Review Results

Comment

The only change in this .SRCINFO diff is a pkgrel bump from 1 to 2 for the python310 package. No source URLs, checksums, build steps, install scripts, dependencies, or packaging behavior changed. This is a metadata-only rebuild indicator and does not introduce an apparent security risk.

@@ -1,7 +1,7 @@
 pkgbase = python310
 	pkgdesc = The Python programming language (version 3.10)
 	pkgver = 3.10.22
-	pkgrel = 1
+	pkgrel = 2
 	url = https://www.python.org/
 	arch = x86_64
 	arch = aarch64

Comment

The change only adds a runtime dependency on openssl-3 to the python310 package metadata in .SRCINFO. This does not introduce any executable code, build-time network access, privilege escalation, persistence, or packaging integrity issues by itself. It appears to be a straightforward dependency metadata update, likely reflecting upstream linkage requirements. No security red flags are evident from this diff alone.

@@ -9,6 +9,7 @@ pkgbase = python310
 	makedepends = gdb
 	makedepends = tk
 	depends = mpdecimal
+	depends = openssl-3
 	optdepends = python-pip
 	optdepends = python-pipx
 	optdepends = python-setuptools

Comment

Low risk change. The PKGBUILD only updates the package description, adds an explicit runtime dependency on openssl-3, and adjusts the build to point configure at the OpenSSL 3 pkg-config directory with --with-openssl-rpath=auto. This is a normal packaging fix for linking against the system OpenSSL 3 used by Python 3.10 and does not introduce network access, privilege escalation, suspicious scripts, or nonstandard install behavior. No malicious artifacts are present in the reviewed diff.

@@ -8,13 +8,13 @@
 
 pkgname=python310
 pkgver=3.10.22
-pkgrel=1
+pkgrel=2
 _pybasever=${pkgver%.*}
-pkgdesc="The Python programming language (version 3.10)"
+pkgdesc="The Python programming language (version $_pybasever)"
 arch=("x86_64" "aarch64")
 license=("PSF-2.0")
 url="https://www.python.org/"
-depends=("mpdecimal")
+depends=("mpdecimal" "openssl-3")
 makedepends=("gdb" "tk")
 optdepends=("python-pip" "python-pipx" "python-setuptools" "tk")
 options=(strip !debug !lto)

Comment

The change only prepends PKG_CONFIG_PATH=/usr/lib/openssl-3/pkgconfig to the existing ./configure invocation in build(). This is a build-environment tweak to make configure find the intended OpenSSL 3 pkg-config metadata; it does not add network access, shell execution, privilege escalation, persistence, or packaging outside $pkgdir. No suspicious sources or install-time behavior are introduced by this hunk.

@@ -52,7 +52,8 @@ build() {
 	CFLAGS="${CFLAGS/-O2/-O3} -ffat-lto-objects"
 
 	# Disable bundled pip & setuptools
-	./configure \
+	PKG_CONFIG_PATH=/usr/lib/openssl-3/pkgconfig \
+		./configure \
 		ax_cv_c_float_words_bigendian=no \
 		--prefix=/usr \
 		--enable-shared \

Comment

The change is narrowly scoped to Python's build configuration and does not introduce new sources, scripts, or post-install actions. Adding --with-openssl-rpath=auto and an explicit openssl-3 pkg-config path only affects how the interpreter links against the system OpenSSL 3 library at build time. That does increase reliance on a specific system library path and embeds an rpath-related setting, but in this context it is a packaging/build tweak rather than a persistence or code-execution risk. No suspicious downloads, privilege changes, or install-time network activity are present in the diff.

@@ -65,6 +66,7 @@ build() {
 		--with-system-libmpdec \
 		--enable-loadable-sqlite-extensions \
 		--without-ensurepip \
+		--with-openssl-rpath=auto \
 		--with-tzpath=/usr/share/zoneinfo
 
 	make EXTRA_CFLAGS="$CFLAGS"