Review Results

Comment

The change is limited to .SRCINFO metadata: pkgrel increments from 3 to 4 and the license field is corrected from the generic 'GPL' to 'GPL-2.0-only'. There are no source, build, install-script, or packaging behavior changes, and no new integrity or privilege-related concerns are introduced by this metadata-only update.

@@ -1,11 +1,11 @@
 pkgbase = jellyfin-desktop
 	pkgdesc = Jellyfin Desktop Client
 	pkgver = 2.0.0
-	pkgrel = 3
+	pkgrel = 4
 	url = https://github.com/jellyfin/jellyfin-desktop
 	arch = i686
 	arch = x86_64
-	license = GPL
+	license = GPL-2.0-only
 	makedepends = cmake
 	makedepends = git
 	makedepends = ninja

Comment

The change switches the source from a release tarball on the archived upstream repo to a git VCS source pinned to tag v2.0.0 on the current upstream repository. This is not inherently malicious, and the tag pin avoids floating HEAD. The only notable risk is that VCS sources are less reproducible than release tarballs and rely on the integrity of the tag/object resolution, but there is no evidence of a supply-chain or execution issue in this diff. No build scripts or install hooks are changed here.

@@ -18,7 +18,7 @@ pkgbase = jellyfin-desktop
 	depends = protobuf
 	depends = qt6-webengine
 	depends = qt6-declarative
-	source = https://github.com/jellyfin-archive/jellyfin-desktop-qt/archive/refs/tags/v2.0.0.tar.gz
-	sha256sums = 11ba0a7f4f344dc076b9f234193f93684a5621a100607298dfc2d14092b525d5
+	source = git+https://github.com/jellyfin/jellyfin-desktop.git#tag=v2.0.0
+	sha256sums = 43067703588e5ae375507f38bcc421aeeebe08ac86edca17cab4ea98bb5b31dc
 
 pkgname = jellyfin-desktop

Comment

The change is low risk overall. It switches the source from a release tarball to a pinned git tag over HTTPS, which is acceptable from an integrity standpoint, and the tag is version-pinned rather than floating. The added prepare() only initializes submodules and does not introduce network fetches beyond the declared VCS source. The build/package steps still install only into $pkgdir. The only notable concern is that moving from a release tarball to a git checkout reduces reproducibility somewhat and relies on submodule contents at build time, but there is no evidence of malicious behavior, privilege escalation, or unsafe post-install actions in this diff.

@@ -1,33 +1,40 @@
-# Maintainer: Andrew Rabert <ar@nullsum.net>
+# Maintainer: Zen Wen <zen.8841@gmail.com>
+# Contributor: Andrew Rabert <ar@nullsum.net>
 
 pkgname=jellyfin-desktop
 pkgver=2.0.0
-pkgrel=3
+pkgrel=4
 pkgdesc='Jellyfin Desktop Client'
 arch=('i686' 'x86_64')
-license=('GPL')
+license=('GPL-2.0-only')
 url='https://github.com/jellyfin/jellyfin-desktop'
 depends=('mpv' 'mpvqt' 'libcec' 'sdl2' 'p8-platform' 'protobuf' 'qt6-webengine' 'qt6-declarative')
 makedepends=('cmake' 'git' 'ninja' 'python')
-source=("https://github.com/jellyfin-archive/jellyfin-desktop-qt/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('11ba0a7f4f344dc076b9f234193f93684a5621a100607298dfc2d14092b525d5')
+#source=("https://github.com/jellyfin/jellyfin-desktop/archive/refs/tags/v${pkgver}.tar.gz")
+source=("git+https://github.com/jellyfin/jellyfin-desktop.git#tag=v${pkgver}")
+sha256sums=('43067703588e5ae375507f38bcc421aeeebe08ac86edca17cab4ea98bb5b31dc')
 
+prepare() {
+    cd "${srcdir}/jellyfin-desktop"
+    git submodule update --init --recursive
+}
 build() {
-    cd "${srcdir}/jellyfin-desktop-qt-${pkgver}"
+    cd "${srcdir}/jellyfin-desktop"
     rm -rf build
     mkdir build
     cmake \
         -B build \
         -G Ninja \
         -DCMAKE_BUILD_TYPE='Release' \
+        -DUSE_STATIC_MPVQT=ON \
         -DCMAKE_INSTALL_PREFIX='/usr/' \
         -DCMAKE_SKIP_RPATH=1 \
         -DQTROOT=build/qt \
-        -Wno-dev
+        -Wno-author
     cmake --build build
 }
 
 package() {
-    cd "${srcdir}/jellyfin-desktop-qt-${pkgver}"
+    cd "${srcdir}/jellyfin-desktop"
     DESTDIR="${pkgdir}" cmake --install build
 }