Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2. No sources, build commands, dependencies, install scripts, or packaging behavior changed, so there is no new security risk evident from this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = ffmpeg-full
 	pkgdesc = Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)
 	pkgver = 9.0.2
-	pkgrel = 1
+	pkgrel = 2
 	url = https://ffmpeg.org/
 	arch = x86_64
 	license = LicenseRef-nonfree-and-unredistributable

Comment

The change only adds a new source entry in .SRCINFO for an upstream FFmpeg patch hosted over HTTPS on the official FFmpeg forge, plus the corresponding checksum and pkgrel bump. I did not find any signs of malicious behavior in this metadata-only change: no new build-time network fetches beyond declared sources, no suspicious mirrors or non-official domains, and no install-script or packaging logic changes. The actual patch file is not present in this checkout, so there is no evidence here of harmful patch content. Overall this looks like a routine packaging update with low security risk.

@@ -164,6 +164,7 @@ pkgbase = ffmpeg-full
 	source = 050-ffmpeg-fix-cuda-nvcc-with-gcc14.patch
 	source = 060-ffmpeg-lensfun-fix-pkgconfig.patch
 	source = 070-ffmpeg-whisper.cpp-fix-pkgconfig.patch
+	source = 080-ffmpeg-openapv1.1-fix.patch::https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c54710db21c1827dbc3e47658a562525af0fe528.patch
 	source = LICENSE
 	validpgpkeys = FCF986EA15E6E293A5644F10B4322F04D67658D8
 	sha256sums = 8c3850283eb25fa026482078a04051e0be17347b09ef81a0849bec15a96e002e

Comment

The change only adds one additional sha256 checksum entry to .SRCINFO, with no source URL, build logic, install script, or packaging behavior changed. By itself this is a metadata update and does not introduce executable code, network access, privilege escalation, or persistence mechanisms. I did not see any security-relevant concern in the provided hunk.

@@ -177,6 +178,7 @@ pkgbase = ffmpeg-full
 	sha256sums = 4a9a672f67cc0e5dd63bd7659f5a5198cd981e60bbbc1b9a63277758be6a7fdf
 	sha256sums = c39addf190d25d1182c5c5658677f77ee7c1ae542969b2004441c62a425d324b
 	sha256sums = 2c846c629ad129ae8ce50791de4f1d390714db6d6420a35406b83b9b44999d4a
+	sha256sums = 6eda059a49ec07dc8d0c872c3c1fc71d8f92c5e76463380c62fe027111b3ae2e
 	sha256sums = 04a7176400907fd7db0d69116b99de49e582a6e176b3bfb36a03e50a4cb26a36
 
 pkgname = ffmpeg-full

Comment

The change only bumps pkgrel and adds a new source patch from the official FFmpeg upstream commit URL over HTTPS, with a matching checksum and application in prepare(). I did not find any signs of build-time network fetching beyond declared sources, privilege escalation, or suspicious packaging behavior in this diff. The only caveat is that the actual patch content is not present in the repo snapshot, so I cannot inspect its semantics here; however, based on the packaging change alone, this looks like a routine upstream fix integration rather than a supply-chain risk.

@@ -3,7 +3,7 @@
 
 pkgname=ffmpeg-full
 pkgver=9.0.2
-pkgrel=1
+pkgrel=2
 _svt_hevc_ver='4181c9ee0611baefb40b4c0ed10023cfd837d522'
 _whispercpp_ver='1.9.4'
 pkgdesc='Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)'

Comment

The change adds a new upstream patch source over HTTPS from the official FFmpeg forge and pins it by an explicit commit hash, with a matching sha256 checksum and a corresponding apply step in prepare(). I do not see any suspicious build-time network fetches beyond the declared source array, no privilege escalation, and no packaging-path changes. The only risk is the usual patch-content risk, but the patch itself is not present in the repository checkout to inspect here; based on the PKGBUILD change alone, this looks like a routine integrity-preserving update.

@@ -172,6 +172,7 @@ source=("https://ffmpeg.org/releases/ffmpeg-${pkgver}.tar.xz"{,.asc}
         '050-ffmpeg-fix-cuda-nvcc-with-gcc14.patch'
         '060-ffmpeg-lensfun-fix-pkgconfig.patch'
         '070-ffmpeg-whisper.cpp-fix-pkgconfig.patch'
+        '080-ffmpeg-openapv1.1-fix.patch'::'https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c54710db21c1827dbc3e47658a562525af0fe528.patch'
         'LICENSE')
 sha256sums=('8c3850283eb25fa026482078a04051e0be17347b09ef81a0849bec15a96e002e'
             'SKIP'

Comment

The change only adds a new upstream FFmpeg patch source and applies it during prepare(), with a matching SHA-256 checksum. The source is fetched over HTTPS from the official FFmpeg forge, and there are no new build-time downloads, shell execution patterns, privilege changes, or packaging/install-script changes in this diff. I did not find evidence of malicious behavior in the reviewed hunk itself. Note: the patch file itself is not present in the checked-out tree, so I could not inspect its contents here; however, based on the PKGBUILD-only change shown, the risk appears low.

@@ -184,6 +185,7 @@ sha256sums=('8c3850283eb25fa026482078a04051e0be17347b09ef81a0849bec15a96e002e'
             '4a9a672f67cc0e5dd63bd7659f5a5198cd981e60bbbc1b9a63277758be6a7fdf'
             'c39addf190d25d1182c5c5658677f77ee7c1ae542969b2004441c62a425d324b'
             '2c846c629ad129ae8ce50791de4f1d390714db6d6420a35406b83b9b44999d4a'
+            '6eda059a49ec07dc8d0c872c3c1fc71d8f92c5e76463380c62fe027111b3ae2e'
             '04a7176400907fd7db0d69116b99de49e582a6e176b3bfb36a03e50a4cb26a36')
 validpgpkeys=('FCF986EA15E6E293A5644F10B4322F04D67658D8')
 

Comment

The change only adds a new patch application in prepare() and bumps pkgrel. The patch is fetched via the source=() array over HTTPS from the official FFmpeg forge, with a pinned commit patch URL and matching checksum, so there is no obvious integrity or supply-chain issue in this diff itself. No new build-time network access, privilege escalation, or packaging-path changes are introduced by the hunk. Risk is low, though the actual patch contents are outside this hunk and would need separate review if they were part of the change set.

@@ -196,6 +198,7 @@ prepare() {
     patch -d "ffmpeg-${pkgver}" -Np1 -i "${srcdir}/050-ffmpeg-fix-cuda-nvcc-with-gcc14.patch"
     patch -d lensfun -Np1 -i "${srcdir}/060-ffmpeg-lensfun-fix-pkgconfig.patch"
     patch -d "whisper.cpp-${_whispercpp_ver}" -Np1 -i "${srcdir}/070-ffmpeg-whisper.cpp-fix-pkgconfig.patch"
+    patch -d "ffmpeg-${pkgver}" -Np1 -i "${srcdir}/080-ffmpeg-openapv1.1-fix.patch"
 }
 
 build() {