Review Results

Comment

The .SRCINFO change is low risk. It only updates the package description, version, and dependency metadata to match a newer upstream sway-git snapshot. There are no added sources, build commands, install scripts, or privilege-related changes in this diff hunk. The new depends entries (glib2, glibc) are standard runtime libraries and do not indicate a supply-chain or persistence concern. No security issues are evident from this metadata-only change.

@@ -1,18 +1,19 @@
 pkgbase = sway-git
-	pkgdesc = Tiling Wayland compositor and replacement for the i3 window manager (git development version)
-	pkgver = 1.11.r7536.0e19d85
+	pkgdesc = Tiling Wayland compositor and replacement for i3 (git development version)
+	pkgver = 1.13.r7704.1652c54
 	pkgrel = 1
 	url = https://github.com/swaywm/sway
 	install = sway-git.install
 	arch = x86_64
 	license = MIT
 	makedepends = git
-	makedepends = libcap
 	makedepends = meson
 	makedepends = scdoc
 	makedepends = wayland-protocols
 	depends = cairo
 	depends = gdk-pixbuf2
+	depends = glib2
+	depends = glibc
 	depends = json-c
 	depends = libdrm
 	depends = libevdev

Comment

The .SRCINFO update is metadata-only and does not introduce executable code or new fetch locations. It adds/adjusts dependency and optdepends declarations, pins the provided version string for sway, and marks two config files as backups. I do not see any supply-chain, privilege-escalation, or persistence risk in this diff alone. The only notable change is the expanded default-configuration dependency metadata (including systemd-libs and ttf-font), but that is packaging metadata rather than an execution path.

@@ -22,20 +23,29 @@ pkgbase = sway-git
 	depends = pango
 	depends = pcre2
 	depends = pixman
+	depends = systemd-libs
+	depends = ttf-font
 	depends = wayland
 	depends = wlroots-git
 	depends = xcb-util-wm
-	optdepends = wmenu: Application launcher used in default configuration
+	optdepends = brightnessctl: Brightness adjustment tool used in default configuration
 	optdepends = foot: Terminal emulator used in default configuration
+	optdepends = grim: Screenshot utility used in default configuration
+	optdepends = libpulse: Volume adjustment tool (pactl) used in default configuration
+	optdepends = playerctl: Media player controller used in default configuration
 	optdepends = polkit: System privilege control. Required if not using seatd service
-	optdepends = swaybg: Wallpaper tool for sway
+	optdepends = swaybg: Wallpaper tool used in default configuration
 	optdepends = swayidle: Idle management daemon
 	optdepends = swaylock: Screen locker
+	optdepends = wmenu: Application launcher used in default configuration
 	optdepends = xdg-desktop-portal-gtk: Portal used for default file picking
 	optdepends = xdg-desktop-portal-wlr: Portal used for screen sharing
-	provides = sway
+	optdepends = xorg-xwayland: X11 support
+	provides = sway=1.13.r7704.1652c54
 	provides = wayland-compositor
 	conflicts = sway
+	backup = etc/sway/config
+	backup = etc/sway/config.d/50-systemd-user.conf
 	source = sway-git::git+https://github.com/swaywm/sway.git
 	source = 50-systemd-user.conf
 	source = sway-portals.conf

Comment

The change is low risk. It only updates package metadata and build commands for the sway-git PKGBUILD: refreshed pkgver, adjusted description, dependency/optdepend lists, added backup entries, and switched the build to a direct meson introspect-based pkgver() plus an explicit -D werror=false. I do not see any new network fetches, shell-eval, privilege escalation, suspicious install-time actions, or changes that would write outside $pkgdir. The only noteworthy behavior change is disabling werror, which affects build strictness but is not a security issue by itself. The dependency additions (glib2, glibc, systemd-libs, ttf-font) and optdepends appear consistent with sway's runtime ecosystem and default config references.

@@ -1,15 +1,18 @@
 # Maintainer: GreyXor <greyxor@protonmail.com>
 # Contributor: Drew DeVault <sir@cmpwn.com>
+# Contributor: Antonin Décimo <antonin dot decimo at gmail dot com>
 pkgname=sway-git
-pkgver=1.11.r7536.0e19d85
+pkgver=1.13.r7704.1652c54
 pkgrel=1
-pkgdesc='Tiling Wayland compositor and replacement for the i3 window manager (git development version)'
+pkgdesc='Tiling Wayland compositor and replacement for i3 (git development version)'
 arch=('x86_64')
 url="https://github.com/swaywm/sway"
 license=("MIT")
 depends=(
 	"cairo"
 	"gdk-pixbuf2"
+	"glib2"
+	"glibc"
 	"json-c"
 	"libdrm"
 	"libevdev"

Comment

The PKGBUILD changes are mostly metadata and build-flag updates, with no obvious malicious behavior. The package still sources the upstream git repo over HTTPS, and the build/install steps remain confined to meson install plus copying packaged files into $pkgdir. I do not see curl|bash, network fetches during build, privilege escalation, or suspicious persistence mechanisms in this diff. The added dependencies/optdepends and backup entries look consistent with packaging sway's default config and systemd-user integration. One minor concern is the new pkgver() implementation shells out to python to parse meson introspection output, but it only reads local project metadata and does not introduce a security issue.

@@ -19,29 +22,39 @@ depends=(
 	"pango"
 	"pcre2"
 	"pixman"
+	"systemd-libs"
+	"ttf-font"
 	"wayland"
 	"wlroots-git"
 	"xcb-util-wm"
 )
 makedepends=(
 	"git"
-	"libcap"
 	"meson"
 	"scdoc"
 	"wayland-protocols"
 )
 optdepends=(
-	'wmenu: Application launcher used in default configuration'
+	'brightnessctl: Brightness adjustment tool used in default configuration'
 	'foot: Terminal emulator used in default configuration'
+	'grim: Screenshot utility used in default configuration'
+	'libpulse: Volume adjustment tool (pactl) used in default configuration'
+	'playerctl: Media player controller used in default configuration'
 	'polkit: System privilege control. Required if not using seatd service'
-	'swaybg: Wallpaper tool for sway'
+	'swaybg: Wallpaper tool used in default configuration'
 	'swayidle: Idle management daemon'
 	'swaylock: Screen locker'
+	'wmenu: Application launcher used in default configuration'
 	'xdg-desktop-portal-gtk: Portal used for default file picking'
 	'xdg-desktop-portal-wlr: Portal used for screen sharing'
+	'xorg-xwayland: X11 support'
 )
-provides=("${pkgname%-git}" "wayland-compositor")
+provides=("${pkgname%-git}=${pkgver}" "wayland-compositor")
 conflicts=("${pkgname%-git}")
+backup=(
+	etc/sway/config
+	etc/sway/config.d/50-systemd-user.conf
+)
 install="${pkgname}.install"
 source=("${pkgname}::git+${url}.git"
 	"50-systemd-user.conf"

Comment

The change is low risk. It only adjusts packaging metadata and build commands: adds/updates dependencies and optdepends, changes provides to include an explicit version, marks config files as backup, and simplifies the Meson version lookup/build invocation. I do not see any new network fetches, privilege escalation, shell obfuscation, or install-script/systemd changes in this diff. The only noteworthy behavior change is disabling werror and using a different pkgver derivation path, but that does not introduce a security issue by itself.

@@ -50,34 +63,27 @@ b2sums=('SKIP'
         '71f45f9abb4e9f98a52177b227aa30ab27d02c9eef8a31400460e71c72b6d40ec396581f0b1703d4cec655aaba704077212882f643c6efb6cda951ea69b5383d'
         'cdba5fd2988b7ead8b264d5b41f1c7adb47a6487be1e3a4ce98c0af2094d9964f4bc364237c4437014be18061f067aa741b0382f21365be497e06b189c5c7728')
 
-_meson_setup() {
-	arch-meson "$pkgname" "$1" -D sd-bus-provider=libsystemd
-}
-
-prepare() {
-	_meson_setup build-pkgver
-}
-
 pkgver() {
-	(
-		set -o pipefail
-		meson introspect --projectinfo build-pkgver | sed -n 's/.*"version": "\([^"]*\)".*/\1/;s/-\(dev\|rc[0-9]\+\)//p' | tr -d '\n'
-	)
-	cd "$pkgname"
-	printf ".r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+	cd "${pkgname}"
+	local ver
+	ver=$(meson introspect --projectinfo meson.build 2>/dev/null |
+		python -c 'import json, sys; print(json.load(sys.stdin)["version"].split("-")[0])') || return
+	printf '%s.r%s.%s' "${ver}" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
 }
 
 build() {
-	_meson_setup build
+	arch-meson "${pkgname}" build \
+		-D sd-bus-provider=libsystemd \
+		-D werror=false
 	meson compile -C build
 }
 
 package() {
-	meson install -C build --destdir "$pkgdir"
+	meson install -C build --destdir "${pkgdir}"
 
-	install -Dm644 "${pkgname}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
-	install -Dm644 "${pkgname}/README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
+	install -Dm644 "${pkgname}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
+	install -Dm644 "${pkgname}/README.md" -t "${pkgdir}/usr/share/doc/${pkgname}/"
 
-	install -Dm644 50-systemd-user.conf -t "$pkgdir/etc/sway/config.d/"
-	install -Dm644 sway-portals.conf -t "$pkgdir/usr/share/xdg-desktop-portal/"
+	install -Dm644 50-systemd-user.conf -t "${pkgdir}/etc/sway/config.d/"
+	install -Dm644 sway-portals.conf -t "${pkgdir}/usr/share/xdg-desktop-portal/"
 }

Comment

The change is limited to the .install script and only swaps the order/placement of an existing capability-setting action. It removes the pre-install/pre-upgrade warning about keeping wlroots-git updated, and consolidates the `setcap cap_sys_nice+ep usr/bin/sway` call so it runs in `post_install()` with `post_upgrade()` delegating to it. There is no new network access, privilege escalation beyond the pre-existing file capability assignment, or persistence mechanism introduced. The only security-relevant regression is the removal of the upgrade warning, which could slightly reduce user awareness of ABI compatibility issues, but it does not create a direct security issue.

@@ -1,23 +1,7 @@
-upgrade_wlroots_message() {
-	cat <<END
-
-Please make sure your wlroots-git is up-to-date before compiling sway-git.
-
-END
-}
-
-pre_install() {
-	upgrade_wlroots_message
-}
-
-pre_upgrade() {
-	upgrade_wlroots_message
-}
-
 post_install() {
-	post_upgrade
+	setcap cap_sys_nice+ep usr/bin/sway
 }
 
 post_upgrade() {
-	setcap cap_sys_nice+ep usr/bin/sway
+	post_install
 }