Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump from 0.9.0.r5.ge0940ac to 0.10.0.r0.g01bc7cc. This is metadata-only and does not introduce any new sources, build steps, install scripts, permissions changes, or other security-relevant behavior. No red flags are visible in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = svt-jpeg-xs-git
 	pkgdesc = An implementation of the JPEG XS (ISO/IEC 21122) codec (git version)
-	pkgver = 0.9.0.r5.ge0940ac
+	pkgver = 0.10.0.r0.g01bc7cc
 	pkgrel = 1
 	url = https://github.com/OpenVisualCloud/SVT-JPEG-XS/
 	arch = x86_64

Comment

The change only updates .SRCINFO metadata to match the PKGBUILD's new pkgver and the checksum for the existing patch file. There are no new sources, no build-script changes, and no evidence of added network access, privilege escalation, or packaging behavior changes. This is a routine metadata refresh with no security impact.

@@ -14,6 +14,6 @@ pkgbase = svt-jpeg-xs-git
 	source = git+https://github.com/OpenVisualCloud/SVT-JPEG-XS.git
 	source = 010-svt-jpeg-xs-remove-werror.patch
 	sha256sums = SKIP
-	sha256sums = 27e8899b11dc3466d9b060571b51d38524e1cfc89f7552e7c8ada3d1a3035dbc
+	sha256sums = cd095dfd29cc2bdc5ca5e0bb21decad57793c1f17ac4dc5739473c1a4eb8b05c
 
 pkgname = svt-jpeg-xs-git

Comment

The change only adjusts the patch hunk header line numbers in 010-svt-jpeg-xs-remove-werror.patch from @@ -304... to @@ -455..., with no modification to the actual patched content. This is a non-functional context update and does not introduce any new build, install, or execution behavior. No security impact identified.

@@ -1,6 +1,6 @@
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -304,7 +304,7 @@ endif()
+@@ -455,7 +455,7 @@ endif()
  if(MSVC OR MINGW)
  #"-Wall" too big restrict for MSVC
  else()

Comment

The change is a routine version bump in PKGBUILD: pkgver updated to a newer git revision and the checksum for the existing local patch changed accordingly. The source remains the official upstream GitHub repository over HTTPS, still pinned to a specific commit via the package versioning scheme, and there are no new build-time downloads, scripts, privilege changes, or packaging red flags introduced by this diff. The dependency formatting changes are cosmetic only. No security issues are evident in the reviewed hunk.

@@ -1,20 +1,24 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=svt-jpeg-xs-git
-pkgver=0.9.0.r5.ge0940ac
+pkgver=0.10.0.r0.g01bc7cc
 pkgrel=1
 pkgdesc='An implementation of the JPEG XS (ISO/IEC 21122) codec (git version)'
 arch=('x86_64')
 url='https://github.com/OpenVisualCloud/SVT-JPEG-XS/'
 license=('BSD-2-Clause-Patent')
-depends=('glibc')
-makedepends=('cmake' 'git' 'yasm')
+depends=(
+    'glibc')
+makedepends=(
+    'cmake'
+    'git'
+    'yasm')
 provides=('svt-jpeg-xs')
 conflicts=('svt-jpeg-xs')
 source=('git+https://github.com/OpenVisualCloud/SVT-JPEG-XS.git'
         '010-svt-jpeg-xs-remove-werror.patch')
 sha256sums=('SKIP'
-            '27e8899b11dc3466d9b060571b51d38524e1cfc89f7552e7c8ada3d1a3035dbc')
+            'cd095dfd29cc2bdc5ca5e0bb21decad57793c1f17ac4dc5739473c1a4eb8b05c')
 
 prepare() {
     patch -d SVT-JPEG-XS -Np1 -i "${srcdir}/010-svt-jpeg-xs-remove-werror.patch"

Comment

The change is low risk. It only adjusts PKGBUILD build flags and metadata: removes a local CFLAGS/CXXFLAGS workaround, drops an explicit CMake policy minimum, and replaces `-Wno-dev` with `-Wno-author`. There are no new sources, no network-fetching logic, no install-script changes, and no privilege/persistence mechanisms. The only potential concern is that removing the CFLAGS/CXXFLAGS filtering could reintroduce a build warning or build failure if upstream still hardcodes `_FORTIFY_SOURCE`, but that is a build hygiene issue rather than a security issue. No evidence of malicious behavior in this diff.

@@ -25,18 +29,12 @@ pkgver() {
 }
 
 build() {
-    # fix warning: "_FORTIFY_SOURCE" redefined
-    # note: upstream forces _FORTIFY_SOURCE=2
-    export CFLAGS="${CFLAGS/-Wp,-D_FORTIFY_SOURCE=?/}"
-    export CXXFLAGS="${CXXFLAGS/-Wp,-D_FORTIFY_SOURCE=?/}"
-    
     cmake -B build -S SVT-JPEG-XS \
         -G 'Unix Makefiles' \
         -DCMAKE_BUILD_TYPE:STRING='None' \
         -DCMAKE_INSTALL_PREFIX:PATH='/usr' \
-        -DCMAKE_POLICY_VERSION_MINIMUM:STRING='3.5.0' \
         -DNATIVE:BOOL='OFF' \
-        -Wno-dev
+        -Wno-author
     cmake --build build
 }