Review Results

Comment

The change is low risk. It only updates .SRCINFO metadata for the existing winetricks-git package: pkgver is bumped, dependencies are adjusted to match upstream script requirements (bash/perl added, wine retained), and optdepends are expanded to reflect optional helper tools. The source remains the official GitHub repository over HTTPS with SKIP for the VCS source as expected. No new build-time network fetches, install scripts, privilege escalation, or suspicious sources are introduced in this diff. The removal of the bin32-winetricks conflict is a packaging metadata change, not an execution path change, and does not by itself create a security issue in the reviewed hunk.

@@ -1,19 +1,24 @@
 pkgbase = winetricks-git
 	pkgdesc = Script to install various redistributable runtime libraries in Wine.
-	pkgver = 20240105.r47.g72b934e1
+	pkgver = 20260125.r44.gf3890f67
 	pkgrel = 1
 	url = https://wiki.winehq.org/winetricks
 	arch = any
 	license = LGPL-2.1-or-later
 	makedepends = git
-	depends = wine
+	depends = bash
 	depends = cabextract
+	depends = perl
 	depends = unzip
-	optdepends = zenity: For the GTK3 GUI.
-	optdepends = kdialog: For the KDE GUI (less capable).
+	depends = wine
+	optdepends = zenity: GTK GUI
+	optdepends = kdialog: KDE GUI (less capable)
+	optdepends = 7zip: native extraction instead of Windows 7-Zip fallback
+	optdepends = unrar: native extraction of RAR archives
+	optdepends = aria2: preferred downloader
+	optdepends = wget: alternative downloader
 	provides = winetricks
 	conflicts = winetricks
-	conflicts = bin32-winetricks
 	source = winetricks-git::git+https://github.com/Winetricks/winetricks.git
 	sha256sums = SKIP
 

Comment

The change is low risk. It only adjusts package metadata: adds runtime dependencies (bash/perl), updates optional dependencies, removes an obsolete conflict, and changes the pkgver() formatting. The source remains pinned to the upstream GitHub repository over HTTPS, and there are no new build-time downloads, install-script changes, patches, or privileged actions. The only notable integrity regression is that the package now uses sha256sums=('SKIP') in the source array, but for a VCS package this is common and does not by itself introduce a new attack surface beyond the existing trust in the pinned git source. No evidence of malicious behavior or persistence mechanisms in this diff.

@@ -8,23 +8,25 @@ pkgdesc='Script to install various redistributable runtime libraries in Wine.'
 url='https://wiki.winehq.org/winetricks'
 license=('LGPL-2.1-or-later')
 arch=('any')
-depends=('wine' 'cabextract' 'unzip')
+depends=('bash' 'cabextract' 'perl' 'unzip' 'wine')
 makedepends=('git')
-optdepends=('zenity: For the GTK3 GUI.'
-  'kdialog: For the KDE GUI (less capable).'
-)
-conflicts=('winetricks' 'bin32-winetricks')
+optdepends=('zenity: GTK GUI'
+  'kdialog: KDE GUI (less capable)'
+  '7zip: native extraction instead of Windows 7-Zip fallback'
+  'unrar: native extraction of RAR archives'
+  'aria2: preferred downloader'
+  'wget: alternative downloader')
+conflicts=('winetricks')
 provides=('winetricks')
 source=("$pkgname::git+https://github.com/Winetricks/winetricks.git")
+sha256sums=('SKIP')
 
 pkgver() {
   cd "$pkgname"
-  git describe --long --tags | sed -r 's/-([0-9]+)-/.r\1./' | sed -r 's/-test//'
+  git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
 }
 
 package() {
   cd "$pkgname"
   make DESTDIR="$pkgdir" install
 }
-
-sha256sums=('SKIP')