Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2. No sources, checksums, dependencies, install scripts, or build commands are altered, so there is no new security-relevant behavior introduced by this diff. Based on the provided hunk alone, this is effectively a metadata-only rebuild and appears safe.

@@ -1,6 +1,6 @@
 pkgbase = qt5-doc
 	pkgver = 5.15.19
-	pkgrel = 1
+	pkgrel = 2
 	url = https://www.qt.io
 	arch = any
 	groups = qt5

Comment

Risk is low. The change only updates .SRCINFO metadata by bumping pkgrel and removing one source/checksum entry, which appears to reflect a packaging adjustment rather than introducing new code execution, network fetches, or privilege changes. I do note that the removed upstream source URL/checksum should be consistent with the actual PKGBUILD, but within this diff there is no evidence of a malicious payload or supply-chain red flag.

@@ -22,10 +22,8 @@ pkgbase = qt5-doc
 	makedepends = clang
 	makedepends = nodejs
 	makedepends = ninja
-	source = https://download.qt.io/archive/qt/5.15/5.15.19/single/qt-everywhere-opensource-src-5.15.19.tar.xz
 	source = no-qmake.patch
 	source = qt-everywhere-src-5.15.17-assimp.patch
-	sha256sums = 173c2326dae138bbb0d98921e9d911e55c00163d93a6db29f294b5e19ff306ae
 	sha256sums = db90fa31381fa0814c9c8c803c9e2f9b36bdd6f52da753399e500c0692352498
 	sha256sums = 9d54e70051adfeed818db437f266e3bba5ccd2f5f9e056515281ee2f7ff71bac
 

Comment

The only change in this diff is a pkgrel bump from 1 to 2 in PKGBUILD. No sources, build steps, install scripts, permissions, or package metadata affecting security were changed. This is a no-op packaging revision with no apparent security impact.

@@ -6,7 +6,7 @@ pkgbase=qt5-doc
 pkgname=(qt5-doc qt5-examples)
 _basever=5.15.19
 pkgver=$_basever
-pkgrel=1
+pkgrel=2
 arch=('any')
 url='https://www.qt.io'
 license=('GPL3' 'LGPL3' 'FDL' 'custom')

Comment

The change replaces a pinned source tarball in `source=()` with a runtime download in `prepare()`, which bypasses Arch's normal source integrity model. The build now fetches from the network during package preparation, and if the first response is XML it parses a redirect URL out of the response body and downloads from that URL as well. That introduces an unvetted network dependency and makes the build trust remote metadata at build time rather than a fixed, checksum-covered source entry. Although the tarball is still SHA-256 checked before extraction, the redirect-following logic is brittle and expands the attack surface (e.g. any compromise or manipulation of the Qt download endpoint/redirect metadata can steer the build to arbitrary HTTPS content that only needs to match the hardcoded hash). This is a supply-chain integrity regression compared with the original PKGBUILD, so I rate it moderately risky.

@@ -14,14 +14,24 @@ makedepends=('qt5-tools' 'python' 'pciutils' 'libxtst' 'libxcursor' 'libxrandr' 
              'gperf' 'nss' 'clang' 'nodejs' 'ninja')
 groups=('qt5')
 _pkgfqn="qt-everywhere-opensource-src-${pkgver}"
-source=("https://download.qt.io/archive/qt/${pkgver%.*}/${pkgver}/single/$_pkgfqn.tar.xz"
-         no-qmake.patch
+_qt_tarball="$_pkgfqn.tar.xz"
+_qt_sha256='173c2326dae138bbb0d98921e9d911e55c00163d93a6db29f294b5e19ff306ae'
+source=(no-qmake.patch
          qt-everywhere-src-5.15.17-assimp.patch)
-sha256sums=('173c2326dae138bbb0d98921e9d911e55c00163d93a6db29f294b5e19ff306ae'
-            'db90fa31381fa0814c9c8c803c9e2f9b36bdd6f52da753399e500c0692352498'
+sha256sums=('db90fa31381fa0814c9c8c803c9e2f9b36bdd6f52da753399e500c0692352498'
             '9d54e70051adfeed818db437f266e3bba5ccd2f5f9e056515281ee2f7ff71bac')
 
 prepare() {
+  local _url="https://download.qt.io/archive/qt/${pkgver%.*}/${pkgver}/single/$_qt_tarball"
+  curl -fsSL -o "$_qt_tarball" "$_url"
+  if [ "$(head -c5 "$_qt_tarball")" = '<?xml' ]; then
+    _url=$(grep -oE '<url location="[^"]+" priority="[0-9]+">[^<]+</url>' "$_qt_tarball" | head -n1 | sed -E 's/^<url[^>]*>//; s@</url>$@@')
+    test -n "$_url"
+    curl -fsSL -o "$_qt_tarball" "$_url"
+  fi
+  echo "$_qt_sha256  $_qt_tarball" | sha256sum -c -
+  bsdtar -xf "$_qt_tarball"
+
   cd ${_pkgfqn/opensource-/}
 
   ln -s /usr/bin qttools/