Review Results

Comment

The change only updates the generated .SRCINFO pkgver to match a newer upstream git revision. No build logic, sources, install scripts, permissions, or dependencies are changed, and there are no new integrity or execution red flags in the provided diff hunk. This appears to be a routine version bump with negligible security impact.

@@ -1,6 +1,6 @@
 pkgbase = jstest-gtk-git
 	pkgdesc = A simple GTK2-based joystick tester and calibrator
-	pkgver = 0.1.0.r127.g92bdf8e
+	pkgver = 0.1.0.r163.gd910b1c
 	pkgrel = 1
 	url = https://github.com/Grumbel/jstest-gtk
 	arch = i686

Comment

The change removes a local patch source (`fix_datadir.patch`) and its checksum from .SRCINFO, leaving only the upstream git source and desktop file. This is a reduction in attack surface rather than an addition: no new network fetches, no new build-time execution, and no packaging/install-script changes are introduced by this diff. Based on the provided hunk alone, there are no security concerns evident.

@@ -11,9 +11,7 @@ pkgbase = jstest-gtk-git
 	depends = gtkmm3
 	source = git+https://github.com/Grumbel/jstest-gtk.git
 	source = jstest-gtk.desktop
-	source = fix_datadir.patch
 	sha256sums = SKIP
 	sha256sums = 8063bdd1426bd772396929bc044de933db40a9888663bc72556ffc62a255c0fc
-	sha256sums = 2aa59e55543db649bc0d1288ed22ec9b0702c824edd9f84913b8eadd029cac77
 
 pkgname = jstest-gtk-git

Comment

The change only adds a .gitignore that ignores all files except the package metadata, desktop file, and patch. This is a repository hygiene change with no build, install, or runtime impact. No suspicious sources, scripts, permissions, or persistence mechanisms are introduced by this diff.

@@ -0,0 +1,7 @@
+*
+
+!PKGBUILD
+!.SRCINFO
+!jstest-gtk.desktop
+!fix_datadir.patch
+!.gitignore

Comment

The change is low risk. It only updates the VCS-derived pkgver and removes a local patch from source/sums, with no new code execution, network behavior, privilege changes, or packaging logic introduced in the shown hunk. The remaining source is still the upstream GitHub repo over HTTPS, and the package continues to build from source. I did not see any suspicious additions in this diff.

@@ -3,22 +3,20 @@
 # Maintainer: Cazzoo <caz.san@gmail.com>
 
 pkgname=jstest-gtk-git
-pkgver=0.1.0.r127.g92bdf8e
+pkgver=0.1.0.r163.gd910b1c
 pkgrel=1
 pkgdesc="A simple GTK2-based joystick tester and calibrator"
 arch=('i686' 'x86_64')
 url="https://github.com/Grumbel/jstest-gtk"
 source=("git+$url.git"
-		'jstest-gtk.desktop'
-		'fix_datadir.patch')
+		'jstest-gtk.desktop')
 license=('GPL3')
 depends=('gtkmm3')
 makedepends=('git' 'cmake')
 _gitname="jstest-gtk"
 
 sha256sums=('SKIP'
-			'8063bdd1426bd772396929bc044de933db40a9888663bc72556ffc62a255c0fc'
-			'2aa59e55543db649bc0d1288ed22ec9b0702c824edd9f84913b8eadd029cac77')
+            '8063bdd1426bd772396929bc044de933db40a9888663bc72556ffc62a255c0fc')
 
 pkgver() {
   cd "$_gitname"

Comment

The change removes an in-tree patch and switches the build to use the upstream CMake install prefix, while also adjusting packaging paths to match the upstream layout. I do not see any new network access, privilege escalation, persistence, or other security-sensitive behavior introduced by this diff. The only notable risk is that removing the patch could change where data files are installed, but the accompanying package() path updates appear to compensate for that. Overall this looks like a routine packaging fix with no clear security impact.

@@ -28,14 +26,11 @@ pkgver() {
 build() {
   cd "$_gitname"
 
-  msg "Patching..."
-  patch -p1 < "../fix_datadir.patch"
-
   if [[ ! -e 'build' ]]; then
       mkdir build
   fi
   cd build
-  cmake ..
+  cmake -DCMAKE_INSTALL_PREFIX=/usr ..
   make
 }
 

Comment

The change is low risk. It removes an external patch file from the build and instead packages files directly from the upstream source tree, while also setting an explicit CMAKE_INSTALL_PREFIX. I do not see any added network access, privilege escalation, persistence, or other suspicious behavior. The only noteworthy change is the broader `cp -r ../jstest-gtk/data/*` packaging step, which could include additional upstream data files if present, but it still copies only from the checked-out source tree into `$pkgdir` and does not write outside the package directory.

@@ -43,8 +38,8 @@ package() {
   cd "$_gitname"
 
   install -D -m755 build/jstest-gtk "${pkgdir}/usr/bin/jstest-gtk"
-  install -D -m644 "./data/generic.png" "${pkgdir}/usr/share/icons/jstest-gtk.png"
+  install -D -m644 "./data/icons/generic.png" "${pkgdir}/usr/share/icons/jstest-gtk.png"
   install -D -m644 "../jstest-gtk.desktop" "${pkgdir}/usr/share/applications/jstest-gtk.desktop"
   mkdir -p "${pkgdir}/usr/share/jstest-gtk"
-  cp -r "../jstest-gtk/data" "${pkgdir}/usr/share/jstest-gtk/"
+  cp -r "../jstest-gtk/data/"* "${pkgdir}/usr/share/jstest-gtk/"
 }