Review Results

Comment

The only change in this diff is a pkgrel bump from 1 to 2 in .SRCINFO. This is metadata-only and does not alter sources, build steps, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by this change.

@@ -1,7 +1,7 @@
 pkgbase = xscreensaver-arch-logo
 	pkgdesc = Screen saver and locker for the X Window System with Arch Linux branding
 	pkgver = 6.17
-	pkgrel = 1
+	pkgrel = 2
 	url = https://www.jwz.org/xscreensaver/
 	arch = x86_64
 	license = 0BSD

Comment

The change only adds a runtime dependency on `wayland` in .SRCINFO. This does not introduce code execution, network access, privilege escalation, persistence, or packaging integrity issues by itself. It is a metadata-only dependency adjustment and appears low risk.

@@ -14,6 +14,7 @@ pkgbase = xscreensaver-arch-logo
 	depends = gtk3
 	depends = libxmu
 	depends = perl-libwww
+	depends = wayland
 	depends = xdg-utils
 	depends = xorg-appres
 	optdepends = fortune-mod: for fortune file support

Comment

The only change in this diff is a pkgrel bump from 1 to 2. No source URLs, build steps, install scripts, dependencies, or packaging behavior changed. This is a metadata-only rebuild and does not introduce any security-relevant behavior.

@@ -6,7 +6,7 @@
 
 pkgname=xscreensaver-arch-logo
 pkgver=6.17
-pkgrel=1
+pkgrel=2
 pkgdesc="Screen saver and locker for the X Window System with Arch Linux branding"
 url="https://www.jwz.org/${pkgname%%-*}/"
 arch=('x86_64')

Comment

The change is low risk. It only adds a runtime dependency on `wayland` and removes an explicit `--with-wayland=no` configure flag, which may enable Wayland support in the upstream build. I did not find any new network fetches, privilege escalation, persistence mechanisms, or suspicious install-time actions in the PKGBUILD diff. The package still builds from the pinned upstream tarball with checksums, and the rest of the packaging logic is unchanged.

@@ -16,6 +16,7 @@ depends=('fontconfig'
          'gtk3'
          'libxmu'
          'perl-libwww'
+         'wayland'
          'xdg-utils'
          'xorg-appres') 
 makedepends=('bc'

Comment

The change is low risk. It removes a commented-out patch reference and drops an explicit --with-wayland=no configure flag while adding a runtime dependency on wayland. There is no evidence of added code execution, network access, privilege escalation, persistence, or packaging outside pkgdir. The package still fetches its main source over HTTPS from the upstream site, and this diff does not introduce any suspicious sources or install scripts.

@@ -45,7 +46,6 @@ source=("${pkgname}-${pkgver}.tar.gz::https://www.jwz.org/${pkgname%%-*}/${pkgna
         logo-50.xpm
         logo-180.xpm
 		logo-360.xpm)
-        #"${pkgname%%-*}-${pkgver}-configure-gettext.patch")
 sha512sums=('236dd14fe63b568063b69ddf79f438c398e725aa1789c1062203c6523867bdd06303ace5a169e308b8b93bff2d1a594973eccc9f6106df12777a2278f41056f2'
             '529ed9b7904631989803a4e1f306a0f3e496e50a123ebbd6ff77058e52aeb1b2328148d8224e54b547faff14e9d591146b9849c5fb9d1063e6db41f295f3074e'
             'a63d93f148500eb8ae4a011286c1e762a38575773381d33fa1c79cb1b94df8bdba54b40c52c5861ab865934f1d3a3a225c1ef5758a698a9e587b0779d76a0a34'

Comment

The change is low risk. It removes a commented-out patch application from prepare() and drops an explicit --with-wayland=no configure flag while adding the wayland dependency. There is no new code execution, no new network fetches, no privilege escalation, and no install-time persistence mechanism. The only behavioral change is enabling Wayland support in the upstream build, which is a normal feature toggle rather than a security concern. I do not see evidence of malicious packaging behavior in this diff.

@@ -87,10 +87,6 @@ prepare() {
   for _file in "${logos[@]}"; do
 	install -Dm0644 "${_file}" "${srcdir}/${pkgname%%-*}-${pkgver}/utils/images/${_file}"
   done
-
-  # Fix xscreensaver-6.16 configure file issue
-  #cd "${pkgname%%-*}-${pkgver}"
-  #patch -p1 -i "../${pkgname%%-*}-${pkgver}-configure-gettext.patch"
 }
 
 build() {

Comment

The change is low risk. It removes an explicit `--with-wayland=no` configure flag and adds a runtime dependency on `wayland`, while keeping the build otherwise unchanged. I do not see any new code execution, network access, privilege escalation, or persistence mechanism introduced by this diff. The package still builds from the same upstream tarball with pinned checksums, and the removed flag only broadens Wayland support rather than enabling a suspicious install path. No security issue is evident from this single hunk.

@@ -109,8 +105,7 @@ build() {
       --without-gle \
       --with-pixbuf \
       --with-jpeg \
-      --with-systemd \
-      --with-wayland=no
+      --with-systemd
   make
 }