Review Results

Comment

The change is a routine metadata refresh for a new upstream release: pkgver and source checksum are updated, the license string changes from LGPL-3.0-or-later to GPL-3.0-or-later, and dependency metadata is adjusted. I do not see any new attack surface in the .SRCINFO itself: sources remain HTTPS from the official GitHub upstream, there are no added build-time downloads, no suspicious mirrors or scripts, and no privilege/persistence mechanisms. The added/removed dependency entries are consistent with packaging metadata changes and do not by themselves indicate malicious behavior. Based on this diff alone, risk is low.

@@ -1,18 +1,17 @@
 pkgbase = auto-cpufreq
 	pkgdesc = Automatic CPU speed & power optimizer
-	pkgver = 3.1.0
+	pkgver = 3.2.0
 	pkgrel = 1
 	url = https://github.com/AdnanHodzic/auto-cpufreq
 	install = auto-cpufreq.install
 	arch = any
-	license = LGPL-3.0-or-later
+	license = GPL-3.0-or-later
 	makedepends = python-build
 	makedepends = python-installer
 	makedepends = python-wheel
 	makedepends = python-poetry-core
 	makedepends = python-poetry-dynamic-versioning
 	depends = python
-	depends = python-setuptools
 	depends = python-psutil
 	depends = python-click
 	depends = python-distro

Comment

The .SRCINFO update is a routine version bump from 3.1.0 to 3.2.0 with corresponding checksum updates and dependency metadata adjustments. The source remains the official GitHub release tarball over HTTPS, and there are no signs of added build-time network fetches, suspicious extra sources, or privilege/persistence mechanisms in this metadata-only change. The license field change and dependency list updates may reflect upstream packaging changes, but nothing here indicates a security issue by itself.

@@ -22,15 +21,18 @@ pkgbase = auto-cpufreq
 	depends = python-urwid
 	depends = python-pyasyncore
 	depends = dmidecode
-	depends = gobject-introspection
 	depends = gtk3
-	source = auto-cpufreq-3.1.0.tar.gz::https://github.com/AdnanHodzic/auto-cpufreq/archive/v3.1.0.tar.gz
+	depends = pango
+	depends = glib2
+	depends = gdk-pixbuf2
+	depends = bash
+	source = auto-cpufreq-3.2.0.tar.gz::https://github.com/AdnanHodzic/auto-cpufreq/archive/v3.2.0.tar.gz
 	source = auto-cpufreq.service
 	source = 001-fix-icon-n-style-locations.patch
 	source = 002-fix-other-icon-path.patch
-	sha256sums = c843a90f59ce47bcfc320bfc8b75044946cfd2f02b714fb10d06a911dcf78bc5
+	sha256sums = 99d46c8bbc8ca6a22caf08bbd7857813a0b27c4403ba6f76830863a64621395b
 	sha256sums = 8ff1c82788f7cb6bf06151e6632aa4006eb09337daf03faa4866d23075b39e1b
-	sha256sums = 227d85df7f71187c87e24388104f0127b13a680c1e859a90a14864a0d29e1fdf
-	sha256sums = 9c06cba2d936aa325fac8f4306ef77e4f5e33ec4703112bb8352097d0b13abfe
+	sha256sums = f0fda29c1b5aab24de392281a186bc71acdec765fc1c08c16ac588ff0bff348b
+	sha256sums = 6afa9b853b690c832eff5fe499063c17719a870840f5cfec8903285eaf1dddc0
 
 pkgname = auto-cpufreq

Comment

The patch only updates hardcoded asset paths in the GUI app from an older version layout to the current /opt/auto-cpufreq/current/share/... locations, and the remaining non-snap paths still point to standard system locations. There is no added code execution, network access, privilege escalation, or packaging behavior change in this hunk. This looks like a straightforward path fix with no security impact.

@@ -1,9 +1,8 @@
-diff src/auto_cpufreq-2.4.0/auto_cpufreq/gui/app.py src.new/auto_cpufreq-2.4.0/auto_cpufreq/gui/app.py
---- src/auto_cpufreq-2.4.0/auto_cpufreq/gui/app.py
-+++ src.new/auto_cpufreq-2.4.0/auto_cpufreq/gui/app.py
-@@ -15,8 +15,8 @@ if IS_INSTALLED_WITH_SNAP:
-     CSS_FILE = "/snap/auto-cpufreq/current/style.css"
-     ICON_FILE = "/snap/auto-cpufreq/current/icon.png"
+--- a/auto-cpufreq-3.2.0/auto_cpufreq/gui/app.py
++++ b/auto-cpufreq-3.2.0/auto_cpufreq/gui/app.py
+@@ -28,8 +28,8 @@
+     CSS_FILE = "/opt/auto-cpufreq/current/share/scripts/style.css"
+     ICON_FILE = "/opt/auto-cpufreq/current/share/images/icon.png"
  else:
 -    CSS_FILE = "/usr/local/share/auto-cpufreq/scripts/style.css"
 -    ICON_FILE = "/usr/local/share/auto-cpufreq/images/icon.png"

Comment

The patch only adjusts hardcoded asset paths in a Python GUI file and replaces one constant name/value in the diff context. There are no added network calls, privilege changes, persistence mechanisms, or build-time execution changes in this patch. The change appears to be a straightforward packaging/path fix for icon/CSS locations, with no security-sensitive behavior introduced in the reviewed hunk.

@@ -11,4 +10,4 @@ diff src/auto_cpufreq-2.4.0/auto_cpufreq/gui/app.py src.new/auto_cpufreq-2.4.0/a
 +    ICON_FILE = "/usr/share/pixmaps/auto-cpufreq.png"
  
  HBOX_PADDING = 20
- PKEXEC_ERROR = "Error executing command as another user: Not authorized\n\nThis incident has been reported.\n"
+ CONTROL_OPTION_MARGIN = 8

Comment

The patch only changes the fallback icon path used by the GUI About dialog, from a local/share image to the standard pixmaps location. This is a benign packaging fix with no code execution, privilege, network, or persistence implications. No security concerns identified in the reviewed hunk.

@@ -1,12 +1,11 @@
-diff --git src/auto_cpufreq-2.4.0/auto_cpufreq/gui/objects.py src.new/auto_cpufreq-2.4.0/auto_cpufreq/gui/objects.py
---- src/auto_cpufreq-2.4.0/auto_cpufreq/gui/objects.py
-+++ src.new/auto_cpufreq-2.4.0/auto_cpufreq/gui/objects.py
-@@ -193,7 +193,7 @@ class AboutDialog(Gtk.Dialog):
-         self.add_button("Close", Gtk.ResponseType.CLOSE)
+--- a/auto-cpufreq-3.2.0/auto_cpufreq/gui/objects.py
++++ b/auto-cpufreq-3.2.0/auto_cpufreq/gui/objects.py
+@@ -717,7 +717,7 @@
          self.set_default_size(400, 350)
+         icon_file = "/opt/auto-cpufreq/current/share/images/icon.png"
+         if not isfile(icon_file):
+-            icon_file = "/usr/local/share/auto-cpufreq/images/icon.png"
++            icon_file = "/usr/share/pixmaps/auto-cpufreq.png"
          img_buffer = GdkPixbuf.Pixbuf.new_from_file_at_scale(
--            filename="/usr/local/share/auto-cpufreq/images/icon.png",
-+            filename="/usr/share/pixmaps/auto-cpufreq.png",
+             filename=icon_file,
              width=150,
-             height=150,
-             preserve_aspect_ratio=True

Comment

The change is low risk. It only updates the package version, license metadata, and runtime dependencies, and adjusts build-time substitutions to point the polkit policy at /usr/bin/auto-cpufreq instead of a venv path. The added mkdir for /opt/auto-cpufreq is confined to $pkgdir and is explicitly justified by upstream writing state there. I do not see any new network fetches, privilege escalation, persistence mechanisms, or suspicious build-time execution in this diff. One minor note is that the license field changes from LGPL-3.0-or-later to GPL-3.0-or-later, but that is a metadata change rather than a security issue.

@@ -3,13 +3,13 @@
 # Maintainer: Zhanibek Adilbekov <zhanibek.adilbekov@pm.me>
 # shellcheck disable=SC2034,2164,2154
 pkgname=auto-cpufreq
-pkgver=3.1.0
+pkgver=3.2.0
 pkgrel=1
 pkgdesc="Automatic CPU speed & power optimizer"
 arch=('any')
 url="https://github.com/AdnanHodzic/auto-cpufreq"
-license=('LGPL-3.0-or-later')
-depends=('python' 'python-setuptools' 'python-psutil' 'python-click' 'python-distro' 'python-requests' 'python-gobject' 'python-pyinotify' 'python-urwid' 'python-pyasyncore' 'dmidecode' 'gobject-introspection' 'gtk3')
+license=('GPL-3.0-or-later')
+depends=('python' 'python-psutil' 'python-click' 'python-distro' 'python-requests' 'python-gobject' 'python-pyinotify' 'python-urwid' 'python-pyasyncore' 'dmidecode' 'gtk3' 'pango' 'glib2' 'gdk-pixbuf2' 'bash')
 makedepends=('python-build' 'python-installer' 'python-wheel' 'python-poetry-core' 'python-poetry-dynamic-versioning' )
 
 install="$pkgname.install"

Comment

The PKGBUILD change is low risk overall. It updates the package to a new upstream release, refreshes checksums, and adjusts build-time version injection from a hardcoded bypass value to the actual package version. The new sed substitution in prepare() only rewrites a pkexec policy path from an upstream venv location to /usr/bin/auto-cpufreq, which is consistent with packaging for system installation and does not introduce network access, privilege escalation, or persistence. The added comment/mkdir change in package() is also benign. I did note that the package still ships a root-run systemd service and an .install script that touches /var/log and restarts the service on upgrade, but those behaviors pre-existed this diff and are expected for this daemon package; the reviewed change does not worsen them.

@@ -24,20 +24,21 @@ source=(
 prepare() {
 	cd "$srcdir/$pkgname-$pkgver"
 	sed -i 's|usr/local|usr|g' "scripts/${pkgname}.service" auto_cpufreq/core.py
+	sed -i "s|/opt/auto-cpufreq/current/venv/bin/auto-cpufreq|/usr/bin/auto-cpufreq|g" scripts/org.auto-cpufreq.pkexec.policy
 	patch --strip=2 --input=../001-fix-icon-n-style-locations.patch
 	patch --strip=2 --input=../002-fix-other-icon-path.patch
 
 }
 
-sha256sums=('c843a90f59ce47bcfc320bfc8b75044946cfd2f02b714fb10d06a911dcf78bc5'
+sha256sums=('99d46c8bbc8ca6a22caf08bbd7857813a0b27c4403ba6f76830863a64621395b'
             '8ff1c82788f7cb6bf06151e6632aa4006eb09337daf03faa4866d23075b39e1b'
-            '227d85df7f71187c87e24388104f0127b13a680c1e859a90a14864a0d29e1fdf'
-            '9c06cba2d936aa325fac8f4306ef77e4f5e33ec4703112bb8352097d0b13abfe')
+            'f0fda29c1b5aab24de392281a186bc71acdec765fc1c08c16ac588ff0bff348b'
+            '6afa9b853b690c832eff5fe499063c17719a870840f5cfec8903285eaf1dddc0')
 
 build() {
 	cd "$srcdir/$pkgname-$pkgver"
 
-	POETRY_DYNAMIC_VERSIONING_BYPASS=1 python -m build --wheel --no-isolation
+	POETRY_DYNAMIC_VERSIONING_BYPASS="$pkgver" python -m build --wheel --no-isolation
 }
 
 package() {

Comment

The change is low risk. It only adds a quoted mkdir for the package staging directory under $pkgdir/opt/auto-cpufreq and a comment explaining why that directory is needed. This does not introduce new code execution, network access, privilege changes, or install-time persistence. The rest of the PKGBUILD changes are outside the provided hunk and were not used to assess this specific change.

@@ -53,7 +54,8 @@ package() {
 	install -Dm644 images/icon.png -t "$pkgdir/usr/share/$pkgname/"
 
 	mkdir -p $pkgdir/usr/share/$pkgname/scripts/
-	mkdir -p $pkgdir/opt/auto-cpufreq/
+	# Upstream writes governor/turbo override state here without creating the directory.
+	mkdir -p "$pkgdir/opt/auto-cpufreq/"
 
 	install -Dm755 scripts/auto-cpufreq-install.sh "$pkgdir/usr/share/$pkgname/scripts/"
 	install -Dm755 scripts/auto-cpufreq-remove.sh "$pkgdir/usr/share/$pkgname/scripts/"