Review Results

Comment

The change is a simple version bump in .SRCINFO from 6.15 to 6.16 with no accompanying changes to sources, build logic, install scripts, or package metadata beyond pkgver. On its face this does not introduce any new attack surface or supply-chain risk. I did not see evidence of suspicious URLs, build-time downloads, privilege escalation, or persistence mechanisms in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = xscreensaver-arch-logo
 	pkgdesc = Screen saver and locker for the X Window System with Arch Linux branding
-	pkgver = 6.15
+	pkgver = 6.16
 	pkgrel = 1
 	url = https://www.jwz.org/xscreensaver/
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the xscreensaver tarball from 6.15 to 6.16 on the official jwz.org HTTPS source. No new sources, scripts, patches, or packaging behavior are introduced by this diff, and there are no signs of privilege escalation, persistence, or integrity issues in the reviewed hunk.

@@ -24,7 +24,7 @@ pkgbase = xscreensaver-arch-logo
 	provides = xscreensaver
 	conflicts = xscreensaver
 	backup = etc/pam.d/xscreensaver
-	source = xscreensaver-arch-logo-6.15.tar.gz::https://www.jwz.org/xscreensaver/xscreensaver-6.15.tar.gz
+	source = xscreensaver-arch-logo-6.16.tar.gz::https://www.jwz.org/xscreensaver/xscreensaver-6.16.tar.gz
 	source = LICENSE
 	source = logo-50.gif
 	source = logo-180.gif

Comment

The change only updates .SRCINFO to match a packaging change: bumping xscreensaver from 6.15 to 6.16 and adding a local patch source with a pinned SHA-512. I checked the referenced patch and it is a small build-system tweak that removes an AM_GNU_GETTEXT line from configure; it does not introduce network access, privilege escalation, persistence, or other suspicious behavior. The source URL remains the official upstream site over HTTPS, and the added artifact is locally packaged and checksum-pinned. No security red flags are evident in this diff alone.

@@ -39,7 +39,8 @@ pkgbase = xscreensaver-arch-logo
 	source = logo-50.xpm
 	source = logo-180.xpm
 	source = logo-360.xpm
-	sha512sums = 2a01c6c450c85e427cf2194b96d85017d3817d7e76821f36db9f643dd0c0a30b5197d431044c6a451dc3c3d74252b77e25bd8b51203a5f5c23ddef6e1bd02fb6
+	source = xscreensaver-6.16-configure-gettext.patch
+	sha512sums = 537f0c77b2ae88ecd73619e5bb6d883680090070ebb2b1c3efa113cec8a85ad487f03367ab135c590d3ef31076262882fc40efba1a337fd96121291c895e66f3
 	sha512sums = 529ed9b7904631989803a4e1f306a0f3e496e50a123ebbd6ff77058e52aeb1b2328148d8224e54b547faff14e9d591146b9849c5fb9d1063e6db41f295f3074e
 	sha512sums = a63d93f148500eb8ae4a011286c1e762a38575773381d33fa1c79cb1b94df8bdba54b40c52c5861ab865934f1d3a3a225c1ef5758a698a9e587b0779d76a0a34
 	sha512sums = 4814fa3178d5f37b5422dcfa73b53f94492863e958987590796ea1a5a5df85977033aa2064e2cd6b2b813908751d8f9982e5103b6615d5b60d521d720340483b

Comment

The change is low risk. It updates .SRCINFO to match the PKGBUILD’s version bump to 6.16, adds a new upstream tarball checksum, and records a local patch source/checksum. I checked the referenced patch and it is a small build-system fix that removes an AM_GNU_GETTEXT(external) line from configure; there are no signs of network fetches, privilege escalation, persistence, or embedded binaries introduced by this metadata-only update.

@@ -54,5 +55,6 @@ pkgbase = xscreensaver-arch-logo
 	sha512sums = abc52d3821deb9b34779c7bea2a3512a2bb015982fa1c196a2da75a74d8bf4d6766402dfb620d34b2eb9e117c1c9e9acc2f579c8acb15a1389d40fe0c5d1c93a
 	sha512sums = 5b1762bb1b3f01d23d7df14a0773f34fb0b751c013220e5e105916375ff8f094fb5821f2dbdc3c90ec5d10552dc6e8e15c4491ab239f0e5123eec51a2527ec70
 	sha512sums = dcbf893a99ad1ad8c4868481eea1921c465737cb09b36fc7cafcdee6b0ec9c8b701051e2a17e215ed9b368d79c72b4a752c532e1ddd565602c0d58782b7cb4a7
+	sha512sums = 6cf3c80682b996a4e9120371175db0e5442996c99967e0fae2d38fdcdda6360043267558719bdbea09b18244502e7f1cd50fd6df6dda69d3c07bda65e4ece794
 
 pkgname = xscreensaver-arch-logo

Comment

The change is a simple version bump in PKGBUILD from 6.15 to 6.16 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or other supply-chain red flags in the reviewed hunk. Based on the provided diff alone, this appears low risk.

@@ -5,7 +5,7 @@
 # Contributor: Eric Bélanger <eric@archlinux.org>
 
 pkgname=xscreensaver-arch-logo
-pkgver=6.15
+pkgver=6.16
 pkgrel=1
 pkgdesc="Screen saver and locker for the X Window System with Arch Linux branding"
 url="https://www.jwz.org/${pkgname%%-*}/"

Comment

The change adds a local patch source and applies it during prepare(), but the patch is narrowly scoped to removing a single AM_GNU_GETTEXT(external) line from configure. I found no signs of network fetches at build time, no privilege escalation, no persistence mechanisms, and the new source is pinned and checksumed like the existing upstream assets. The patch does alter build configuration, but in a way that appears to fix a packaging issue rather than introduce executable behavior. Overall this looks low risk.

@@ -44,8 +44,9 @@ source=("${pkgname}-${pkgver}.tar.gz::https://www.jwz.org/${pkgname%%-*}/${pkgna
         logo-512.png
         logo-50.xpm
         logo-180.xpm
-        logo-360.xpm)
-sha512sums=('2a01c6c450c85e427cf2194b96d85017d3817d7e76821f36db9f643dd0c0a30b5197d431044c6a451dc3c3d74252b77e25bd8b51203a5f5c23ddef6e1bd02fb6'
+        logo-360.xpm
+        "${pkgname%%-*}-${pkgver}-configure-gettext.patch")
+sha512sums=('537f0c77b2ae88ecd73619e5bb6d883680090070ebb2b1c3efa113cec8a85ad487f03367ab135c590d3ef31076262882fc40efba1a337fd96121291c895e66f3'
             '529ed9b7904631989803a4e1f306a0f3e496e50a123ebbd6ff77058e52aeb1b2328148d8224e54b547faff14e9d591146b9849c5fb9d1063e6db41f295f3074e'
             'a63d93f148500eb8ae4a011286c1e762a38575773381d33fa1c79cb1b94df8bdba54b40c52c5861ab865934f1d3a3a225c1ef5758a698a9e587b0779d76a0a34'
             '4814fa3178d5f37b5422dcfa73b53f94492863e958987590796ea1a5a5df85977033aa2064e2cd6b2b813908751d8f9982e5103b6615d5b60d521d720340483b'

Comment

The change is low risk. It only bumps pkgver, updates the source checksum, and adds a small local patch that removes a gettext macro invocation from the generated configure script. The patch does not introduce any network access, privilege escalation, persistence, or installation outside the package directory. I did inspect the patch content and it is a one-line build-system tweak, not executable payload. No suspicious sources or packaging behaviors are introduced.

@@ -59,7 +60,8 @@ sha512sums=('2a01c6c450c85e427cf2194b96d85017d3817d7e76821f36db9f643dd0c0a30b519
             'e650ad1351107aef023420bcb7422279efb1f2594362e66b737c960e2a1a5444f4925449ecae5b4ffa3a0127d6645f9d466f3b5d17767c865dcaf438b3b0e44f'
             'abc52d3821deb9b34779c7bea2a3512a2bb015982fa1c196a2da75a74d8bf4d6766402dfb620d34b2eb9e117c1c9e9acc2f579c8acb15a1389d40fe0c5d1c93a'
             '5b1762bb1b3f01d23d7df14a0773f34fb0b751c013220e5e105916375ff8f094fb5821f2dbdc3c90ec5d10552dc6e8e15c4491ab239f0e5123eec51a2527ec70'
-            'dcbf893a99ad1ad8c4868481eea1921c465737cb09b36fc7cafcdee6b0ec9c8b701051e2a17e215ed9b368d79c72b4a752c532e1ddd565602c0d58782b7cb4a7')
+            'dcbf893a99ad1ad8c4868481eea1921c465737cb09b36fc7cafcdee6b0ec9c8b701051e2a17e215ed9b368d79c72b4a752c532e1ddd565602c0d58782b7cb4a7'
+            '6cf3c80682b996a4e9120371175db0e5442996c99967e0fae2d38fdcdda6360043267558719bdbea09b18244502e7f1cd50fd6df6dda69d3c07bda65e4ece794')
 
 prepare() {
   local logos_png

Comment

The change adds a local patch to the upstream source tree during prepare(), but the patch is narrowly scoped and only removes an AM_GNU_GETTEXT(external) line from configure. I checked the patch contents and it does not introduce any code execution, network access, privilege escalation, or packaging-side persistence. The source URL remains HTTPS and the new patch is included in source() with a checksum, so integrity is preserved. No other suspicious build or install behavior is introduced by this diff.

@@ -86,6 +88,10 @@ prepare() {
   for _file in "${logos[@]}"; do
 	install -Dm0644 "${_file}" "${srcdir}/${pkgname%%-*}-${pkgver}/utils/images/${_file}"
   done
+
+  # Fix xscreensaver-6.16 configure file issue
+  cd "${pkgname%%-*}-${pkgver}"
+  patch -p1 -i "../${pkgname%%-*}-${pkgver}-configure-gettext.patch"
 }
 
 build() {

Comment

This patch only removes the `AM_GNU_GETTEXT(external)` macro invocation from the generated `configure` script in the xscreensaver source tree. It does not add any new code paths, network access, privilege changes, install-time actions, or packaging logic. The change appears to be a build-system compatibility tweak for gettext detection and has no obvious security impact in the reviewed hunk.

@@ -0,0 +1,11 @@
+diff -ura xscreensaver-6.16.orig/configure xscreensaver-6.16.new/configure
+--- xscreensaver-6.16.orig/configure	2026-09-04 10:49:16.939316840 +1200
++++ xscreensaver-6.16.new/configure	2026-09-24 21:21:35.705013425 +1200
+@@ -7962,7 +7962,6 @@
+ 
+ 
+ ALL_LINGUAS="da de es et fi fr hu it ja ko nb nl pl pt pt_BR ru sk sv vi wa zh_CN zh_TW"
+-AM_GNU_GETTEXT(external)
+ MKINSTALLDIRS="$INSTALL_DIRS"
+ 
+ # The library is there, but neither $INTLLIBS nor $LIBINTL are getting set.