Review Results

Comment

The change is limited to .SRCINFO metadata and only updates the pkgver plus moves several libraries from makedepends to depends. There are no new sources, scripts, patches, install hooks, or build commands introduced, so there is no evidence of supply-chain or privilege-escalation risk in this diff. The dependency reshuffle is consistent with packaging metadata maintenance and does not itself execute code.

@@ -1,23 +1,20 @@
 pkgbase = dolphin-emu-git
 	pkgdesc = A Gamecube / Wii emulator
-	pkgver = 2606.r121.g774200dcf4
+	pkgver = 2609.r133.g1f30867901
 	pkgrel = 1
 	url = https://dolphin-emu.org
 	arch = x86_64
 	arch = aarch64
 	license = GPL-2.0-or-later
 	checkdepends = gtest
-	makedepends = alsa-lib
 	makedepends = cmake
 	makedepends = git
-	makedepends = libevdev
-	makedepends = libpulse
 	makedepends = miniupnpc
 	makedepends = ninja
 	makedepends = python
-	makedepends = qt6-base
 	makedepends = qt6-svg
 	makedepends = vulkan-headers
+	depends = alsa-lib
 	depends = bluez-libs
 	depends = bzip2
 	depends = curl

Comment

The change only adds two runtime dependencies in .SRCINFO: libevdev and libpulse. This is a metadata-only update with no evidence of malicious behavior, no new sources, scripts, or build steps, and no privilege or persistence implications. The added dependencies are plausible for Dolphin emulator input/audio support and do not introduce a security concern by themselves.

@@ -27,8 +24,10 @@ pkgbase = dolphin-emu-git
 	depends = glibc
 	depends = glslang
 	depends = hidapi
+	depends = libevdev
 	depends = libgcc
 	depends = libgl
+	depends = libpulse
 	depends = libspng
 	depends = libstdc++
 	depends = libusb

Comment

The change only adds qt6-base to the runtime depends in .SRCINFO. This is a metadata-only update and does not introduce any new build steps, scripts, sources, or privilege/network behavior. No security concerns are evident from this diff alone.

@@ -38,6 +37,7 @@ pkgbase = dolphin-emu-git
 	depends = lz4
 	depends = lzo
 	depends = pugixml
+	depends = qt6-base
 	depends = sdl3
 	depends = sfml
 	depends = speexdsp

Comment

The change only adds a runtime dependency on alsa-lib in .SRCINFO. This is a metadata-only update with no impact on source integrity, build steps, install scripts, permissions, or runtime behavior beyond declaring an additional library dependency. No security red flags are present in the provided diff hunk.

@@ -78,6 +78,7 @@ pkgbase = dolphin-emu-git
 
 pkgname = dolphin-emu-git
 	pkgdesc = A Gamecube / Wii emulator - git version
+	depends = alsa-lib
 	depends = bluez-libs
 	depends = bzip2
 	depends = curl

Comment

The change only adds two runtime dependencies in .SRCINFO: libevdev and libpulse. This is a metadata-only update with no evidence of malicious behavior, code execution, network access, privilege escalation, or packaging integrity issues. The added dependencies are standard libraries commonly used by Dolphin for input and audio support, so the risk is minimal.

@@ -87,8 +88,10 @@ pkgname = dolphin-emu-git
 	depends = glibc
 	depends = glslang
 	depends = hidapi
+	depends = libevdev
 	depends = libgcc
 	depends = libgl
+	depends = libpulse
 	depends = libspng
 	depends = libstdc++
 	depends = libusb

Comment

The change only adds qt6-base to the package metadata dependency list in .SRCINFO. This is a benign dependency declaration update with no evidence of malicious behavior, no build-script changes, and no new sources or install-time actions. I found no security impact from this diff alone.

@@ -98,6 +101,7 @@ pkgname = dolphin-emu-git
 	depends = lz4
 	depends = lzo
 	depends = pugixml
+	depends = qt6-base
 	depends = sdl3
 	depends = sfml
 	depends = speexdsp

Comment

The .SRCINFO change only removes dependency entries and deletes the separate dolphin-emu-nogui-git package metadata. This is a packaging/metadata reduction, not an execution-path change: no new sources, scripts, install hooks, permissions, or build commands are introduced. The main effect is that the package metadata now advertises fewer runtime dependencies and fewer split packages, which could break functionality for users expecting the removed subpackages, but it does not create a security issue by itself.

@@ -111,96 +115,13 @@ pkgname = dolphin-emu-git
 	depends = libiconv
 	depends = llvm
 	depends = minizip-ng
-	depends = alsa-lib
 	depends = hicolor-icon-theme
-	depends = libevdev
-	depends = libpulse
 	depends = miniupnpc
-	depends = qt6-base
 	depends = qt6-svg
 	provides = dolphin-emu
 	conflicts = dolphin-emu
 
-pkgname = dolphin-emu-nogui-git
-	pkgdesc = A Gamecube / Wii emulator - no GUI - git version
-	depends = bluez-libs
-	depends = bzip2
-	depends = curl
-	depends = enet
-	depends = ffmpeg
-	depends = fmt
-	depends = glibc
-	depends = glslang
-	depends = hidapi
-	depends = libgcc
-	depends = libgl
-	depends = libspng
-	depends = libstdc++
-	depends = libusb
-	depends = libx11
-	depends = libxi
-	depends = libxrandr
-	depends = lz4
-	depends = lzo
-	depends = pugixml
-	depends = sdl3
-	depends = sfml
-	depends = speexdsp
-	depends = systemd-libs
-	depends = xxhash
-	depends = xz
-	depends = zlib
-	depends = zlib-ng
-	depends = zstd
-	depends = cubeb
-	depends = libiconv
-	depends = llvm
-	depends = minizip-ng
-	depends = dolphin-emu
-	optdepends = 
-	provides = dolphin-emu-nogui
-	provides = dolphin-emu-cli
-	conflicts = dolphin-emu-nogui
-	conflicts = dolphin-emu-cli
-
 pkgname = dolphin-emu-tool-git
 	pkgdesc = A Gamecube / Wii emulator - CLI-based utility for functions such as managing disc images - git version
-	depends = bluez-libs
-	depends = bzip2
-	depends = curl
-	depends = enet
-	depends = ffmpeg
-	depends = fmt
-	depends = glibc
-	depends = glslang
-	depends = hidapi
-	depends = libgcc
-	depends = libgl
-	depends = libspng
-	depends = libstdc++
-	depends = libusb
-	depends = libx11
-	depends = libxi
-	depends = libxrandr
-	depends = lz4
-	depends = lzo
-	depends = pugixml
-	depends = sdl3
-	depends = sfml
-	depends = speexdsp
-	depends = systemd-libs
-	depends = xxhash
-	depends = xz
-	depends = zlib
-	depends = zlib-ng
-	depends = zstd
-	depends = cubeb
-	depends = libiconv
-	depends = llvm
-	depends = minizip-ng
-	depends = alsa-lib
-	depends = libevdev
-	depends = libpulse
-	depends = qt6-base
 	provides = dolphin-emu-tool
 	conflicts = dolphin-emu-tool

Comment

The change is a packaging refactor that removes the separate nogui subpackage and adjusts dependency placement between the main and tool packages. I do not see any new code execution, network access, privilege escalation, or integrity issues introduced by this diff. The main package still installs from built artifacts only, and the removed nogui package logic is simply deleted rather than replaced with something suspicious. The only notable effect is a packaging/metadata change (fewer split packages, dependency reshuffling), which may affect functionality but not security.

@@ -5,11 +5,10 @@
 # Contributor: Michał Kopeć <michal.kopec@3mdeb.com>
 _projectname='dolphin'
 _mainpkgname="$_projectname-emu"
-_noguipkgname="$_projectname-emu-nogui"
 _toolpkgname="$_projectname-emu-tool"
 pkgbase="$_mainpkgname-git"
-pkgname=("$pkgbase" "$_noguipkgname-git" "$_toolpkgname-git")
-pkgver='2606.r121.g774200dcf4'
+pkgname=("$pkgbase" "$_toolpkgname-git")
+pkgver='2609.r133.g1f30867901'
 pkgrel='1'
 pkgdesc='A Gamecube / Wii emulator'
 _pkgdescappend=' - git version'

Comment

The change only adjusts PKGBUILD dependency lists: it moves several packages from makedepends to depends (alsa-lib, libevdev, libpulse, qt6-base) and removes them from build-time deps. This does not introduce code execution, network access, privilege escalation, or packaging integrity issues. The package still builds from the same upstream source and no suspicious scripts or artifacts are added in this hunk.

@@ -18,16 +17,16 @@ url="https://$_mainpkgname.org"
 license=('GPL-2.0-or-later')
 depends=(
 	# Based on the repo package
-	'bluez-libs' 'bzip2' 'curl' 'enet' 'ffmpeg' 'fmt' 'glibc' 'glslang'
-	'hidapi' 'libgcc' 'libgl' 'libspng' 'libstdc++' 'libusb' 'libx11' 'libxi'
-	'libxrandr' 'lz4' 'lzo' 'pugixml' 'sdl3' 'sfml' 'speexdsp' 'systemd-libs'
-	'xxhash' 'xz' 'zlib' 'zlib-ng' 'zstd'
+	'alsa-lib' 'bluez-libs' 'bzip2' 'curl' 'enet' 'ffmpeg' 'fmt' 'glibc'
+	'glslang' 'hidapi' 'libevdev' 'libgcc' 'libgl' 'libpulse' 'libspng'
+	'libstdc++' 'libusb' 'libx11' 'libxi' 'libxrandr' 'lz4' 'lzo' 'pugixml'
+	'qt6-base' 'sdl3' 'sfml' 'speexdsp' 'systemd-libs' 'xxhash' 'xz' 'zlib'
+	'zlib-ng' 'zstd'
 	# Additional dependencies to replace vendored deps
 	'cubeb' 'libiconv' 'llvm' 'minizip-ng'
 )
 makedepends=(
-	'alsa-lib' 'cmake' 'git' 'libevdev' 'libpulse' 'miniupnpc' 'ninja' 'python'
-	'qt6-base' 'qt6-svg' 'vulkan-headers'
+	'cmake' 'git' 'miniupnpc' 'ninja' 'python' 'qt6-svg' 'vulkan-headers'
 )
 checkdepends=('gtest')
 optdepends=('pulseaudio: PulseAudio backend')

Comment

The change is limited to the check() test invocation, replacing the binary name from the no-GUI package name variable to the main package name variable. This is a low-risk packaging fix and does not introduce new sources, network access, privilege changes, install-script behavior, or any code execution beyond the existing version check. I see no security impact from this diff alone.

@@ -122,7 +121,7 @@ check() {
 	ninja unittests
 
 	# Verify that the basic functionality works
-	_checkoutput="$(QT_QPA_PLATFORM='offscreen' "$srcdir/$_sourcedirectory/build/Binaries/$_noguipkgname" --version)"
+	_checkoutput="$(QT_QPA_PLATFORM='offscreen' "$srcdir/$_sourcedirectory/build/Binaries/$_mainpkgname" --version)"
 	printf '%s\n' "$_checkoutput"
 	printf '%s\n' "$_checkoutput" | grep -q -E "^${_projectname^}( \[.+\])? ${_checkversion}(-dirty)?(-ICC)?$"
 }

Comment

The change removes the separate `dolphin-emu-nogui-git` package and repoints `check()` to the main GUI binary, while also trimming some package-specific runtime deps from the main package. I do not see any new code execution, network access, privilege escalation, or persistence mechanism introduced by this diff. The removed package stanza and dependency adjustments look like packaging simplification rather than a security issue. The only notable effect is that the main package now carries fewer explicit deps and the no-GUI binary is no longer packaged, but that does not create a direct security risk in the reviewed hunk.

@@ -130,8 +129,7 @@ check() {
 package_dolphin-emu-git() {
 	pkgdesc="$pkgdesc$_pkgdescappend"
 	depends+=(
-		'alsa-lib' 'hicolor-icon-theme' 'libevdev' 'libpulse' 'miniupnpc'
-		'qt6-base' 'qt6-svg'
+		'hicolor-icon-theme' 'miniupnpc' 'qt6-svg'
 	)
 	provides=("$_mainpkgname")
 	conflicts=("$_mainpkgname")

Comment

The change removes the separate `dolphin-emu-nogui-git` package and folds its runtime dependencies into the main package, while also adjusting the check target to the main binary. I do not see any malicious behavior, privilege escalation, network fetches, or suspicious install-time actions introduced by this diff. The only notable effect is packaging/metadata consolidation: the main package now depends on `alsa-lib`, `libevdev`, `libpulse`, and `qt6-base`, which is consistent with shipping the GUI binary and does not create a security issue. The removed `rm -rf` cleanup and deleted subpackage function are packaging changes only.

@@ -141,29 +139,11 @@ package_dolphin-emu-git() {
 	install -Dm644 'Data/51-usb-device.rules' "$pkgdir/usr/lib/udev/rules.d/51-usb-device.rules"
 	install -Dm644 'build/Flatpak/org.DolphinEmu.dolphin-emu.metainfo.xml' "$pkgdir/usr/share/metainfo/org.DolphinEmu.dolphin-emu.metainfo.xml"
 
-	rm -rf "$pkgdir/usr/bin/$_noguipkgname"
 	rm -rf "$pkgdir/usr/bin/$_projectname-tool"
-	rm -rf "$pkgdir/usr/share/man/man6/$_noguipkgname.6"
-}
-
-package_dolphin-emu-nogui-git() {
-	pkgdesc="$pkgdesc - no GUI$_pkgdescappend"
-	depends+=("$_mainpkgname")
-	optdepends=()
-	provides=("$_noguipkgname" "$_mainpkgname-cli")
-	conflicts=("$_noguipkgname" "$_mainpkgname-cli")
-
-	cd "$srcdir/$_sourcedirectory/"
-	install -Dm755 "build/Binaries/$_noguipkgname" "$pkgdir/usr/bin/$_noguipkgname"
-	ln -sf "/usr/bin/$_noguipkgname" "$pkgdir/usr/bin/$_mainpkgname-cli"
-	install -Dm644 "Data/$_noguipkgname.6" "$pkgdir/usr/share/man/man6/$_noguipkgname.6"
 }
 
 package_dolphin-emu-tool-git() {
 	pkgdesc="$pkgdesc - CLI-based utility for functions such as managing disc images$_pkgdescappend"
-	depends+=(
-		'alsa-lib' 'libevdev' 'libpulse' 'qt6-base'
-	)
 	provides=("$_toolpkgname")
 	conflicts=("$_toolpkgname")