Version #3137 of pidgin · commit 7653ffdbdb20 · status Reviewed
The only change is a pkgrel bump in .SRCINFO from 5 to 5.1. This is metadata-only and does not affect sources, build steps, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by this diff.
@@ -1,6 +1,6 @@
pkgbase = pidgin
pkgver = 2.14.14
- pkgrel = 5
+ pkgrel = 5.1
url = https://pidgin.im/
arch = x86_64
license = GPL
The change only adds a local patch to .SRCINFO and updates the recorded checksums/pkgrel. I inspected the patch content: it removes the GNT_DISABLE_DEPRECATED define from configure so finch can build against newer libgnt. This is a narrow build-compatibility fix with no signs of network access, privilege escalation, persistence, or bundled binaries. The source remains the official upstream tarball over HTTPS with PGP verification, and the new patch is a local file in the package tree. Low risk.
@@ -24,11 +24,13 @@ pkgbase = pidgin
source = https://downloads.sourceforge.net/project/pidgin/Pidgin/2.14.14/pidgin-2.14.14.tar.bz2.asc
source = libpurple-fix-media-manager-gst-device-reference.patch
source = libpurple-unref-gst-devices-from-messages.patch
+ source = finch-no-gnt-disable-deprecated.patch
validpgpkeys = 40DE1DC7288FE3F50AB938C548F66AFFD9BDB729
sha256sums = 0ffc9994def10260f98a55cd132deefa8dc4a9835451cc0e982747bd458e2356
sha256sums = SKIP
- sha256sums = 4d13b1e22e10c099f80562600fde259c05be4c0e16d5f22353d40fc2d4cb6e7e
- sha256sums = a3e87df23cc19c03f5eeeb4d8043537b5bff1121a6be7f6e08b035a1d298f9f9
+ sha256sums = 7ac937705681460e42028e6ad2d3609b8d21108d534547c87991753c74a8fb5f
+ sha256sums = d02eb86645d1692b51ed570c83069daee9f31ead481581906c771ee46e248889
+ sha256sums = de41e318fdaaedcb8ddbd00e6b1dec878bccfbbc9b1a10373d2f561b84ab8aba
pkgname = libpurple
pkgdesc = IM library extracted from Pidgin
The only change in this PKGBUILD diff is a pkgrel bump from 5 to 5.1. No source URLs, build steps, dependencies, install scripts, permissions, or packaging logic changed. This is a metadata-only rebuild indicator and does not introduce a security concern by itself.
@@ -7,7 +7,7 @@
pkgbase=pidgin
pkgname=('libpurple' 'finch')
pkgver=2.14.14
-pkgrel=5
+pkgrel=5.1
arch=('x86_64')
url="https://pidgin.im/"
license=('GPL')
The change only adds a local patch to the source array and applies it in prepare(). I inspected the patch content: it removes the GNT_DISABLE_DEPRECATED flag from configure's DEBUG_CFLAGS, which is a build-configuration tweak rather than a code-execution or persistence change. Sources remain HTTPS from the official upstream release, the new patch is a repository-local file with a pinned checksum, and there are no new network fetches, privilege escalations, or install-script/systemd changes in this diff. Low risk.
@@ -18,11 +18,13 @@ options=('!emptydirs')
source=(https://downloads.sourceforge.net/project/pidgin/Pidgin/$pkgver/$pkgbase-$pkgver.tar.bz2{,.asc}
libpurple-fix-media-manager-gst-device-reference.patch
libpurple-unref-gst-devices-from-messages.patch
+ finch-no-gnt-disable-deprecated.patch
)
sha256sums=('0ffc9994def10260f98a55cd132deefa8dc4a9835451cc0e982747bd458e2356'
'SKIP'
'7ac937705681460e42028e6ad2d3609b8d21108d534547c87991753c74a8fb5f'
- 'd02eb86645d1692b51ed570c83069daee9f31ead481581906c771ee46e248889')
+ 'd02eb86645d1692b51ed570c83069daee9f31ead481581906c771ee46e248889'
+ 'de41e318fdaaedcb8ddbd00e6b1dec878bccfbbc9b1a10373d2f561b84ab8aba')
validpgpkeys=('40DE1DC7288FE3F50AB938C548F66AFFD9BDB729') # Gary Kramlich <grim@reaperworld.com>
prepare() {
The change only adds a local patch to the upstream configure script, and the patch simply removes the `-DGNT_DISABLE_DEPRECATED` define from `DEBUG_CFLAGS`. I found no signs of network access, privilege escalation, persistence, embedded binaries, or writes outside the package build tree. The patch is small, locally sourced, and checksum-pinned in `source=()` like the other patches. Security risk appears low.
@@ -30,6 +32,7 @@ prepare() {
patch -Np1 -i ../libpurple-fix-media-manager-gst-device-reference.patch
patch -Np1 -i ../libpurple-unref-gst-devices-from-messages.patch
+ patch -Np1 -i ../finch-no-gnt-disable-deprecated.patch
}
build() {
The patch only removes -DGNT_DISABLE_DEPRECATED from the generated configure script’s DEBUG_CFLAGS line. This is a narrow build-flag change in a source patch, with no added network access, privilege escalation, persistence, or embedded binaries. It does not introduce new code paths; it merely stops disabling deprecated GNT APIs during compilation, which is a compatibility/build behavior change rather than a security concern. No red flags are present in the diff itself.
@@ -0,0 +1,11 @@
+--- a/configure
++++ b/configure
+@@ -23862,7 +23862,7 @@
+ fi
+
+
+-DEBUG_CFLAGS="$DEBUG_CFLAGS -DPURPLE_DISABLE_DEPRECATED -DPIDGIN_DISABLE_DEPRECATED -DFINCH_DISABLE_DEPRECATED -DGNT_DISABLE_DEPRECATED"
++DEBUG_CFLAGS="$DEBUG_CFLAGS -DPURPLE_DISABLE_DEPRECATED -DPIDGIN_DISABLE_DEPRECATED -DFINCH_DISABLE_DEPRECATED"
+ if test "x$GCC" = "xyes"; then
+ starting_CFLAGS=`echo $CFLAGS |$sedpath 's/-Wall//'`
+ orig_CFLAGS="$CFLAGS"