Review Results

Comment

The change only bumps pkgver in .SRCINFO from 26.6.2 to 26.9. No build logic, sources, checksums, install scripts, or packaging behavior changed in the reviewed hunk. On its face this is a metadata-only version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = wivrn-server
 	pkgdesc = A wireless Monado-based OpenXR runtime for standalone headsets.
-	pkgver = 26.6.2
+	pkgver = 26.9
 	pkgrel = 1
 	url = https://github.com/WiVRn/WiVRn
 	arch = x86_64

Comment

The change only updates the upstream release tarball URL and its SHA-256 checksum in .SRCINFO, both over HTTPS and pinned to a specific tagged release archive. There are no new build-time fetches, scripts, install hooks, or privilege-related changes in the reviewed hunk. This is a routine version bump with no obvious security red flags in the diff provided.

@@ -58,8 +58,8 @@ pkgbase = wivrn-server
 	depends = qqc2-desktop-style
 	depends = qt6-base
 	depends = qt6-declarative
-	source = wivrn-server-26.6.2.tar.gz::https://github.com/WiVRn/WiVRn/archive/refs/tags/v26.6.2.tar.gz
-	sha256sums = 8b2012a74eb753cbf5a695e5be32e7e3d595cf2f4c6cec2b88eb7d853517686f
+	source = wivrn-server-26.9.tar.gz::https://github.com/WiVRn/WiVRn/archive/refs/tags/v26.9.tar.gz
+	sha256sums = 89f63bc6c89943f3571055381ee2f1aa744d3d11372c56188b21e39c8d8ef733
 
 pkgname = wivrn-server
 	depends = avahi

Comment

The change only updates the lib32 package dependency pin from wivrn-server=26.6.2-1 to wivrn-server=26.9-1 in .SRCINFO. This is a metadata-only version bump with no new sources, scripts, permissions, or install-time behavior introduced in the reviewed hunk. I do not see a security issue in this diff alone.

@@ -93,7 +93,7 @@ pkgname = lib32-wivrn-server
 	depends = lib32-glibc
 	depends = lib32-libglvnd
 	depends = lib32-vulkan-icd-loader
-	depends = wivrn-server=26.6.2-1
+	depends = wivrn-server=26.9-1
 	optdepends = lib32-xrizer: OpenVR to OpenXR translation layer
 	provides = lib32-openxr-runtime
 

Comment

The change only updates the declared dependency version of wivrn-dashboard from wivrn-server=26.6.2-1 to wivrn-server=26.9-1 in .SRCINFO. This is a metadata-only version pin adjustment with no evidence of added code execution, network access, privilege changes, or packaging red flags in the provided diff. On its face it looks like a routine sync with the newer server package version.

@@ -113,4 +113,4 @@ pkgname = wivrn-dashboard
 	depends = qqc2-desktop-style
 	depends = qt6-base
 	depends = qt6-declarative
-	depends = wivrn-server=26.6.2-1
+	depends = wivrn-server=26.9-1

Comment

The change is a routine version bump from 26.6.2 to 26.9 with an updated source checksum and a small CMake argument rename from DGIT_DESC/DGIT_COMMIT to DGIT_TAG. The source remains an HTTPS GitHub release tarball pinned to a specific tag, and there are no new build-time downloads, shell execution, privilege escalation, or packaging changes that would introduce persistence or integrity risks. I do not see any security-relevant red flags in this diff.

@@ -6,7 +6,7 @@ pkgname=(
 	lib32-wivrn-server
 	wivrn-dashboard
 )
-pkgver=26.6.2
+pkgver=26.9
 pkgrel=1
 pkgdesc="A wireless Monado-based OpenXR runtime for standalone headsets."
 arch=(x86_64)

Comment

The change is low risk. It only updates the source tarball checksum and adjusts CMake metadata flags from DGIT_DESC/DGIT_COMMIT to DGIT_TAG, which affects version labeling rather than build behavior or installed artifacts. The source remains an HTTPS GitHub release tarball pinned to a tag, and there are no new network fetches, scripts, privilege changes, or packaging path changes in the diff shown.

@@ -86,14 +86,13 @@ makedepends=(
 )
 
 source=("$pkgname-$pkgver.tar.gz::https://github.com/WiVRn/WiVRn/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('8b2012a74eb753cbf5a695e5be32e7e3d595cf2f4c6cec2b88eb7d853517686f')
+sha256sums=('89f63bc6c89943f3571055381ee2f1aa744d3d11372c56188b21e39c8d8ef733')
 
 build() {
 	cd "WiVRn-$pkgver"
 	cmake -B build-server . \
 	-G Ninja \
-	-DGIT_DESC=v${pkgver} \
-	-DGIT_COMMIT=v${pkgver} \
+	-DGIT_TAG=v${pkgver} \
 	-DWIVRN_BUILD_SERVER=ON \
 	-DWIVRN_BUILD_WIVRNCTL=ON \
 	-DWIVRN_BUILD_CLIENT=OFF \

Comment

Low risk change. The diff only updates the upstream release version/checksum and replaces deprecated CMake cache variables (DGIT_DESC/DGIT_COMMIT) with DGIT_TAG for all build variants. There are no new sources, no network-at-build additions, no privilege changes, and no packaging/install-script modifications. I did not find any security-relevant behavior introduced by this change.

@@ -112,8 +111,7 @@ build() {
 	# 32-bit build
 	PKG_CONFIG_PATH="/usr/lib32/pkgconfig" cmake -B build-server-32 -S . \
 	-G Ninja \
-	-DGIT_DESC=v${pkgver} \
-	-DGIT_COMMIT=v${pkgver} \
+	-DGIT_TAG=v${pkgver} \
 	-DCMAKE_C_FLAGS="-m32" \
 	-DCMAKE_CXX_FLAGS="-m32" \
 	-DWIVRN_BUILD_CLIENT=OFF \

Comment

The change is low risk. It only updates the package version/checksum and switches the CMake metadata from DGIT_DESC/DGIT_COMMIT to DGIT_TAG for three build invocations. This does not introduce new sources, network access, privilege changes, install-time scripts, or packaging behavior. The source remains an HTTPS GitHub release tarball pinned by checksum, and the build/install flow is otherwise unchanged.

@@ -132,8 +130,7 @@ build() {
 
 	cmake -B build-dashboard . \
 	-G Ninja \
-	-DGIT_DESC=v${pkgver} \
-	-DGIT_COMMIT=v${pkgver} \
+	-DGIT_TAG=v${pkgver} \
 	-DWIVRN_BUILD_CLIENT=OFF \
 	-DWIVRN_BUILD_SERVER=OFF \
 	-DWIVRN_BUILD_WIVRNCTL=OFF \