Review Results

Comment

The change is low risk. It only updates the pkgver to a newer git snapshot and adds an install script reference in .SRCINFO. I did not see any evidence in the provided diff of malicious sources, build-time network fetches, privilege escalation, or other supply-chain red flags. The install script itself is not shown here, so this review is limited to the metadata change; based on the diff alone, there is no direct security issue.

@@ -1,8 +1,9 @@
 pkgbase = hyprland-git
 	pkgdesc = Hyprland is an independent, highly customizable, dynamic tiling Wayland compositor that doesn't sacrifice on its looks
-	pkgver = 0.56.2.r130.g4a4a527
+	pkgver = 0.56.2.r164.g1b85c7a
 	pkgrel = 1
 	url = https://github.com/hyprwm/Hyprland
+	install = hyprland-git.install
 	arch = x86_64
 	arch = aarch64
 	license = BSD-3-Clause

Comment

The change only adds `meson` to `makedepends` in `.SRCINFO`. This is a metadata-only update that affects build dependencies, not runtime behavior or package contents. I see no indication of malicious code execution, network access, privilege escalation, or integrity issues from this diff alone.

@@ -11,6 +12,7 @@ pkgbase = hyprland-git
 	makedepends = glaze
 	makedepends = hyprland-protocols-git
 	makedepends = hyprwayland-scanner-git
+	makedepends = meson
 	makedepends = ninja
 	makedepends = xorgproto
 	depends = aquamarine-git

Comment

The change is low risk. It only updates .SRCINFO metadata to match the PKGBUILD: adds the install script and meson makedependency, removes libliftoff from depends, and simplifies optdepends to hyprpm-git. There is no evidence of new code execution, network fetching, privilege escalation, or suspicious sources in this diff. The only notable item is the new install script reference, but the PKGBUILD already declares it and no malicious behavior is visible in the reviewed change.

@@ -31,7 +33,6 @@ pkgbase = hyprland-git
 	depends = libdrm
 	depends = libglvnd
 	depends = libinput
-	depends = libliftoff
 	depends = libx11
 	depends = libxcb
 	depends = libxcomposite

Comment

The diff is low risk. It only updates metadata in .SRCINFO: pkgver bump, adds an install script reference, adds meson to makedepends, removes libliftoff from depends, and collapses several hyprpm-related optdepends into a single optdepend on hyprpm-git. I checked the PKGBUILD for context: the package still builds from the official Hyprland GitHub repo over HTTPS, uses a pinned git source via pkgver, and the build/package steps do not introduce network fetches or privilege escalation. The only potential concern is that .SRCINFO now advertises an install script, but no corresponding .install file exists in the repository tree, so there is no evidence of a new root-executed post-install action in this change. Overall this looks like a packaging metadata adjustment rather than a security-sensitive change.

@@ -63,12 +64,7 @@ pkgbase = hyprland-git
 	depends = xcb-util-renderutil
 	depends = xcb-util-wm
 	depends = xorg-xwayland
-	optdepends = cmake: to build and install plugins using hyprpm
-	optdepends = cpio: to build and install plugins using hyprpm
-	optdepends = glaze: to build and install plugins using hyprpm
-	optdepends = hyprwayland-scanner-git: to build and install plugins using hyprpm
-	optdepends = hyprqt6engine-git: the recommended way to manage qt styles
-	optdepends = meson: to build and install plugins using hyprpm
+	optdepends = hyprpm-git: to build and install plugins
 	optdepends = rtkit: real-time scheduling support
 	provides = hyprland=0.56.2
 	provides = wayland-compositor

Comment

The change only bumps pkgver in PKGBUILD from one git snapshot to a newer git snapshot. No build logic, sources, install scripts, permissions, or packaging behavior changed. Based on the provided diff, there are no new security concerns introduced by this update.

@@ -5,7 +5,7 @@
 
 _pkgname="hyprland"
 pkgname="$_pkgname-git"
-pkgver=0.56.2.r130.g4a4a527
+pkgver=0.56.2.r164.g1b85c7a
 pkgrel=1
 pkgdesc="Hyprland is an independent, highly customizable, dynamic tiling Wayland compositor that doesn't sacrifice on its looks"
 arch=('x86_64' 'aarch64')

Comment

The change is low risk. It removes a runtime dependency on libliftoff, adds an explicit build-time dependency on meson, and disables bundled hyprpm support via a CMake flag while pointing users to a separate hyprpm-git package. I did not find any evidence of network fetches, privilege escalation, suspicious install-script behavior, or other supply-chain red flags in the provided diff. The only minor concern is that the new install script is referenced but not present in this checkout, so I could not inspect it; however, based on the diff alone, the PKGBUILD changes themselves do not introduce a clear security issue.

@@ -31,7 +31,6 @@ depends=(
   libdrm
   libglvnd
   libinput
-  libliftoff
   libx11
   libxcb
   libxcomposite

Comment

The change is low risk. It only adjusts package metadata/build flags: adds meson to makedepends, removes several now-unneeded optdepends, and disables HyprPM at build time via -DNO_HYPRPM=1 while pointing users to a separate hyprpm-git package. I did not find any new network fetches, privilege escalation, install-time scripting, or suspicious source changes in this diff. One minor concern is that the referenced hyprland-git.install file is not present in the repository snapshot, but since the diff only adds the install directive and no install script content is available here, there is no evidence of malicious post-install behavior in the reviewed change itself.

@@ -70,18 +69,12 @@ makedepends=(
   glaze
   hyprland-protocols-git
   hyprwayland-scanner-git
+  meson
   ninja
-  #patch
-  #pkgconf
   xorgproto
 )
 optdepends=(
-  'cmake: to build and install plugins using hyprpm'
-  'cpio: to build and install plugins using hyprpm'
-  'glaze: to build and install plugins using hyprpm'
-  'hyprwayland-scanner-git: to build and install plugins using hyprpm'
-  'hyprqt6engine-git: the recommended way to manage qt styles'
-  'meson: to build and install plugins using hyprpm'
+  'hyprpm-git: to build and install plugins'
   'rtkit: real-time scheduling support'
 )
 

Comment

The change is low risk. It only adds an install script reference, updates the package version, adjusts dependencies, and passes a CMake flag to disable bundled hyprpm support in favor of the separate hyprpm-git package. I could not find the referenced .install file in the repository, so I cannot assess its post-install behavior from this diff; however, the PKGBUILD change itself does not introduce network fetches, privilege escalation, or suspicious build-time execution. The main caveat is that the new install script should be reviewed separately once present, because .install hooks run as root.

@@ -94,6 +87,8 @@ sha256sums=('SKIP')
 
 backup=("usr/share/xdg-desktop-portal/hyprland-portals.conf")
 
+install="hyprland-git.install"
+
 pkgver() {
   cd "$_pkgsrc"
   local _tag=$(git tag -l --contains $(git describe --tags --abbrev=0) --sort=-v:refname | head -n1 | sed 's/^v//')

Comment

The change is a small packaging/build tweak: it disables building Hyprland's bundled hyprpm component via `-DNO_HYPRPM=1` and updates package metadata to depend on `hyprpm-git` instead. There is no evidence of added network access, privilege escalation, persistence, or other malicious behavior in the diff. The only minor concern is that the referenced `.install` file is not present in the checked-out tree, so I could not verify any post-install actions, but the reviewed hunk itself is low risk.

@@ -109,6 +104,7 @@ build() {
     -W no-dev
     -D CMAKE_BUILD_TYPE=None
     -D CMAKE_INSTALL_PREFIX=/usr
+    -DNO_HYPRPM=1 # hyprpm is provided by hyprpm-git
   )
   cmake "${cmake_options[@]}"
   cmake --build build