Review Results

Comment

The change is a routine package update in .SRCINFO: it bumps android-studio from 2026.1.3.8 to 2026.1.4.7, updates the upstream Google download URL accordingly, and refreshes checksums. The added dependency/optdepends entries are plausible for the IDE/runtime (fontconfig, libbsd, libxkbcommon, libxkbfile, vulkan-icd-loader) and do not introduce privilege escalation, persistence, or build-time network execution. No suspicious sources, scripts, or packaging directives are present in this diff.

@@ -1,25 +1,29 @@
 pkgbase = android-studio
 	pkgdesc = The official Android IDE (Stable branch)
-	pkgver = 2026.1.3.8
+	pkgver = 2026.1.4.7
 	pkgrel = 1
 	url = https://developer.android.com/
-	arch = i686
 	arch = x86_64
-	license = APACHE
+	license = Apache-2.0
 	depends = alsa-lib
+	depends = fontconfig
 	depends = freetype2
 	depends = libxrender
 	depends = libxtst
 	depends = which
 	optdepends = gtk2: GTK+ look and feel
+	optdepends = libbsd: emulator support
 	optdepends = libgl: emulator support
+	optdepends = libxkbcommon: Wayland support for the bundled runtime
+	optdepends = libxkbfile: emulator support
 	optdepends = ncurses5-compat-libs: native debugger support
+	optdepends = vulkan-icd-loader: Vulkan acceleration for Gemini local models
 	options = !strip
-	source = https://dl.google.com/dl/android/studio/ide-zips/2026.1.3.8/android-studio-quail3-patch1-linux.tar.gz
+	source = https://dl.google.com/dl/android/studio/ide-zips/2026.1.4.7/android-studio-quail4-linux.tar.gz
 	source = android-studio.desktop
 	source = license.html
-	sha256sums = 5bd5ee5d6e747b13f82fba3241380bd358cc2f4a847815c8e860757df13dc35f
-	sha256sums = 73cd2dde1d0f99aaba5baad1e2b91c834edd5db3c817f6fb78868d102360d3c4
-	sha256sums = 9a7563f7fb88c9a83df6cee9731660dc73a039ab594747e9e774916275b2e23e
+	b2sums = c4f0dfad8eff9b8d0d9f2040dc9f26f2c60f7330226060ec1c9254f3a2ee8a8296c6be9002c7ef8818b18730d34dbe67b516036c4ad0378c4f4f6ba857571e5a
+	b2sums = 0b978b7fdbcd277cf432080572b141a760ad169984c9cb09f11c6f3ca0be807483545685c86853329bc4622bf516c7a668148bd25ada906fa7289bb9a7c7ccf8
+	b2sums = 43b288fb81656cd72826a52620e41fbd0daa65d37246cb5b7dbff9c326022eabf18344513517b16134b557d6ae86535f44f863ebd06d6fe0410f92117c1a8c67
 
 pkgname = android-studio

Comment

The change only updates .gitignore to allow two additional tracked files, README.md and android-studio.desktop, into the package repository. This does not affect build logic, install scripts, sources, or runtime behavior by itself. I found no security-relevant execution or integrity impact in this diff hunk alone.

@@ -2,4 +2,6 @@
 !.gitignore
 !.SRCINFO
 !PKGBUILD
+!README.md
+!android-studio.desktop
 !license.html

Comment

The change is low risk. It only updates the upstream Android Studio version, switches the checksum format from sha256sums to b2sums, removes i686 support, and adds a few dependency/optdependency entries. The package still downloads the official tarball from dl.google.com over HTTPS, and the packaging logic remains a straightforward copy/install into $pkgdir with no added network access, privilege escalation, or suspicious post-install behavior. I do note the new optdepends mention Gemini local models and emulator support, but these are just metadata changes and do not introduce executable code. No malicious artifacts or build-time execution were added in this diff.

@@ -10,45 +10,44 @@
 # Maintainer: Kordian Bruck <k@bruck.me>
 
 pkgname=android-studio
-pkgver=2026.1.3.8
-_vername="quail3-patch1"
+pkgver=2026.1.4.7
+_vername="quail4"
 pkgrel=1
 pkgdesc="The official Android IDE (Stable branch)"
-arch=('i686' 'x86_64')
+arch=('x86_64')
 url="https://developer.android.com/"
-license=('APACHE')
-makedepends=()
-depends=('alsa-lib' 'freetype2' 'libxrender' 'libxtst' 'which')
+license=('Apache-2.0')
+depends=('alsa-lib' 'fontconfig' 'freetype2' 'libxrender' 'libxtst' 'which')
 optdepends=('gtk2: GTK+ look and feel'
+            'libbsd: emulator support'
             'libgl: emulator support'
-            'ncurses5-compat-libs: native debugger support')
+            'libxkbcommon: Wayland support for the bundled runtime'
+            'libxkbfile: emulator support'
+            'ncurses5-compat-libs: native debugger support'
+            'vulkan-icd-loader: Vulkan acceleration for Gemini local models')
 options=('!strip')
 source=("https://dl.google.com/dl/android/studio/ide-zips/$pkgver/android-studio-$_vername-linux.tar.gz"
         "$pkgname.desktop"
         "license.html")
-sha256sums=('5bd5ee5d6e747b13f82fba3241380bd358cc2f4a847815c8e860757df13dc35f'
-            '73cd2dde1d0f99aaba5baad1e2b91c834edd5db3c817f6fb78868d102360d3c4'
-            '9a7563f7fb88c9a83df6cee9731660dc73a039ab594747e9e774916275b2e23e')
-
-if [ "$CARCH" = "i686" ]; then
-    depends+=('java-environment')
-fi
+b2sums=('c4f0dfad8eff9b8d0d9f2040dc9f26f2c60f7330226060ec1c9254f3a2ee8a8296c6be9002c7ef8818b18730d34dbe67b516036c4ad0378c4f4f6ba857571e5a'
+        '0b978b7fdbcd277cf432080572b141a760ad169984c9cb09f11c6f3ca0be807483545685c86853329bc4622bf516c7a668148bd25ada906fa7289bb9a7c7ccf8'
+        '43b288fb81656cd72826a52620e41fbd0daa65d37246cb5b7dbff9c326022eabf18344513517b16134b557d6ae86535f44f863ebd06d6fe0410f92117c1a8c67')
 
 package() {
-  cd $srcdir/$pkgname
+  cd "$srcdir/$pkgname" || exit
 
   # Install the application
-  install -d $pkgdir/{opt/$pkgname,usr/bin}
-  cp -a bin lib jbr plugins license LICENSE.txt build.txt product-info.json $pkgdir/opt/$pkgname
-  ln -s /opt/android-studio/bin/studio $pkgdir/usr/bin/$pkgname
+  install -d "$pkgdir/opt/$pkgname" "$pkgdir/usr/bin"
+  cp -a bin lib jbr plugins license LICENSE.txt build.txt product-info.json "$pkgdir/opt/$pkgname"
+  ln -s /opt/android-studio/bin/studio "$pkgdir/usr/bin/$pkgname"
 
   # Copy licenses
-  install -Dm644 LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
-  install -Dm644 $srcdir/license.html "${pkgdir}/usr/share/licenses/${pkgname}/license.html"
+  install -Dm644 LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
+  install -Dm644 "$srcdir/license.html" "$pkgdir/usr/share/licenses/$pkgname/license.html"
 
   # Add the icon and desktop file
-  install -Dm644 bin/studio.png $pkgdir/usr/share/pixmaps/$pkgname.png
-  install -Dm644 $srcdir/$pkgname.desktop $pkgdir/usr/share/applications/$pkgname.desktop
+  install -Dm644 bin/studio.png "$pkgdir/usr/share/pixmaps/$pkgname.png"
+  install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
 
-  chmod -R ugo+rX $pkgdir/opt
+  chmod -R ugo+rX "$pkgdir/opt"
 }

Comment

The change only updates README.md documentation and installation notes. It does not alter PKGBUILD, install scripts, sources, or any executable packaging logic, so there is no direct security impact from this diff. I did not see any malicious instructions, privilege escalation, network-fetching code, or persistence mechanisms introduced here.

@@ -1,5 +1,25 @@
 # Android Studio for Arch Linux
 
-This is a AUR package for Arch Linux packaging the [official releases](https://developer.android.com/studio#downloads) as convience and integrating with any AUR compatible package manager. Find all the details [aur.archlinux.org/packages/android-studio/](https://aur.archlinux.org/packages/android-studio/).
+This is the [Arch User Repository (AUR)](https://aur.archlinux.org/packages/android-studio) package for [Android Studio](https://developer.android.com/studio), the official IDE for Android development. It repackages the stable release tarballs that Google publishes. The IDE installs to `/opt/android-studio`. It bundles its own Java runtime, so you do not need to install Java.
 
-The [Github Repo](https://github.com/kordianbruck/arch-aur-android-studio) is [a mirror of the official repo](https://aur.archlinux.org/cgit/aur.git/log/?h=android-studio), but enables anyone to send pull requests.
+## Installation
+
+Use an AUR helper (a tool that builds and installs AUR packages), such as `paru` or `yay`:
+
+    paru -S android-studio
+
+To build the package by hand:
+
+1. Make sure that the `base-devel` group is installed.
+2. Clone the repository: `git clone https://aur.archlinux.org/android-studio.git`.
+3. Run `makepkg -si` inside the cloned directory.
+
+## Packaging notes
+
+- The IDE is a Java program and does not use Qt. The emulator, which the SDK Manager downloads separately, bundles its own Qt 6 build without a Wayland plugin. If the session sets `QT_QPA_PLATFORM=wayland`, the emulator aborts at startup with a Qt platform plugin error. The desktop entry sets `QT_QPA_PLATFORM=wayland;xcb`: programs that support Wayland use it, and the emulator falls back to X11.
+- The emulator needs `libbsd`, `libxkbfile`, and `libgl`. The package lists them as optional dependencies.
+- Android Studio keeps a separate cache directory for each release series, for example `~/.cache/Google/AndroidStudio2026.1`. These caches grow to about 2 GB each. The IDE deletes the cache and log directories of old releases automatically. To remove them yourself, open Help | Delete Leftover IDE Directories. Your settings stay in place.
+
+## Contributing
+
+The [GitHub repository](https://github.com/kordianbruck/arch-aur-android-studio) is a mirror of the AUR repository and accepts pull requests. You can also report problems in the comments on the [AUR page](https://aur.archlinux.org/packages/android-studio).

Comment

The change only adjusts the desktop launcher to set QT_QPA_PLATFORM=wayland;xcb before invoking android-studio. This is a local environment tweak to improve display backend selection and does not introduce network access, privilege escalation, persistence, or other security-relevant behavior. The command still launches the same binary with the same arguments, and the added env assignment is a standard, non-malicious wrapper.

@@ -2,7 +2,7 @@
 Version=1.0
 Type=Application
 Name=Android Studio
-Exec=android-studio %f
+Exec=env "QT_QPA_PLATFORM=wayland;xcb" android-studio %f
 Icon=android-studio
 Comment=The official Android IDE
 Categories=Development;IDE;