Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 2 to 3. This is metadata-only and does not alter sources, build steps, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by the diff shown.

@@ -1,7 +1,7 @@
 pkgbase = ffmpeg-full
 	pkgdesc = Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)
 	pkgver = 9.0.2
-	pkgrel = 2
+	pkgrel = 3
 	url = https://ffmpeg.org/
 	arch = x86_64
 	license = LicenseRef-nonfree-and-unredistributable

Comment

The change is a dependency swap in .SRCINFO from `svt-jpeg-xs-git` to `svt-jpeg-xs`. This reduces supply-chain risk by removing a floating VCS dependency and replacing it with a presumably pinned/stable package name. There is no evidence here of added code execution, network access, privilege escalation, or packaging abuse. Based on the provided diff alone, this is low risk.

@@ -118,7 +118,7 @@ pkgbase = ffmpeg-full
 	depends = srt
 	depends = svt-av1
 	depends = svt-hevc
-	depends = svt-jpeg-xs-git
+	depends = svt-jpeg-xs
 	depends = svt-vp9
 	depends = tesseract
 	depends = twolame

Comment

The change is a straightforward version bump of the whisper.cpp source tarball from v1.9.4 to v1.9.5 in .SRCINFO. The source remains an HTTPS GitHub release archive, with no new fetch locations, no build-script changes, and no added execution or packaging logic. On the provided diff alone, this does not introduce an obvious supply-chain or privilege risk.

@@ -156,7 +156,7 @@ pkgbase = ffmpeg-full
 	source = https://ffmpeg.org/releases/ffmpeg-9.0.2.tar.xz
 	source = https://ffmpeg.org/releases/ffmpeg-9.0.2.tar.xz.asc
 	source = git+https://github.com/lensfun/lensfun.git
-	source = https://github.com/ggml-org/whisper.cpp/archive/v1.9.4/whisper.cpp-1.9.4.tar.gz
+	source = https://github.com/ggml-org/whisper.cpp/archive/v1.9.5/whisper.cpp-1.9.5.tar.gz
 	source = 010-ffmpeg-add-svt-hevc.patch
 	source = 020-ffmpeg-add-svt-hevc-docs-g4181c9e.patch::https://raw.githubusercontent.com/OpenVisualCloud/SVT-HEVC/4181c9ee0611baefb40b4c0ed10023cfd837d522/ffmpeg_plugin/0002-doc-Add-libsvt_hevc-encoder-docs.patch
 	source = 030-ffmpeg-add-svt-vp9.patch

Comment

Low risk change. The diff only updates metadata in .SRCINFO: bumps pkgrel, switches a dependency from svt-jpeg-xs-git to the non-VCS svt-jpeg-xs package, and updates the whisper.cpp source version/hash from 1.9.4 to 1.9.5. There are no signs of added build-time code execution, privilege escalation, or suspicious install scripts in this change. The source remains an HTTPS upstream release tarball with a matching checksum update, so this looks like routine dependency/version maintenance rather than a security issue.

@@ -170,7 +170,7 @@ pkgbase = ffmpeg-full
 	sha256sums = 8c3850283eb25fa026482078a04051e0be17347b09ef81a0849bec15a96e002e
 	sha256sums = SKIP
 	sha256sums = SKIP
-	sha256sums = 57e280cee375ab02425b806ad5146b99f6eb9357e3c2b31357c8a6af2e2e44ae
+	sha256sums = ff1a9053feb509ff9d7729703355541ae9690073a6b1c40eb692c962e0dc1720
 	sha256sums = e6fdcb8446b0a0c0967f125d2de5084a5bdb418a1a6608f808cff2c97fc9bd6a
 	sha256sums = a164ebdc4d281352bf7ad1b179aae4aeb33f1191c444bed96cb8ab333c046f81
 	sha256sums = cc80568f7dab2094f4f3bede6d0f068f217161f924915b067b0d287cf53b0849

Comment

The change is low risk. It only bumps the bundled whisper.cpp version, updates the checksum for that source, and switches one dependency from the -git package to the stable svt-jpeg-xs package. There are no new build-time network fetches, no added scripts or patches with suspicious behavior, and no privilege/persistence changes. The source URLs remain HTTPS and pinned; the diff does not introduce any obvious supply-chain red flags.

@@ -3,9 +3,9 @@
 
 pkgname=ffmpeg-full
 pkgver=9.0.2
-pkgrel=2
+pkgrel=3
 _svt_hevc_ver='4181c9ee0611baefb40b4c0ed10023cfd837d522'
-_whispercpp_ver='1.9.4'
+_whispercpp_ver='1.9.5'
 pkgdesc='Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)'
 arch=('x86_64')
 url='https://ffmpeg.org/'

Comment

The change is low risk. It only swaps a dependency from the VCS package `svt-jpeg-xs-git` to the versioned `svt-jpeg-xs` package and updates the corresponding checksum entry in `PKGBUILD`. There are no new build steps, no added network fetches, no privilege changes, and no suspicious install or patch logic introduced by this diff. The only security-relevant effect is reducing reliance on a floating git package in favor of a pinned package, which is neutral-to-positive from an integrity standpoint.

@@ -109,7 +109,7 @@ depends=(
     'srt'
     'svt-av1'
     'svt-hevc'
-    'svt-jpeg-xs-git'
+    'svt-jpeg-xs'
     'svt-vp9'
     'tesseract'
     'twolame'

Comment

The change is low risk. It updates the sha256 checksum for an existing upstream source tarball (whisper.cpp v1.9.5) and switches one dependency from the -git package to the stable svt-jpeg-xs package. There are no new download locations, no build-time network additions, no script execution changes, and no privilege/persistence mechanisms introduced. The only security-relevant effect is integrity verification of a source archive, which is appropriate and reduces risk if the checksum matches the intended upstream release.

@@ -177,7 +177,7 @@ source=("https://ffmpeg.org/releases/ffmpeg-${pkgver}.tar.xz"{,.asc}
 sha256sums=('8c3850283eb25fa026482078a04051e0be17347b09ef81a0849bec15a96e002e'
             'SKIP'
             'SKIP'
-            '57e280cee375ab02425b806ad5146b99f6eb9357e3c2b31357c8a6af2e2e44ae'
+            'ff1a9053feb509ff9d7729703355541ae9690073a6b1c40eb692c962e0dc1720'
             'e6fdcb8446b0a0c0967f125d2de5084a5bdb418a1a6608f808cff2c97fc9bd6a'
             'a164ebdc4d281352bf7ad1b179aae4aeb33f1191c444bed96cb8ab333c046f81'
             'cc80568f7dab2094f4f3bede6d0f068f217161f924915b067b0d287cf53b0849'