no privilege changes, and no suspicious scripts or units introduced. The only potential concern is that the package no longer explicitly installs a license file, but that is a packaging completeness issue rather than a security issue.

@@ -1,11 +1,11 @@
 # Maintainer: Adrián Pérez de Castro <aperez@igalia.com>
 pkgname=libusrsctp
 pkgver=0.9.5.0
-pkgrel=4
+pkgrel=5
 pkgdesc="A portable SCTP userland stack"
 arch=(i686 x86_64)
 url=https://github.com/sctplab/usrsctp
-license=(custom)
+license=(BSD-2-Clause BSD-3-Clause)
 depends=(glibc)
 makedepends=(automake autoconf)
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/${pkgver}.tar.gz")

Comment

The change only removes installation of the upstream LICENSE file from package(). This does not introduce any new code execution, network access, privilege escalation, or packaging integrity issues. It slightly reduces license compliance/metadata completeness, but from a security perspective it is benign.

@@ -29,6 +29,4 @@ build() {
 
 package() {
   make -C _build DESTDIR="$pkgdir/" install
-  install -Dm644 "${pkgname#lib}-${pkgver}/LICENSE.md" \
-    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }