Review Results

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream source URL and checksum from 0.2.1.3 to 1.1.1.0. The source remains on GitHub over HTTPS, the upstream project URL is unchanged, and there are no added build steps, scripts, or suspicious dependencies in this diff. No integrity or persistence red flags are introduced by this metadata-only update.

@@ -1,13 +1,13 @@
 pkgbase = openapv
 	pkgdesc = The reference implementation of the APV codec
-	pkgver = 0.2.1.3
+	pkgver = 1.1.1.0
 	pkgrel = 1
 	url = https://github.com/AcademySoftwareFoundation/openapv/
 	arch = x86_64
 	license = BSD-3-Clause
 	makedepends = cmake
 	depends = glibc
-	source = https://github.com/AcademySoftwareFoundation/openapv/archive/v0.2.1.3-fix/openapv-0.2.1.3.tar.gz
-	sha256sums = b91fbb047869899836aec179e5546a969894a67e2b82f865c87089043a06dd00
+	source = https://github.com/AcademySoftwareFoundation/openapv/archive/v1.1.1.0/openapv-1.1.1.0.tar.gz
+	sha256sums = 956e6e2cc822c63af4c323bf86464f1186171314e67e9c5153f58bd875538470
 
 pkgname = openapv

Comment

The change is a straightforward version bump and source path update for the upstream GitHub release tarball, with a matching checksum update. The source remains HTTPS and points to the official upstream repository, and there are no new build-time downloads, scripts, privilege changes, or packaging actions introduced by this diff. The only notable change is switching the CMake warning suppression flag from -Wno-dev to -Wno-author, which affects build verbosity only. No security issues are evident in the reviewed hunk.

@@ -1,7 +1,7 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=openapv
-pkgver=0.2.1.3
+pkgver=1.1.1.0
 pkgrel=1
 pkgdesc='The reference implementation of the APV codec'
 arch=('x86_64')

Comment

The change is a straightforward upstream version bump and source-path adjustment. The source remains an HTTPS GitHub release tarball, checksum is updated, and the build/package steps still only compile and install into $pkgdir. I do not see any added network fetches, privilege escalation, persistence mechanisms, or suspicious packaging behavior. The only notable change is switching from a '-fix' tarball to the normal release tarball and updating a CMake warning flag, which is not security-relevant.

@@ -9,17 +9,17 @@ url='https://github.com/AcademySoftwareFoundation/openapv/'
 license=('BSD-3-Clause')
 depends=('glibc')
 makedepends=('cmake')
-source=("https://github.com/AcademySoftwareFoundation/openapv/archive/v${pkgver}-fix/${pkgname}-${pkgver}.tar.gz")
-sha256sums=('b91fbb047869899836aec179e5546a969894a67e2b82f865c87089043a06dd00')
+source=("https://github.com/AcademySoftwareFoundation/openapv/archive/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
+sha256sums=('956e6e2cc822c63af4c323bf86464f1186171314e67e9c5153f58bd875538470')
 
 build() {
     CFLAGS+=' -ffat-lto-objects'
-    cmake -B build -S "${pkgname}-${pkgver}-fix" \
+    cmake -B build -S "${pkgname}-${pkgver}" \
         -G 'Unix Makefiles' \
         -DCMAKE_BUILD_TYPE:STRING='None' \
         -DCMAKE_INSTALL_PREFIX:PATH='/usr' \
         -DOAPV_APP_STATIC_BUILD:BOOL='OFF' \
-        -Wno-dev
+        -Wno-author
     cmake --build build
 }
 

Comment

The change only adjusts the LICENSE install path in package(). It does not introduce network access, privilege escalation, suspicious scripts, or packaging outside $pkgdir. I did not see any security-relevant behavior change in this hunk.

@@ -29,5 +29,5 @@ check() {
 
 package() {
     DESTDIR="$pkgdir" cmake --install build
-    install -D -m644 "${pkgname}-${pkgver}-fix/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+    install -D -m644 "${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
 }