Review Results

Comment

The change removes hardcoded include-path overrides that previously forced the build to use /usr/include/mbedtls3 and prevented accidental use of the wrong mbedtls headers. This is a build-environment hygiene change only; it does not add new code execution, network access, privilege escalation, or packaging side effects. I do not see a security issue in the diff itself, though it may affect build compatibility depending on the system's mbedtls setup.

@@ -141,10 +141,6 @@ build() (
   CFLAGS="${CFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=2}"
   CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=2}"
 
-  # ensure extra/mbedtls is not used
-  CFLAGS+=" -I/usr/include/mbedtls3"
-  CXXFLAGS=" -I/usr/include/mbedtls3"
-
   local _cmake_options=(
     -B build
     -S "$_pkgname"

Comment

The change only switches the PKGBUILD's MbedTLS CMake configuration from explicit include/library paths to a standard CMake package directory, and removes a redundant CFLAGS/CXXFLAGS include override. There is no added code execution, network access, privilege escalation, or packaging behavior change. The new path still points to a local system directory under /usr/lib/mbedtls3, so this appears to be a benign build-system cleanup with no security impact.

@@ -154,10 +150,7 @@ build() (
     -DCMAKE_INSTALL_LIBDIR='lib'
     -Wno-author
 
-    -DMbedTLS_INCLUDE_DIR="/usr/include/mbedtls3"
-    -DMbedtls_LIBRARY="/usr/lib/mbedtls3/libmbedtls.so"
-    -DMbedcrypto_LIBRARY="/usr/lib/mbedtls3/libmbedcrypto.so"
-    -DMbedx509_LIBRARY="/usr/lib/mbedtls3/libmbedx509.so"
+    -DMbedTLS_DIR="/usr/lib/mbedtls3/cmake/MbedTLS"
 
     -DCEF_ROOT_DIR="$srcdir/$_cef_src"
     -DOBS_VERSION_OVERRIDE="${pkgver%%.r*}"