Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 0.7.0 to 0.8.0. No source URLs, checksums, build steps, install scripts, permissions, or package metadata that would affect security were changed in the provided diff. Based on this hunk alone, there is no evidence of malicious behavior or integrity risk.

@@ -1,6 +1,6 @@
 pkgbase = xevd
 	pkgdesc = MPEG-5 EVC (Essential Video Coding) decoder
-	pkgver = 0.7.0
+	pkgver = 0.8.0
 	pkgrel = 1
 	url = https://github.com/mpeg5/xevd/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from 0.7.0 to 0.8.0, with the source URL still using HTTPS and pointing to the upstream GitHub project. The only other changes are updated checksums for the tarball and one patch, which is expected for a release update. No new sources, build-time downloads, privilege escalation, or suspicious metadata were introduced in this diff. Based on the provided hunk alone, this appears low risk.

@@ -8,11 +8,11 @@ pkgbase = xevd
 	makedepends = cmake
 	depends = glibc
 	options = !emptydirs
-	source = https://github.com/mpeg5/xevd/archive/v0.7.0/xevd-0.7.0.tar.gz
+	source = https://github.com/mpeg5/xevd/archive/v0.8.0/xevd-0.8.0.tar.gz
 	source = 010-xevd-disable-werror.patch
 	source = 020-xevd-fix-pkg-config.patch
-	sha256sums = febfdb532819bbf36b1b04e74d3ef328ad0f0f2db6224ddb7640fce6bd0014f4
+	sha256sums = 258d626fbb6c7ea1677b4fb0ffed3eaca2ec312810d6a76f67359fdc16068472
 	sha256sums = a7a22d26772657046475b1e664cbab3331355aef847f51bbb74d0bede25462f2
-	sha256sums = 28e46788d188dbbd27c0b47d2c4510029491f434cccfa41967b60d94def36d4a
+	sha256sums = 13dca2086607c63bca3785e832ff17adb494f654c295a24d57a1a3e951bdc6dd
 
 pkgname = xevd

Comment

The patch only adjusts the pkg-config metadata for xevd by adding the library path to Libs.private and moving -lm into the public Libs line. This is a small packaging fix with no code execution, no network access, no privilege changes, and no suspicious install-time behavior. The change affects link flags only and does not introduce any obvious security risk.

@@ -5,7 +5,7 @@
  
  Requires:
 -Libs: -L${libdir} -lxevd
--Libs.private: -lm
+-Libs.private: -L${libdir}/@LIB_NAME@ -lm
 +Libs: -L${libdir} -lxevd -lm
  
  Cflags: -I${includedir}

Comment

The change is a straightforward version bump from 0.7.0 to 0.8.0 with corresponding checksum updates for the upstream tarball and an existing patch. The source remains an HTTPS GitHub release archive, there are no new build-time downloads, no added scripts, and no changes to install/package logic or privileges. Based on the provided diff hunk, I do not see any security-relevant regression.

@@ -1,7 +1,7 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=xevd
-pkgver=0.7.0
+pkgver=0.8.0
 pkgrel=1
 pkgdesc='MPEG-5 EVC (Essential Video Coding) decoder'
 arch=('x86_64')

Comment

The change only updates the PKGBUILD to the new upstream release 0.8.0 and refreshes the source and patch checksums. The source remains an HTTPS GitHub release tarball, there are no new build-time downloads, no suspicious scripts, and the existing patches are ordinary packaging fixes. No privilege escalation, persistence, or integrity red flags are introduced by this diff.

@@ -15,9 +15,9 @@ options=('!emptydirs')
 source=("https://github.com/mpeg5/xevd/archive/v${pkgver}/${pkgname}-${pkgver}.tar.gz"
         '010-xevd-disable-werror.patch'
         '020-xevd-fix-pkg-config.patch')
-sha256sums=('febfdb532819bbf36b1b04e74d3ef328ad0f0f2db6224ddb7640fce6bd0014f4'
+sha256sums=('258d626fbb6c7ea1677b4fb0ffed3eaca2ec312810d6a76f67359fdc16068472'
             'a7a22d26772657046475b1e664cbab3331355aef847f51bbb74d0bede25462f2'
-            '28e46788d188dbbd27c0b47d2c4510029491f434cccfa41967b60d94def36d4a')
+            '13dca2086607c63bca3785e832ff17adb494f654c295a24d57a1a3e951bdc6dd')
 
 prepare() {
     printf '%s\n' "v${pkgver}" > "${pkgname}-${pkgver}/version.txt"