Review Results

Comment

The change is low risk. It only swaps the packaged patch file from xdg-base-directory.patch to xorg-binary-path.patch and updates the accompanying comment. The new patch merely changes the Xorg binary path used by chrome-remote-desktop from /usr/lib/xorg/Xorg to /usr/lib/Xorg with a fallback to PATH, which is a packaging/runtime compatibility fix rather than a build-time or install-time execution change. I did not see any added network access, privilege escalation, persistence, or suspicious install-script behavior in this diff. The only caveat is that the new path relies on the system Xorg wrapper layout, but that is an expected Arch-specific adjustment and not a security issue by itself.

@@ -19,7 +19,7 @@ source=(
   "${pkgname}-${pkgver}.deb::https://dl.google.com/linux/${pkgname}/deb/pool/main/c/${pkgname}/${pkgname}_${pkgver}_amd64.deb"
   "pamrule"
   "crd"
-  "xdg-base-directory.patch"
+  "xorg-binary-path.patch"
 )
 sha256sums=('39701c6951b3d9edff08143dccad919468e1866b9897c873141dc4f66baaff72'
             'fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2'

Comment

The change only swaps the patch applied in prepare() from one local patch to another. The new patch changes the hardcoded Xorg path from /usr/lib/xorg/Xorg to /usr/lib/Xorg with a fallback to PATH, which is a packaging/runtime compatibility fix for Chrome Remote Desktop on Arch. I did not see any added network access, privilege escalation, persistence, or install-script behavior in this diff. The patch itself is small and directly related to the package's expected functionality. Low risk.

@@ -40,8 +40,11 @@ prepare() {
   rm -rf "${srcdir}/etc/init.d"
   rm -rf "${srcdir}/etc/pam.d"
 
-  # Fix problem with missing import xdg.BaseDirectory, fixing xorg_binary location
-  patch -Np1 -i "${srcdir}/xdg-base-directory.patch"
+  # Upstream probes /usr/lib/xorg/Xorg and otherwise falls back to "Xorg" from
+  # PATH, which on Arch is the suid wrapper /usr/bin/Xorg; the wrapper refuses
+  # to start the server for non-console users, so the CRD systemd user session
+  # would never get a display.
+  patch -Np1 -i "${srcdir}/xorg-binary-path.patch"
 }
 
 package() {

Comment

The patch only changes the hardcoded Xorg path from /usr/lib/xorg/Xorg to /usr/lib/Xorg, with a fallback to PATH if that exact path is not executable. This is a narrow compatibility fix for Arch’s Xorg layout and does not introduce network access, privilege escalation, persistence, or other security-sensitive behavior. No suspicious code execution or packaging red flags are present in this hunk.

@@ -0,0 +1,11 @@
+--- a/opt/google/chrome-remote-desktop/shared_lib.py
++++ b/opt/google/chrome-remote-desktop/shared_lib.py
+@@ -1445,7 +1445,7 @@
+     self.randr_add_sizes = True
+     self.xorg_conf = config_file.name
+ 
+-    xorg_binary = "/usr/lib/xorg/Xorg";
++    xorg_binary = "/usr/lib/Xorg";
+     if not os.access(xorg_binary, os.X_OK):
+       xorg_binary = "Xorg";
+