Review Results

Comment

The change only bumps pkgver in .SRCINFO from 0.7.0 to 0.7.1. No source URLs, build logic, install scripts, or packaging behavior changed, and there are no new integrity or execution red flags visible in this diff. This appears to be a routine metadata update with negligible security impact.

@@ -1,6 +1,6 @@
 pkgbase = xeve
 	pkgdesc = MPEG-5 EVC (Essential Video Coding) encoder
-	pkgver = 0.7.0
+	pkgver = 0.7.1
 	pkgrel = 1
 	url = https://github.com/mpeg5/xeve/
 	arch = x86_64

Comment

The change only updates .SRCINFO metadata to point to the upstream xeve 0.7.1 release tarball and refreshes the corresponding checksums. The source remains an HTTPS GitHub release archive from the same upstream project, and the patch files are unchanged. No new build steps, scripts, privileges, or network-fetching behavior are introduced by this metadata-only update. Low risk.

@@ -8,11 +8,11 @@ pkgbase = xeve
 	makedepends = cmake
 	depends = glibc
 	options = !emptydirs
-	source = https://github.com/mpeg5/xeve/archive/v0.7.0/xeve-0.7.0.tar.gz
+	source = https://github.com/mpeg5/xeve/archive/v0.7.1/xeve-0.7.1.tar.gz
 	source = 010-xeve-disable-werror.patch
 	source = 020-xeve-fix-pkg-config.patch
-	sha256sums = f60950d063f52adf11ed7196c0bbb0503fa107b0e43af06bdc81fecc24f2a62e
+	sha256sums = 5d1249212f431816b4723937c9ec8491b45ee1bb75c0f46692deaf7f59fbf19c
 	sha256sums = 0579f036b5f1543306c177054f749360740ac798bd2cbc20938d2717c8cd7ea2
-	sha256sums = 68ae77132ec2b3dd8de641d16f3d7cc0de819ddb116484809445666b4d215187
+	sha256sums = aae6de85f948df7d6b3dc0cf5ce477c4a8e2cfd463d3a9abbdd8e85351e17722
 
 pkgname = xeve

Comment

The patch only adjusts the pkg-config metadata for xeve: it moves -lm from Libs.private into Libs and adds an extra library search path in Libs.private. This does not introduce code execution, network access, privilege escalation, or packaging persistence mechanisms. The change is limited to link flags and appears intended to fix consumers linking against the library. No obvious security impact beyond normal build/link behavior.

@@ -5,7 +5,7 @@
  
  Requires:
 -Libs: -L${libdir} -lxeve
--Libs.private: -lm
+-Libs.private: -L${libdir}/@LIB_NAME@ -lm
 +Libs: -L${libdir} -lxeve -lm
  
  Cflags: -I${includedir}

Comment

The change is a straightforward version bump from 0.7.0 to 0.7.1 with corresponding source and patch checksums updated. The source remains an HTTPS GitHub release tarball, there are no new build-time network fetches, no added scripts, and no packaging or privilege-related changes. I did not find any security-relevant red flags in this diff.

@@ -1,7 +1,7 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=xeve
-pkgver=0.7.0
+pkgver=0.7.1
 pkgrel=1
 pkgdesc='MPEG-5 EVC (Essential Video Coding) encoder'
 arch=('x86_64')

Comment

The change is a straightforward version bump from 0.7.0 to 0.7.1 with corresponding checksum updates for the upstream tarball and an existing patch. No new sources, no build-script logic changes, no network-at-build behavior, and no packaging/install/systemd artifacts are introduced by this diff. Based on the provided hunk, there are no security red flags.

@@ -15,9 +15,9 @@ options=('!emptydirs')
 source=("https://github.com/mpeg5/xeve/archive/v${pkgver}/${pkgname}-${pkgver}.tar.gz"
         '010-xeve-disable-werror.patch'
         '020-xeve-fix-pkg-config.patch')
-sha256sums=('f60950d063f52adf11ed7196c0bbb0503fa107b0e43af06bdc81fecc24f2a62e'
+sha256sums=('5d1249212f431816b4723937c9ec8491b45ee1bb75c0f46692deaf7f59fbf19c'
             '0579f036b5f1543306c177054f749360740ac798bd2cbc20938d2717c8cd7ea2'
-            '68ae77132ec2b3dd8de641d16f3d7cc0de819ddb116484809445666b4d215187')
+            'aae6de85f948df7d6b3dc0cf5ce477c4a8e2cfd463d3a9abbdd8e85351e17722')
 
 prepare() {
     printf '%s\n' "v${pkgver}" > "${pkgname}-${pkgver}/version.txt"