Review Results

Comment

The .SRCINFO change is a metadata cleanup only: it removes an extra source entry for jstest-gtk.desktop and its corresponding checksum. The PKGBUILD still only fetches the upstream GitHub repository over HTTPS, with no new build-time network access, no added scripts, and no packaging/install logic changes. I see no security impact from this diff alone.

@@ -10,8 +10,6 @@ pkgbase = jstest-gtk-git
 	makedepends = cmake
 	depends = gtkmm3
 	source = git+https://github.com/Grumbel/jstest-gtk.git
-	source = jstest-gtk.desktop
 	sha256sums = SKIP
-	sha256sums = 8063bdd1426bd772396929bc044de933db40a9888663bc72556ffc62a255c0fc
 
 pkgname = jstest-gtk-git

Comment

The change removes the packaged desktop file from source() and its checksum, leaving only the pinned git VCS source. That is a packaging regression, but not a security issue by itself: it does not introduce network fetches at build time, privilege escalation, persistence, or suspicious execution. The remaining source is still the official GitHub repo over HTTPS and the VCS source is unchanged. Risk is low because the diff only drops an auxiliary desktop entry from the package metadata.

@@ -8,15 +8,12 @@ pkgrel=1
 pkgdesc="A simple GTK2-based joystick tester and calibrator"
 arch=('i686' 'x86_64')
 url="https://github.com/Grumbel/jstest-gtk"
-source=("git+$url.git"
-		'jstest-gtk.desktop')
 license=('GPL3')
 depends=('gtkmm3')
 makedepends=('git' 'cmake')
 _gitname="jstest-gtk"
-
-sha256sums=('SKIP'
-            '8063bdd1426bd772396929bc044de933db40a9888663bc72556ffc62a255c0fc')
+source=("git+$url.git")
+sha256sums=('SKIP')
 
 pkgver() {
   cd "$_gitname"

Comment

The change is a straightforward packaging refactor from manual install steps to CMake's install target. It does not add new sources, network fetches, privilege escalation, or suspicious commands. The source remains the same pinned VCS URL pattern used previously, and the package still installs into $pkgdir via DESTDIR. One minor packaging concern is that the new build() uses `-DCMAKE_BUILD_TYPE=None`, which is unusual but not a security issue. Overall, no meaningful security regression is evident in this diff.

@@ -24,22 +21,12 @@ pkgver() {
 }
 
 build() {
-  cd "$_gitname"
-
-  if [[ ! -e 'build' ]]; then
-      mkdir build
-  fi
-  cd build
-  cmake -DCMAKE_INSTALL_PREFIX=/usr ..
-  make
+  cmake -B build -S "$_gitname" \
+    -DCMAKE_BUILD_TYPE=None \
+    -DCMAKE_INSTALL_PREFIX=/usr
+  cmake --build build
 }
 
 package() {
-  cd "$_gitname"
-
-  install -D -m755 build/jstest-gtk "${pkgdir}/usr/bin/jstest-gtk"
-  install -D -m644 "./data/icons/generic.png" "${pkgdir}/usr/share/icons/jstest-gtk.png"
-  install -D -m644 "../jstest-gtk.desktop" "${pkgdir}/usr/share/applications/jstest-gtk.desktop"
-  mkdir -p "${pkgdir}/usr/share/jstest-gtk"
-  cp -r "../jstest-gtk/data/"* "${pkgdir}/usr/share/jstest-gtk/"
+  DESTDIR="$pkgdir" cmake --install build
 }