Review Results

Comment

The only change in .SRCINFO is a version bump from 0.8.14 to 0.8.15. No sources, checksums, build steps, install scripts, or package metadata affecting trust boundaries were changed in the reviewed hunk. Based on this diff alone, there is no evidence of a security issue.

@@ -1,6 +1,6 @@
 pkgbase = xboxdrv
 	pkgdesc = Userspace Xbox gamepad driver and input remapper
-	pkgver = 0.8.14
+	pkgver = 0.8.15
 	pkgrel = 1
 	url = https://github.com/xiota/xboxdrv
 	arch = x86_64

Comment

The change is low risk. It switches the VCS source from a pinned commit to a pinned tag on the same HTTPS GitHub repository, which remains integrity-preserving and does not introduce new execution paths, downloads, or packaging scripts. The checksum changes from SKIP to a concrete sha256, improving source verification. Removing the explicit !debug option only affects build/debug packaging behavior and does not create a security issue by itself. No suspicious URLs, privilege changes, or install-time behavior are introduced in this .SRCINFO-only diff.

@@ -14,9 +14,8 @@ pkgbase = xboxdrv
 	depends = dbus-python
 	depends = libusb
 	depends = libx11
-	options = !debug
 	backup = etc/default/xboxdrv
-	source = xboxdrv::git+https://github.com/xiota/xboxdrv.git#commit=a7be45051b2c920d6dfec4d0c515c815883bdaff
-	sha256sums = SKIP
+	source = xboxdrv::git+https://github.com/xiota/xboxdrv.git#tag=v0.8.15
+	sha256sums = 4a2c6d523c52c455214b772dcbf9d03489168ebdb6fb540d3143abf6e881159a
 
 pkgname = xboxdrv

Comment

The change is low risk. It updates the package from a pinned VCS commit to an upstream tag for v0.8.15 and replaces SKIP with a fixed checksum, which improves integrity rather than weakening it. The diff does not introduce new build-time network fetches, shell execution, privilege escalation, install-script behavior, or suspicious sources. I did note that the package still uses a git source URL, but it is now pinned to a tag and checksum-verified, so there is no obvious supply-chain red flag in this hunk.

@@ -2,11 +2,9 @@
 # Contributor: Levente Polyak <anthraxx[at]archlinux[dot]org>
 # Contributor: Andrew Rabert <ar@nullsum.net>
 
-: ${_commit:=a7be45051b2c920d6dfec4d0c515c815883bdaff}
-
 _pkgname="xboxdrv"
 pkgname="$_pkgname"
-pkgver=0.8.14
+pkgver=0.8.15
 pkgrel=1
 pkgdesc="Userspace Xbox gamepad driver and input remapper"
 url="https://github.com/xiota/xboxdrv"

Comment

The change is low risk. It switches the VCS source from a pinned commit to a tagged release (`v0.8.15`) and replaces `SKIP` with a fixed SHA-256 checksum, which improves integrity and reproducibility. The removed `!debug` option only affects debug symbol packaging and does not introduce execution or privilege concerns. I did not see any added build-time network access, install-script changes, or other suspicious behavior in this diff.

@@ -27,13 +25,11 @@ makedepends=(
   'ninja'
 )
 
-options=('!debug')
-
 backup=("etc/default/xboxdrv")
 
 _pkgsrc="$_pkgname"
-source=("$_pkgsrc"::"git+$url.git#commit=$_commit")
-sha256sums=('SKIP')
+source=("$_pkgsrc"::"git+$url.git#tag=v$pkgver")
+sha256sums=('4a2c6d523c52c455214b772dcbf9d03489168ebdb6fb540d3143abf6e881159a')
 
 build() {
   arch-meson build "$_pkgsrc"