Review Results

Comment

The change is a straightforward version bump in .SRCINFO from libgnt 2.14.4 to 2.15.0, with matching source URLs and updated checksum. The sources remain HTTPS and point to the upstream SourceForge project, and the PGP signature file is still referenced with the same valid key. No new build-time commands, install scripts, patches, or privilege-related metadata are introduced by this diff. Based on the provided hunk alone, there are no obvious security concerns.

@@ -1,7 +1,7 @@
 pkgbase = libgnt
 	pkgdesc = GLib Ncurses Toolkit
-	pkgver = 2.14.4
-	pkgrel = 2
+	pkgver = 2.15.0
+	pkgrel = 1
 	url = https://keep.imfreedom.org/libgnt/libgnt
 	arch = x86_64
 	license = GPL

Comment

The change is a straightforward upstream version bump in .SRCINFO from libgnt 2.14.4 to 2.15.0, with the source URL, signature URL, and checksum updated accordingly. The source remains HTTPS on the official SourceForge project path, and the package continues to use a pinned release tarball plus PGP verification. No new build-time commands, scripts, dependencies, or packaging behaviors are introduced in this diff. Based on the provided hunk alone, this looks low risk.

@@ -11,10 +11,10 @@ pkgbase = libgnt
 	depends = glib2
 	depends = libxml2
 	depends = ncurses
-	source = https://downloads.sourceforge.net/project/pidgin/libgnt/2.14.4/libgnt-2.14.4-dev.tar.xz
-	source = https://downloads.sourceforge.net/project/pidgin/libgnt/2.14.4/libgnt-2.14.4-dev.tar.xz.asc
+	source = https://downloads.sourceforge.net/project/pidgin/libgnt/2.15.0/libgnt-2.15.0.tar.xz
+	source = https://downloads.sourceforge.net/project/pidgin/libgnt/2.15.0/libgnt-2.15.0.tar.xz.asc
 	validpgpkeys = 40DE1DC7288FE3F50AB938C548F66AFFD9BDB729
-	sha256sums = 195933a9a731d3575791b881ba5cc0ad2a715e1e9c4c23ccaaa2a17e164c96ec
+	sha256sums = 6dce3d4f2fb33c242d8223ddda5f1042f3dfb0ad7c395d4e33a73f92423a58a3
 	sha256sums = SKIP
 
 pkgname = libgnt

Comment

Low-risk packaging update. The change switches from the old -dev source tarball plus a rename step to the upstream 2.15.0 release tarball, and removes an obsolete Meson option for python2. I do not see any added execution, network access, privilege escalation, or suspicious install-time behavior. Source remains HTTPS and pinned by checksum and PGP key. The only notable change is that the package now tracks the normal release archive instead of the -dev variant, which appears to be a straightforward upstream packaging adjustment.

@@ -1,25 +1,21 @@
 # Maintainer: Evangelos Foutras <foutrelis@archlinux.org>
 
 pkgname=libgnt
-pkgver=2.14.4
-pkgrel=2
+pkgver=2.15.0
+pkgrel=1
 pkgdesc="GLib Ncurses Toolkit"
 arch=('x86_64')
 url="https://keep.imfreedom.org/libgnt/libgnt"
 license=('GPL')
 depends=('glib2' 'libxml2' 'ncurses')
 makedepends=('meson' 'gtk-doc' 'glib2-devel')
-source=(https://downloads.sourceforge.net/project/pidgin/libgnt/$pkgver/$pkgname-$pkgver-dev.tar.xz{,.asc})
-sha256sums=('195933a9a731d3575791b881ba5cc0ad2a715e1e9c4c23ccaaa2a17e164c96ec'
+source=(https://downloads.sourceforge.net/project/pidgin/libgnt/$pkgver/$pkgname-$pkgver.tar.xz{,.asc})
+sha256sums=('6dce3d4f2fb33c242d8223ddda5f1042f3dfb0ad7c395d4e33a73f92423a58a3'
             'SKIP')
 validpgpkeys=('40DE1DC7288FE3F50AB938C548F66AFFD9BDB729') # Gary Kramlich <grim@reaperworld.com>
 
-prepare() {
-  mv -v $pkgname-$pkgver{-dev,}
-}
-
 build() {
-  arch-meson $pkgname-$pkgver build -D python2=false
+  arch-meson $pkgname-$pkgver build
   ninja -C build
 }