AUR AI Reviewer

Review Results

Version #3161 of xlibre-xserver · commit deadb58541ab · status Reviewed

Risk 0/5 · Safe .SRCINFO
Result #6462

Comment

The only change in this .SRCINFO hunk is a version bump from 25.1.9 to 25.1.11 and pkgrel from 1 to 3. No sources, checksums, install scripts, dependencies, or build commands are altered here, so this diff does not introduce any new supply-chain, persistence, or privilege-escalation risk on its own. Based on the provided hunk alone, it appears benign.

@@ -1,6 +1,6 @@
 pkgbase = xlibre-xserver
-	pkgver = 25.1.9
-	pkgrel = 1
+	pkgver = 25.1.11
+	pkgrel = 3
 	url = https://xlibre.net
 	arch = x86_64
 	groups = xlibre
Risk 0/5 · Safe .SRCINFO
Result #6463

Comment

The .SRCINFO update is consistent with the PKGBUILD: it bumps the package version, adds two upstream patch sources with matching checksums, and adjusts dependencies from systemd-libs to the soname-style libsystemd.so/libudev.so plus dbus. I do not see any new suspicious source URLs, build-time network fetches, privilege escalation, or packaging red flags in this metadata-only change. The added provides entry (x11win-server) is unusual but appears to be an explicit compatibility alias rather than a hijack, and the rest of the diff tracks the PKGBUILD changes cleanly.

@@ -19,9 +19,11 @@ pkgbase = xlibre-xserver
 	license = SMLNJ
 	license = X11
 	license = X11-distribute-modifications-variant
+	makedepends = dbus
 	makedepends = libepoxy
 	makedepends = libpciaccess
 	makedepends = libunwind
+	makedepends = libudev.so
 	makedepends = libx11
 	makedepends = libxaw
 	makedepends = libxcvt
Risk 0/5 · Safe .SRCINFO
Result #6464

Comment

The change only removes `systemd` from `makedepends` in .SRCINFO. That is a metadata-only adjustment and does not introduce any new code execution, network access, privilege changes, or packaging behavior. It may affect build dependency resolution, but there is no security impact evident from this diff alone.

@@ -38,7 +40,6 @@ pkgbase = xlibre-xserver
 	makedepends = mesa-libgl
 	makedepends = meson
 	makedepends = pixman
-	makedepends = systemd
 	makedepends = xcb-util
 	makedepends = xcb-util-image
 	makedepends = xcb-util-keysyms
Risk 0/5 · Safe .SRCINFO
Result #6465

Comment

The .SRCINFO update is a routine version bump from 25.1.9 to 25.1.11 with corresponding checksum/source updates and two local patch sources added. The new dependencies reflect the package's existing conditional systemd/udev integration, and the added patches are small source fixes (one ABI-related damage struct adjustment, one const-correctness fix) rather than suspicious code. I do not see signs of network fetches outside source=(), privilege escalation, or install-script persistence in this change. Minor concern only because .SRCINFO now advertises extra patch sources and a new provides entry, but nothing indicates malicious behavior.

@@ -48,15 +49,21 @@ pkgbase = xlibre-xserver
 	makedepends = xorg-util-macros
 	makedepends = xorg-xkbcomp
 	makedepends = xorgproto
-	source = https://github.com/X11Libre/xserver/archive/refs/tags/xlibre-xserver-25.1.9.tar.gz
+	depends = libsystemd.so
+	source = https://github.com/X11Libre/xserver/archive/refs/tags/xlibre-xserver-25.1.11.tar.gz
 	source = xvfb-run
 	source = xvfb-run.1
-	sha512sums = ef3d142f1842b415ec4ee18cc8eb3d537700658717c1610e1c2ac20f35711807c140803bd36be4db719d1e40abdbd2eb3b0ca899c018361e3a3762a8b269f29a
+	source = xlibre-xserver-gh-4080-revert-link-libxserver_glx.patch
+	source = xlibre-xserver-gh-4084-damage-fix-abi.patch
+	sha512sums = cc36ff54f915532abb364c1845be98136d1ebbab63f3004d0330af56dd3e7c079466059add113f408d942dc736b539e24b244b2941d3ad19b1fa7823499e791d
 	sha512sums = 672375cb5028ba9cda286e317d17bd8c9a9039483e7f79c21f223fd08ba07655729e9f59a082f4b8f5d8de45a77a9e9affce1002fb8c6657e26ef1a490654e49
 	sha512sums = de5e2cb3c6825e6cf1f07ca0d52423e17f34d70ec7935e9dd24be5fb9883bf1e03b50ff584931bd3b41095c510ab2aa44d2573fd5feaebdcb59363b65607ff22
+	sha512sums = f892af8f8de171a96cecab61a990bd58841ea8b89b970a59c823cfd5689d372d78aaa6d812d149663895846fb7feb34031c7eb9838530f473c361936673d1e4c
+	sha512sums = cbfa8876a8ac94aab16b84e674e179cfb541d334c01ef0f49da6d915ac595821c323ed95d4e93150d473b128fa0b92891faf01a7b95fd818a76d1e16383a5e71
 
 pkgname = xlibre-xserver
-	pkgdesc = XLibre X server
+	pkgdesc = XLibre Xserver
+	depends = libsystemd.so
 	depends = dbus
 	depends = glibc
 	depends = libbsd
Risk 0/5 · Safe .SRCINFO
Result #6466

Comment

The change only adds a runtime dependency on libudev.so in .SRCINFO. This is a metadata-only update and does not introduce any new build steps, scripts, sources, or privilege/persistence mechanisms. I did not find any security-relevant issue in the provided diff hunk.

@@ -66,6 +73,7 @@ pkgname = xlibre-xserver
 	depends = libpciaccess
 	depends = libtirpc
 	depends = libunwind
+	depends = libudev.so
 	depends = libxau
 	depends = libxcvt
 	depends = libxdmcp
Risk 1/5 · Low .SRCINFO
Result #6467

Comment

The change is limited to .SRCINFO metadata and does not introduce executable code, build-time network access, privilege escalation, or packaging script changes. The only substantive metadata edits are removing a dependency on systemd-libs and adding an extra provides entry (x11win-server). That could affect dependency resolution or package replacement behavior, but there is no evidence here of a malicious payload or a direct security impact from this metadata-only diff. I would treat this as low risk, with the main concern being potential package confusion rather than an exploit.

@@ -74,13 +82,13 @@ pkgname = xlibre-xserver
 	depends = nettle
 	depends = pixman
 	depends = sh
-	depends = systemd-libs
 	depends = xlibre-xserver-common
 	provides = X-ABI-EXTENSION_VERSION=11.0
 	provides = X-ABI-VIDEODRV_VERSION=28.0
 	provides = X-ABI-XINPUT_VERSION=26.0
 	provides = x-server
 	provides = xorg-server
+	provides = x11win-server
 	conflicts = glamor-egl
 	conflicts = nvidia-utils<=331.20
 	conflicts = xf86-video-modesetting
Risk 0/5 · Safe .SRCINFO
Result #6468

Comment

The .SRCINFO update is a routine package metadata refresh for a new upstream release and added patch files. The dependency changes replace the virtual `systemd-libs` dependency with explicit SONAME dependencies (`libsystemd.so`, `libudev.so`) and add `dbus` as a makedepends, which is not inherently suspicious. The new source URLs remain HTTPS and point to the upstream GitHub release archive, and the added patch filenames are local package sources with checksums recorded in .SRCINFO. No signs of network fetches at build time, privilege escalation, persistence, or other malicious metadata changes are present in this diff alone.

@@ -94,17 +102,20 @@ pkgname = xlibre-xserver-common
 	depends = xkeyboard-config
 	depends = xorg-setxkbmap
 	depends = xorg-xkbcomp
+	optdepends = 
 	provides = xorg-server-common
 	conflicts = xlibre-xserver-common-beta
 	conflicts = xorg-server-common
 
 pkgname = xlibre-xserver-xephyr
 	pkgdesc = A nested X server that runs as an X application
+	depends = libsystemd.so
 	depends = glibc
 	depends = libepoxy
 	depends = libgl
 	depends = libtirpc
 	depends = libunwind
+	depends = libudev.so
 	depends = libx11
 	depends = libxau
 	depends = libxdmcp
Risk 0/5 · Safe .SRCINFO
Result #6469

Comment

The .SRCINFO update is consistent with the PKGBUILD: it bumps to the new upstream release, adds two patch sources with matching checksums, and updates dependency metadata from systemd-libs to the soname-style libsystemd.so/libudev.so entries. I do not see any new suspicious sources, network fetches, privilege escalation, or packaging red flags in this metadata-only change. The added empty optdepends entries are harmless noise. Overall this looks like a routine metadata refresh.

@@ -112,19 +123,20 @@ pkgname = xlibre-xserver-xephyr
 	depends = libxshmfence
 	depends = nettle
 	depends = pixman
-	depends = systemd-libs
 	depends = xcb-util
 	depends = xcb-util-image
 	depends = xcb-util-keysyms
 	depends = xcb-util-renderutil
 	depends = xcb-util-wm
 	depends = xlibre-xserver-common
+	optdepends = 
 	provides = xorg-server-xephyr
 	conflicts = xlibre-xserver-xephyr-beta
 	conflicts = xorg-server-xephyr
 
 pkgname = xlibre-xserver-xnest
 	pkgdesc = A nested X server that runs as an X application
+	depends = libsystemd.so
 	depends = glibc
 	depends = libtirpc
 	depends = libunwind
Risk 0/5 · Safe .SRCINFO
Result #6470

Comment

The .SRCINFO change is low risk. It updates the package version and dependency metadata, replacing the soname-style systemd dependency with explicit libsystemd.so/libudev.so entries and adding a couple of new patch sources with matching checksums. I did not see any suspicious new network fetches, install-script changes, privilege escalation, or other execution paths in this diff. The added patch sources are pinned by checksum in .SRCINFO, and the extra provides entry is just metadata. No clear security issue is evident from this change alone.

@@ -135,8 +147,8 @@ pkgname = xlibre-xserver-xnest
 	depends = libxfont2
 	depends = nettle
 	depends = pixman
-	depends = systemd-libs
 	depends = xlibre-xserver-common
+	optdepends = 
 	provides = xorg-server-xnest
 	conflicts = xlibre-xserver-xnest-beta
 	conflicts = xorg-server-xnest
Risk 0/5 · Safe .SRCINFO
Result #6471

Comment

The .SRCINFO change is low risk. It updates the package version, adds two upstream patch sources with matching checksums, and adjusts dependencies from the soname package `systemd-libs` to explicit soname dependencies (`libsystemd.so`, `libudev.so`) plus `dbus` as a makedep. There are no signs of network fetches outside `source=()`, no suspicious external URLs, and no install-script or privilege-related changes in this diff. The only notable metadata change is adding `provides = x11win-server`, which could affect dependency resolution, but by itself it does not introduce a security issue.

@@ -145,6 +157,7 @@ pkgname = xlibre-xserver-xvfb
 	pkgdesc = Virtual framebuffer X server
 	license = GPL-2.0-only
 	license = MIT
+	depends = libsystemd.so
 	depends = glibc
 	depends = libgl
 	depends = libtirpc
Risk 0/5 · Safe .SRCINFO
Result #6472

Comment

The .SRCINFO change is low risk. It updates the package version and adds two upstream-hosted patch sources with matching SHA-512 checksums, so there is no obvious integrity bypass or suspicious external fetch. The dependency changes are consistent with the PKGBUILD’s conditional USE_SYSTEMD logic: systemd-libs was replaced by the soname dependency libsystemd.so, and libudev.so/dbus were added to makedepends/depends as part of the same systemd integration. The added empty optdepends entries are harmless metadata noise. I do not see any malicious install scripts, network-at-build behavior, or privilege escalation introduced by this metadata-only change.

@@ -155,9 +168,9 @@ pkgname = xlibre-xserver-xvfb
 	depends = nettle
 	depends = pixman
 	depends = sh
-	depends = systemd-libs
 	depends = xlibre-xserver-common
 	depends = xorg-xauth
+	optdepends = 
 	provides = xorg-server-xvfb
 	conflicts = xlibre-xserver-xvfb-beta
 	conflicts = xorg-server-xvfb
Risk 0/5 · Safe .SRCINFO
Result #6473

Comment

The only change in this .SRCINFO hunk is the addition of an empty `optdepends =` entry for `xlibre-xserver-devel`. This does not introduce executable code, network access, privilege changes, or packaging behavior changes; it appears to be a harmless metadata artifact. No security impact is evident from the diff alone.

@@ -170,6 +183,7 @@ pkgname = xlibre-xserver-devel
 	depends = xlibre-xserver
 	depends = xorg-util-macros
 	depends = xorgproto
+	optdepends = 
 	provides = xorg-server-devel
 	conflicts = xlibre-xserver-devel-beta
 	conflicts = xorg-server-devel
Risk 1/5 · Low PKGBUILD
Result #6474

Comment

The change is low risk. It only adds a defaulted build-time toggle for systemd support, swaps some package dependencies from systemd-libs to libudev.so/libsystemd.so, and adds two patch files that are applied in prepare(). I checked the PKGBUILD diff and there are no obvious red flags like network fetches outside source=(), privilege escalation, or install-script persistence. The only security-relevant concern is that the new patches are not shown here, so their contents should be reviewed separately; however, based on this PKGBUILD change alone, nothing indicates malicious behavior.

@@ -4,6 +4,8 @@
 # Contributor: AndyRTR <andyrtr@archlinux.org>
 # Contributor: Jan de Groot <jgc@archlinux.org>
 
+: "${USE_SYSTEMD:=1}"
+
 pkgbase=xlibre-xserver
 pkgname=(
 	'xlibre-xserver'
Risk 0/5 · Safe PKGBUILD
Result #6475

Comment

The change is a routine version bump plus packaging adjustments. I do not see any malicious behavior: sources remain HTTPS from the official upstream GitHub release tarball, the added patch files are checksum-pinned in source=(), and the new prepare() step only applies local patches. The other edits are dependency toggles around systemd/libudev and package metadata, with no network fetches, privilege escalation, or writes outside $pkgdir. Risk is low.

@@ -13,8 +15,8 @@ pkgname=(
 	'xlibre-xserver-xvfb'
 	'xlibre-xserver-devel' # devel last due to some checks there
 )
-pkgver=25.1.9
-pkgrel=1
+pkgver=25.1.11
+pkgrel=3
 arch=('x86_64')
 license=(
 	'BSD-3-Clause'
Risk 0/5 · Safe PKGBUILD
Result #6476

Comment

The PKGBUILD change is low risk. It adds two local patch files to source() with matching checksums and applies them in prepare(); I inspected both patches and they only adjust Xorg/XLibre build behavior (one reverts a GLX link change, the other fixes a struct layout/const issue). The rest of the diff is dependency and packaging metadata: switching from systemd-libs to libudev.so/libsystemd.so, adding dbus, and gating systemd_notify via USE_SYSTEMD. There are no network fetches at build time, no privilege escalation, no suspicious install scripts, and no evidence of hidden payloads or persistence mechanisms. The only notable concern is that the package now ships extra patch sources, but their contents are benign and checksum-pinned.

@@ -36,9 +38,11 @@ license=(
 groups=('xlibre')
 url="https://xlibre.net"
 makedepends=(
+	'dbus'
 	'libepoxy'
 	'libpciaccess'
 	'libunwind'
+	'libudev.so'
 	'libx11'
 	'libxaw'
 	'libxcvt'
Risk 0/5 · Safe PKGBUILD
Result #6477

Comment

The reviewed hunk only removes `systemd` from `makedepends`. In the full PKGBUILD, systemd-related runtime linkage is still handled via `libsystemd.so`/`systemd_notify` conditionals, and the package continues to build from pinned HTTPS sources with checksummed patches. This change does not introduce any new code execution, network access, privilege escalation, or persistence mechanism; it only adjusts build dependencies. No security concern is evident from this diff alone.

@@ -55,7 +59,6 @@ makedepends=(
 	'mesa-libgl'
 	'meson'
 	'pixman'
-	'systemd'
 	'xcb-util'
 	'xcb-util-image'
 	'xcb-util-keysyms'
Risk 0/5 · Safe PKGBUILD
Result #6478

Comment

The change is a routine packaging update: version bump, dependency adjustments for optional systemd/elogind support, and addition of two local patch files that are checksum-pinned in source(). I did not see any suspicious network fetches, privilege escalation, install-script changes, or other persistence mechanisms in the provided diff. The only security-relevant concern is that new patches can alter build behavior, but they are included as checked-in sources with hashes and there is no evidence in this diff of malicious content.

@@ -66,14 +69,30 @@ makedepends=(
 	'xorg-xkbcomp'
 	'xorgproto'
 )
+
+((USE_SYSTEMD)) && depends=('libsystemd.so')
+((USE_SYSTEMD)) || optdepends=(
+	'elogind: login1 session management'
+)
+
 source=(
 	https://github.com/X11Libre/xserver/archive/refs/tags/${pkgbase}-"${pkgver}".tar.gz
 	xvfb-run # with updates from FC master
 	xvfb-run.1
+	xlibre-xserver-gh-4080-revert-link-libxserver_glx.patch
+	xlibre-xserver-gh-4084-damage-fix-abi.patch
 )
-sha512sums=('ef3d142f1842b415ec4ee18cc8eb3d537700658717c1610e1c2ac20f35711807c140803bd36be4db719d1e40abdbd2eb3b0ca899c018361e3a3762a8b269f29a'
+sha512sums=('cc36ff54f915532abb364c1845be98136d1ebbab63f3004d0330af56dd3e7c079466059add113f408d942dc736b539e24b244b2941d3ad19b1fa7823499e791d'
             '672375cb5028ba9cda286e317d17bd8c9a9039483e7f79c21f223fd08ba07655729e9f59a082f4b8f5d8de45a77a9e9affce1002fb8c6657e26ef1a490654e49'
-            'de5e2cb3c6825e6cf1f07ca0d52423e17f34d70ec7935e9dd24be5fb9883bf1e03b50ff584931bd3b41095c510ab2aa44d2573fd5feaebdcb59363b65607ff22')
+            'de5e2cb3c6825e6cf1f07ca0d52423e17f34d70ec7935e9dd24be5fb9883bf1e03b50ff584931bd3b41095c510ab2aa44d2573fd5feaebdcb59363b65607ff22'
+            'f892af8f8de171a96cecab61a990bd58841ea8b89b970a59c823cfd5689d372d78aaa6d812d149663895846fb7feb34031c7eb9838530f473c361936673d1e4c'
+            'cbfa8876a8ac94aab16b84e674e179cfb541d334c01ef0f49da6d915ac595821c323ed95d4e93150d473b128fa0b92891faf01a7b95fd818a76d1e16383a5e71')
+
+prepare() {
+	cd "xserver-${pkgbase}-${pkgver}"
+	patch -Np1 < "$srcdir/xlibre-xserver-gh-4080-revert-link-libxserver_glx.patch"
+	patch -Np1 < "$srcdir/xlibre-xserver-gh-4084-damage-fix-abi.patch"
+}
 
 build() {
 	# Since pacman 5.0.2-2, hardened flags are now enabled in makepkg.conf
Risk 0/5 · Safe PKGBUILD
Result #6479

Comment

The change is low risk. It only adjusts build-time Meson options and package metadata to make systemd notification conditional, swaps runtime dependencies from systemd-libs to libudev.so/libsystemd.so, and adds two local patch files that are checksum-pinned in source(). I did not see any network fetches, privilege escalation, install-script persistence, or suspicious post-install behavior. The only notable concern is that the new patches should be reviewed for correctness, but based on the PKGBUILD diff alone there is no clear security issue.

@@ -83,6 +102,9 @@ build() {
 	export CXXFLAGS=${CXXFLAGS/-fno-plt}
 	export LDFLAGS=${LDFLAGS/-Wl,-z,now}
 
+	local systemd_notify=false
+	((USE_SYSTEMD)) && systemd_notify=true
+
 	arch-meson "xserver-${pkgbase}-${pkgver}" build \
 		-D ipv6=true \
 		-D xvfb=true \
Risk 0/5 · Safe PKGBUILD
Result #6480

Comment

The change is low risk. It only adds a Meson option to toggle systemd_notify based on a local build-time variable, and the surrounding PKGBUILD changes are dependency/package metadata updates plus two local patch files. I reviewed the provided patch contents: one reverts a GLX link change, the other fixes an ABI/layout issue and a const-correctness build error. No network fetches, privilege escalation, persistence, or suspicious install-time actions were introduced by this diff.

@@ -97,6 +119,7 @@ build() {
 		-D dtrace=false \
 		-D seatd_libseat=false \
 		-D systemd_logind=true \
+		-D systemd_notify="$systemd_notify" \
 		-D suid_wrapper=true \
 		-D linux_acpi=false \
 		-D legacy_nvidia_padding=true \
Risk 0/5 · Safe PKGBUILD
Result #6481

Comment

The change only adds an explicit empty optdepends array to the PKGBUILD package_xlibre-xserver-common() function. This is a no-op packaging metadata change and does not affect sources, build steps, permissions, install scripts, or runtime behavior. No security impact is evident from this diff hunk.

@@ -132,6 +155,7 @@ package_xlibre-xserver-common() {
 		'xorg-setxkbmap'
 		'xorg-xkbcomp'
 	)
+	optdepends=()
 	provides=('xorg-server-common')
 	conflicts=(
 		'xlibre-xserver-common-beta'
Risk 0/5 · Safe PKGBUILD
Result #6482

Comment

The PKGBUILD change is low risk. It updates the package version, adds two upstream patch sources with checksums, and adjusts dependency handling to make systemd optional via USE_SYSTEMD while switching to libudev.so/libsystemd.so linkage. I did not see any suspicious network fetches outside source=(), shell execution, privilege escalation, or install-script changes in this diff. The only notable behavioral change is the optional systemd/elogind split and a new provides entry for x11win-server, which does not appear malicious on its face.

@@ -147,8 +171,8 @@ package_xlibre-xserver-common() {
 }
 
 package_xlibre-xserver() {
-	pkgdesc="XLibre X server"
-	depends=(
+	pkgdesc="XLibre Xserver"
+	depends+=(
 		'dbus'
 		'glibc'
 		'libbsd'
Risk 1/5 · Low PKGBUILD
Result #6483

Comment

The change is low risk. It only adjusts package metadata/dependencies and adds two local patch files to the source array with checksums, plus a prepare() step that applies them. I did not see any network fetches, privilege escalation, install-script changes, or suspicious build-time execution. The new libudev.so/libsystemd split and optional systemd_notify toggle are packaging decisions, not an obvious security issue. The only thing to note is that the review scope includes new patch artifacts, but the diff provided does not show their contents; based on the PKGBUILD alone there is no high-confidence malicious behavior.

@@ -158,6 +182,7 @@ package_xlibre-xserver() {
 		'libpciaccess'
 		'libtirpc'
 		'libunwind'
+		'libudev.so'
 		'libxau'
 		'libxcvt' # FS#52949
 		'libxdmcp'
Risk 0/5 · Safe PKGBUILD
Result #6484

Comment

The change only removes an explicit runtime dependency on systemd-libs from package_xlibre-xserver(). This is a packaging metadata adjustment and does not introduce new code execution, network access, privilege escalation, persistence, or integrity risks. I did not find any accompanying changes in the reviewed hunk that would affect build or install behavior.

@@ -166,7 +191,6 @@ package_xlibre-xserver() {
 		'nettle'
 		'pixman'
 		'sh'
-		'systemd-libs'
 		'xlibre-xserver-common'
 	)
 	# see xorg-server-*/hw/xfree86/common/xf86Module.h for ABI versions - we provide major numbers
Risk 0/5 · Safe PKGBUILD
Result #6485

Comment

The added `provides+=('x11win-server')` is a metadata-only change and does not introduce code execution, privilege escalation, network access, or packaging integrity issues. It simply advertises an additional virtual provide for compatibility on Artix, alongside existing `xorg-server`/`x-server` provides. No suspicious sources, patches, or install-script behavior are implicated by this hunk.

@@ -178,6 +202,7 @@ package_xlibre-xserver() {
 		'x-server'
 		'xorg-server'
 	)
+	provides+=('x11win-server') # Artix only
 	conflicts=(
 		'glamor-egl'
 		'nvidia-utils<=331.20'
Risk 0/5 · Safe PKGBUILD
Result #6486

Comment

The change is limited to dependency metadata in PKGBUILD. It replaces explicit systemd-libs dependencies with the soname dependency libudev.so and adds an optional USE_SYSTEMD toggle that only affects a Meson feature flag. It also adds dbus/libudev build deps and a couple of local patch sources, but there is no evidence of network fetches at build time, privilege escalation, or suspicious install-time behavior in this diff. The only security-relevant concern is that the new patch files should be reviewed separately, but within the provided hunk this is a routine packaging adjustment with no clear malicious behavior.

@@ -207,12 +232,13 @@ package_xlibre-xserver() {
 
 package_xlibre-xserver-xephyr() {
 	pkgdesc="A nested X server that runs as an X application"
-	depends=(
+	depends+=(
 		'glibc'
 		'libepoxy'
 		'libgl'
 		'libtirpc'
 		'libunwind'
+		'libudev.so'
 		'libx11'
 		'libxau'
 		'libxdmcp'
Risk 0/5 · Safe PKGBUILD
Result #6487

Comment

The change is low risk. It removes the hard dependency on systemd-libs from the xephyr subpackage and replaces it with libudev.so, which is a normal ABI-level dependency adjustment. The rest of the PKGBUILD changes are version bumps and two local patch files; I inspected both patches and they only adjust X server build/linkage and a const-correctness fix, with no network access, privilege escalation, persistence, or suspicious install-time behavior. No malicious packaging behavior is evident in this diff.

@@ -220,7 +246,6 @@ package_xlibre-xserver-xephyr() {
 		'libxshmfence'
 		'nettle'
 		'pixman'
-		'systemd-libs'
 		'xcb-util'
 		'xcb-util-image'
 		'xcb-util-keysyms'
Risk 0/5 · Safe PKGBUILD
Result #6488

Comment

The change only adds an empty optdepends array to the xephyr subpackage in PKGBUILD. This has no effect on build steps, installed files, privileges, network access, or runtime behavior. No security-relevant impact is apparent from this diff hunk alone.

@@ -228,6 +253,7 @@ package_xlibre-xserver-xephyr() {
 		'xcb-util-wm'
 		'xlibre-xserver-common'
 	)
+	optdepends=()
 	provides=('xorg-server-xephyr')
 	conflicts=(
 		'xlibre-xserver-xephyr-beta'
Risk 0/5 · Safe PKGBUILD
Result #6489

Comment

The reviewed hunk only changes `depends=` to `depends+=` in the `xlibre-xserver-xvfb` split package. This is a packaging semantics fix: it preserves any dependencies accumulated earlier in the function while still adding the package-specific ones. It does not introduce new sources, network access, privilege changes, or install-script behavior. No security impact is apparent from this change alone.

@@ -248,7 +274,7 @@ package_xlibre-xserver-xvfb() {
 		'GPL-2.0-only'
 		'MIT'
 	)
-	depends=(
+	depends+=(
 		'glibc'
 		'libgl'
 		'libtirpc'
Risk 0/5 · Safe PKGBUILD
Result #6490

Comment

The change is low risk. It removes the hard dependency on systemd-libs from the xvfb split package and adds an optional dependency array, but the package still builds from the upstream tarball with only two local patches and no new network fetches or privilege-bearing install logic. The diff hunk itself does not introduce any suspicious execution paths, persistence mechanisms, or integrity issues. The only notable behavior change is dependency/feature gating around systemd support, which is packaging policy rather than a security concern.

@@ -259,10 +285,10 @@ package_xlibre-xserver-xvfb() {
 		'nettle'
 		'pixman'
 		'sh'
-		'systemd-libs'
 		'xlibre-xserver-common'
 		'xorg-xauth'
 	)
+	optdepends=()
 	provides=('xorg-server-xvfb')
 	conflicts=(
 		'xlibre-xserver-xvfb-beta'
Risk 0/5 · Safe PKGBUILD
Result #6491

Comment

The PKGBUILD change is low risk. The reviewed hunk only switches package_xlibre-xserver-xnest() from assigning depends=() to appending with depends+=(), which is a packaging semantics fix so the split package inherits the base dependency list instead of overwriting it. That does not introduce new sources, network access, privilege escalation, or install-script behavior. I did note the broader PKGBUILD adds patches and systemd-related toggles elsewhere in the file, but those are outside the single hunk under review and do not affect this specific change.

@@ -281,7 +307,7 @@ package_xlibre-xserver-xvfb() {
 
 package_xlibre-xserver-xnest() {
 	pkgdesc="A nested X server that runs as an X application"
-	depends=(
+	depends+=(
 		'glibc'
 		'libtirpc'
 		'libunwind'
Risk 0/5 · Safe PKGBUILD
Result #6492

Comment

The change is a no-op security-wise: it removes an explicit runtime dependency on systemd-libs from the xnest subpackage and adds an empty optdepends array. There is no new code execution, no network access, no privilege change, and no packaging behavior that would increase attack surface. If anything, dropping systemd-libs may be a functional regression if the binary actually links against it, but that is not a security issue in this diff alone.

@@ -292,9 +318,9 @@ package_xlibre-xserver-xnest() {
 		'libxfont2'
 		'nettle'
 		'pixman'
-		'systemd-libs'
 		'xlibre-xserver-common'
 	)
+	optdepends=()
 	provides=('xorg-server-xnest')
 	conflicts=(
 		'xlibre-xserver-xnest-beta'
Risk 1/5 · Low PKGBUILD
Result #6493

Comment

The PKGBUILD change is low risk. It adds two local patch sources with verified checksums, and the new prepare() only applies those patches from the source array. The other edits are dependency/metadata adjustments (switching from systemd-libs to libudev.so/libsystemd.so conditionally, adding an optional elogind note, and adding a local provides entry). I do not see any network fetches at build time, privilege escalation, or suspicious install-time behavior in this diff. The only thing to note is that the added patches should be reviewed for malicious content, but based on the PKGBUILD diff alone there is no direct red flag.

@@ -315,9 +341,10 @@ package_xlibre-xserver-devel() {
 		'mesa'
 		'pixman'
 		'xlibre-xserver'
-		'xorg-util-macros'
+		'xorg-util-macros' # not required but almost every XLibre pkg needs it
 		'xorgproto'
 	)
+	optdepends=()
 	provides=('xorg-server-devel')
 	conflicts=(
 		'xlibre-xserver-devel-beta'
Risk 0/5 · Safe xlibre-xserver-gh-4080-revert-link-libxserver_glx.patch
Result #6494

Comment

The patch only removes `libxserver_glx` from the Xorg link list in `hw/xfree86/meson.build`, reverting a prior upstream change. This is a build/linkage adjustment, not an install-time or runtime privilege/persistence change. I don’t see any added network access, script execution, packaging escape, or suspicious artifact in this diff. Risk is low.

@@ -0,0 +1,26 @@
+From 6f3d19537721929b639d69739bb0873fdcc0747b Mon Sep 17 00:00:00 2001
+From: Tautvis <tautvydas@tcorp.ltd>
+Date: Mon, 9 Nov 2026 14:27:08 +0200
+Subject: [PATCH] Revert "build: link libxserver_glx into Xorg to export
+ xorgGlxCreateVendor"
+
+This revert commit 2e425acb3514e637cfdd8a3f93ae140976069992. As it introduces what is fixed in https://github.com/X11Libre/xserver/pull/3213
+back.
+
+Signed-off-by: Tautvis <gtautvis@gmail.com>
+---
+ hw/xfree86/meson.build | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/hw/xfree86/meson.build b/hw/xfree86/meson.build
+index 75cd139aa1..4bf1dddaf6 100644
+--- a/hw/xfree86/meson.build
++++ b/hw/xfree86/meson.build
+@@ -58,7 +58,6 @@ srcs_xorg = [
+ xorg_link = [
+     libxserver,
+     libglxvnd,
+-    libxserver_glx,
+     xorg_common,
+     xorg_compat,
+     xorg_loader,
Risk 0/5 · Safe xlibre-xserver-gh-4084-damage-fix-abi.patch
Result #6495

Comment

Risk is low. The patch only reorders a struct field in a header to preserve ABI and adds a comment marking the non-ABI tail, plus a const-correctness fix in a local helper. There are no new build-time downloads, privilege changes, persistence mechanisms, or suspicious install/script/unit modifications. The only thing to note is that changing a public struct layout can be ABI-sensitive, but this change is explicitly intended to restore compatibility rather than introduce a backdoor or integrity issue.

@@ -0,0 +1,88 @@
+From 10249fc458c59755aade79caefb84b6cd953e77d Mon Sep 17 00:00:00 2001
+From: "Enrico Weigelt, metux IT consult" <info@metux.net>
+Date: Fri, 13 Nov 2026 14:38:06 +0100
+Subject: [PATCH 1/2] miext: damage: fix ABI mismatch caused by Xorg patch
+
+The xorg commit da72833185481481052972f031262e94976131ef which had been
+cherry-picked introduces a new field in the middle of the DamageRec struct,
+which is part of the public driver ABI.
+
+It broke at least the amdgpu driver (at time of writing no others known yet)
+
+So doing what's the correct approach here: always put new fields at the
+end of the struct, never change existing layout.
+
+Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
+---
+ miext/damage/damagestr.h | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/miext/damage/damagestr.h b/miext/damage/damagestr.h
+index 41f4afe38cf..e2287402ba8 100644
+--- a/miext/damage/damagestr.h
++++ b/miext/damage/damagestr.h
+@@ -1,3 +1,4 @@
++/* PART OF PUBLIC SDK */
+ /*
+  * Copyright © 2003 Keith Packard
+  *
+@@ -35,12 +36,6 @@
+ typedef struct _damage {
+     DamagePtr pNext;
+     DamagePtr pNextWin;
+-    /*
+-     * Head of the pNext list this damage is currently linked on, or NULL if it is not linked on any list.  Recorded at
+-     * insertion time so that removal always unlinks from the list the damage actually went onto; see
+-     * damageInsertDamage().
+-     */
+-    DamagePtr *pListHead;
+     RegionRec damage;
+ 
+     DamageReportLevel damageLevel;
+@@ -55,6 +50,14 @@ typedef struct _damage {
+     Bool reportAfter;
+     RegionRec pendingDamage;    /* will be flushed post submission at the latest */
+     ScreenPtr pScreen;
++
++    /* --- not part of ABI beyond here --- */
++    /*
++     * Head of the pNext list this damage is currently linked on, or NULL if it is not linked on any list.  Recorded at
++     * insertion time so that removal always unlinks from the list the damage actually went onto; see
++     * damageInsertDamage().
++     */
++    DamagePtr *pListHead;
+ } DamageRec;
+ 
+ typedef struct _damageScrPriv {
+
+From 2c2b9d9ccf27167681510333bfe57ce2a235a035 Mon Sep 17 00:00:00 2001
+From: "Enrico Weigelt, metux IT consult" <info@metux.net>
+Date: Fri, 13 Nov 2026 15:36:36 +0100
+Subject: [PATCH 2/2] config: udev: fix const issue in strrstr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+../config/udev.c: In function ‘strrstr’:
+../config/udev.c:485:10: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
+  485 |     prev = strstr(haystack, needle);
+      |          ^
+
+Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
+---
+ config/udev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/config/udev.c b/config/udev.c
+index 45da00f5cc2..5903a9a1397 100644
+--- a/config/udev.c
++++ b/config/udev.c
+@@ -480,7 +480,7 @@ config_udev_fini(void)
+ /* Find the last occurrence of the needle in haystack */
+ static char *strrstr(const char *haystack, const char *needle)
+ {
+-    char *prev, *last, *tmp;
++    const char *prev, *last, *tmp;
+ 
+     prev = strstr(haystack, needle);
+     if (!prev)