Review Results

Comment

The only change in the provided .SRCINFO hunk is a version bump from 9.0.1 to 9.0.2. No sources, checksums, build steps, install scripts, permissions, or dependency metadata are altered in the reviewed diff, so there is no new security concern visible in this change alone.

@@ -1,6 +1,6 @@
 pkgbase = ffmpeg-full
 	pkgdesc = Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)
-	pkgver = 9.0.1
+	pkgver = 9.0.2
 	pkgrel = 1
 	url = https://ffmpeg.org/
 	arch = x86_64

Comment

The change is limited to .SRCINFO metadata updates for an ffmpeg-full version bump and corresponding source/checksum refreshes, plus renaming one local patch entry. I did not see any new build-time network fetches, privilege escalation, suspicious URLs, or packaging behavior changes in the reviewed diff. The added/updated sources are official upstream HTTPS locations, and the patch names indicate routine pkg-config fixes rather than executable code injection. Overall this looks like a normal maintenance update with low security risk.

@@ -153,28 +153,30 @@ pkgbase = ffmpeg-full
 	provides = libswscale.so
 	provides = libswresample.so
 	conflicts = ffmpeg
-	source = https://ffmpeg.org/releases/ffmpeg-9.0.1.tar.xz
-	source = https://ffmpeg.org/releases/ffmpeg-9.0.1.tar.xz.asc
+	source = https://ffmpeg.org/releases/ffmpeg-9.0.2.tar.xz
+	source = https://ffmpeg.org/releases/ffmpeg-9.0.2.tar.xz.asc
 	source = git+https://github.com/lensfun/lensfun.git
-	source = https://github.com/ggml-org/whisper.cpp/archive/v1.9.2/whisper.cpp-1.9.2.tar.gz
+	source = https://github.com/ggml-org/whisper.cpp/archive/v1.9.4/whisper.cpp-1.9.4.tar.gz
 	source = 010-ffmpeg-add-svt-hevc.patch
 	source = 020-ffmpeg-add-svt-hevc-docs-g4181c9e.patch::https://raw.githubusercontent.com/OpenVisualCloud/SVT-HEVC/4181c9ee0611baefb40b4c0ed10023cfd837d522/ffmpeg_plugin/0002-doc-Add-libsvt_hevc-encoder-docs.patch
 	source = 030-ffmpeg-add-svt-vp9.patch
 	source = 040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch
 	source = 050-ffmpeg-fix-cuda-nvcc-with-gcc14.patch
-	source = 060-ffmpeg-whisper.cpp-fix-pkgconfig.patch
+	source = 060-ffmpeg-lensfun-fix-pkgconfig.patch
+	source = 070-ffmpeg-whisper.cpp-fix-pkgconfig.patch
 	source = LICENSE
 	validpgpkeys = FCF986EA15E6E293A5644F10B4322F04D67658D8
-	sha256sums = cf38e0e28c7e5605942c4a77755349b0145804a397af37eb1fb4c77cb237f635
+	sha256sums = 8c3850283eb25fa026482078a04051e0be17347b09ef81a0849bec15a96e002e
 	sha256sums = SKIP
 	sha256sums = SKIP
-	sha256sums = a6abd064fcca8b85e794d205abf328c522e9451db43a3eadc178b883b7d0e9cd
+	sha256sums = 57e280cee375ab02425b806ad5146b99f6eb9357e3c2b31357c8a6af2e2e44ae
 	sha256sums = e6fdcb8446b0a0c0967f125d2de5084a5bdb418a1a6608f808cff2c97fc9bd6a
 	sha256sums = a164ebdc4d281352bf7ad1b179aae4aeb33f1191c444bed96cb8ab333c046f81
 	sha256sums = cc80568f7dab2094f4f3bede6d0f068f217161f924915b067b0d287cf53b0849
 	sha256sums = cd1aa93e78800247b4516a01ef391106acb362957bd1e56f85d64906343cddac
 	sha256sums = 4a9a672f67cc0e5dd63bd7659f5a5198cd981e60bbbc1b9a63277758be6a7fdf
-	sha256sums = 98b3d28cbd13bb575c602785f6b8cb0b66ea3128ab5a3a82fc1645822320c136
+	sha256sums = c39addf190d25d1182c5c5658677f77ee7c1ae542969b2004441c62a425d324b
+	sha256sums = 2c846c629ad129ae8ce50791de4f1d390714db6d6420a35406b83b9b44999d4a
 	sha256sums = 04a7176400907fd7db0d69116b99de49e582a6e176b3bfb36a03e50a4cb26a36
 
 pkgname = ffmpeg-full

Comment

The patch only adjusts the generated lensfun pkg-config metadata: it adds missing static-link dependencies (-lglib-2.0 -lstdc++) and a compile-time define, while leaving source fetching, build steps, and installation behavior unchanged. No network, privilege, persistence, or packaging red flags are introduced by this diff. This looks like a straightforward build-fix for static linking rather than a security-sensitive change.

@@ -0,0 +1,10 @@
+--- a/libs/lensfun/lensfun.pc.cmake
++++ b/libs/lensfun/lensfun.pc.cmake
+@@ -10,5 +10,5 @@ Name: lensfun
+ Description: A photographic lens database and access library
+ Version: @VERSION_MAJOR@.@VERSION_MINOR@.@VERSION_MICRO@.@VERSION_BUGFIX@
+ Requires.private: glib-2.0
+-Libs: -L${libdir} -llensfun
+-Cflags: -I${includedir} -I${includedir}/lensfun
++Libs: -L${libdir} -llensfun -lglib-2.0 -lstdc++
++Cflags: -I${includedir} -I${includedir}/lensfun -DCONF_LENSFUN_STATIC

Comment

The patch only adjusts the generated pkg-config metadata for whisper.cpp, changing library/linker flags and include flags. It does not introduce any new code execution, network access, privilege escalation, persistence, or packaging-time writes outside the package directory. The added flags look like build/link compatibility fixes rather than a security concern. No suspicious sources or scripts are involved in this hunk.

@@ -0,0 +1,10 @@
+--- a/cmake/whisper.pc.in
++++ b/cmake/whisper.pc.in
+@@ -6,5 +6,5 @@ includedir=@CMAKE_INSTALL_FULL_INCLUDEDI
+ Name: whisper
+ Description: Port of OpenAI's Whisper model in C/C++
+ Version: @WHISPER_VERSION@
+-Libs: -L${libdir} -lggml  -lggml-base -lwhisper
+-Cflags: -I${includedir}
++Libs: -L${libdir} -lwhisper -lggml -lggml-cpu -lggml-base -lstdc++ -lm -fopenmp -fPIC
++Cflags: -I${includedir} -fopenmp -fPIC

Comment

The change only bumps pkgver from 9.0.1 to 9.0.2 and updates an internal whispercpp version pin from 1.9.2 to 1.9.4. No build logic, sources, install scripts, permissions, or network behavior changed in the provided hunk. On its face this is a routine version update with no security red flags in the diff shown.

@@ -2,10 +2,10 @@
 # Contributor: Iacopo Isimbaldi <isiachi@rhye.it>
 
 pkgname=ffmpeg-full
-pkgver=9.0.1
+pkgver=9.0.2
 pkgrel=1
 _svt_hevc_ver='4181c9ee0611baefb40b4c0ed10023cfd837d522'
-_whispercpp_ver='1.9.2'
+_whispercpp_ver='1.9.4'
 pkgdesc='Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)'
 arch=('x86_64')
 url='https://ffmpeg.org/'

Comment

The change is low risk. It updates the package version and swaps in two local pkg-config patches: one for lensfun and one for whisper.cpp. The lensfun patch only adjusts static-link metadata in lensfun.pc.cmake, and the whisper.cpp patch similarly rewrites pkg-config flags. I do not see any new network fetches, privilege escalation, install-script behavior, or suspicious build-time execution. The only notable concern is that the new whisper.cpp pkg-config file now advertises compiler flags (-fopenmp, -fPIC) in Libs, which is unusual and may be a packaging bug, but it is not a security issue by itself.

@@ -170,18 +170,20 @@ source=("https://ffmpeg.org/releases/ffmpeg-${pkgver}.tar.xz"{,.asc}
         '030-ffmpeg-add-svt-vp9.patch'
         '040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch'
         '050-ffmpeg-fix-cuda-nvcc-with-gcc14.patch'
-        '060-ffmpeg-whisper.cpp-fix-pkgconfig.patch'
+        '060-ffmpeg-lensfun-fix-pkgconfig.patch'
+        '070-ffmpeg-whisper.cpp-fix-pkgconfig.patch'
         'LICENSE')
-sha256sums=('cf38e0e28c7e5605942c4a77755349b0145804a397af37eb1fb4c77cb237f635'
+sha256sums=('8c3850283eb25fa026482078a04051e0be17347b09ef81a0849bec15a96e002e'
             'SKIP'
             'SKIP'
-            'a6abd064fcca8b85e794d205abf328c522e9451db43a3eadc178b883b7d0e9cd'
+            '57e280cee375ab02425b806ad5146b99f6eb9357e3c2b31357c8a6af2e2e44ae'
             'e6fdcb8446b0a0c0967f125d2de5084a5bdb418a1a6608f808cff2c97fc9bd6a'
             'a164ebdc4d281352bf7ad1b179aae4aeb33f1191c444bed96cb8ab333c046f81'
             'cc80568f7dab2094f4f3bede6d0f068f217161f924915b067b0d287cf53b0849'
             'cd1aa93e78800247b4516a01ef391106acb362957bd1e56f85d64906343cddac'
             '4a9a672f67cc0e5dd63bd7659f5a5198cd981e60bbbc1b9a63277758be6a7fdf'
-            '98b3d28cbd13bb575c602785f6b8cb0b66ea3128ab5a3a82fc1645822320c136'
+            'c39addf190d25d1182c5c5658677f77ee7c1ae542969b2004441c62a425d324b'
+            '2c846c629ad129ae8ce50791de4f1d390714db6d6420a35406b83b9b44999d4a'
             '04a7176400907fd7db0d69116b99de49e582a6e176b3bfb36a03e50a4cb26a36')
 validpgpkeys=('FCF986EA15E6E293A5644F10B4322F04D67658D8')
 

Comment

The change is limited to updating two local patch applications and removing a now-redundant manual sed tweak for lensfun pkg-config metadata. The new lensfun patch only adjusts pkg-config linker flags/CFLAGS for static linking, and the whisper.cpp patch similarly updates its pkg-config file to include additional link flags. I do not see any network access, privilege escalation, persistence, or installation outside the package build root introduced by this diff. The only notable risk is that these patches affect build/link behavior, but they are straightforward packaging fixes rather than suspicious code execution.

@@ -192,7 +194,8 @@ prepare() {
     patch -d "ffmpeg-${pkgver}" -Np1 -i "${srcdir}/030-ffmpeg-add-svt-vp9.patch"
     patch -d "ffmpeg-${pkgver}" -Np1 -i "${srcdir}/040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch"
     patch -d "ffmpeg-${pkgver}" -Np1 -i "${srcdir}/050-ffmpeg-fix-cuda-nvcc-with-gcc14.patch"
-    patch -d "whisper.cpp-${_whispercpp_ver}" -Np1 -i "${srcdir}/060-ffmpeg-whisper.cpp-fix-pkgconfig.patch"
+    patch -d lensfun -Np1 -i "${srcdir}/060-ffmpeg-lensfun-fix-pkgconfig.patch"
+    patch -d "whisper.cpp-${_whispercpp_ver}" -Np1 -i "${srcdir}/070-ffmpeg-whisper.cpp-fix-pkgconfig.patch"
 }
 
 build() {

Comment

The change is low risk. It removes a post-install sed rewrite of lensfun.pc and adds an explicit CMake option to disable ccache for the locally built whisper.cpp dependency. There are no new network fetches, privilege changes, persistence mechanisms, or suspicious install-time actions. The removed sed line slightly reduces packaging customization but does not introduce a security issue, and the new CMake flag only affects build caching behavior.

@@ -217,14 +220,12 @@ build() {
         -DINSTALL_PYTHON_MODULE:BOOL='OFF' \
         -DINSTALL_HELPER_SCRIPTS:BOOL='OFF'
     cmake --build build/lensfun --target install
-    sed -i \
-        -e 's/\(-llensfun\)/\1 -lglib-2.0 -lstdc++/' \
-        -e '/Cflags: /s/$/ -DCONF_LENSFUN_STATIC/' "${_pkgconfigdir}/lensfun.pc"
     
     # using whisper-cpp package from the official repositories will cause a circular dependency with ffmpeg,
     # building it locally as a static library for the time being
     cmake -B build/whisper.cpp -S "whisper.cpp-${_whispercpp_ver}" \
         "${_cmake_opts[@]}" \
+        -DGGML_CCACHE:BOOL='OFF' \
         -DWHISPER_BUILD_EXAMPLES:BOOL='OFF' \
         -DWHISPER_BUILD_TESTS:BOOL='OFF'
     cmake --build build/whisper.cpp --target install