Review Results

Comment

The change is limited to .SRCINFO metadata and updates the package to a new upstream kernel release (7.1.3.lqx1) with matching source URLs and checksums. The sources remain HTTPS and pinned to specific release tarballs/signatures, and there is no evidence here of added build-time code execution, install-script changes, or other persistence/privilege-escalation mechanisms. Risk is low because this is a routine version bump, though the review is constrained to metadata only and does not reveal any hidden changes in the PKGBUILD logic or shipped artifacts.

@@ -1,7 +1,7 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.0.14.lqx2
-	pkgrel = 2
+	pkgver = 7.1.3.lqx1
+	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64
 	license = GPL-2.0-only

Comment

The change is limited to .SRCINFO metadata and updates the package to a newer upstream kernel release and matching liquorix-package tarball. The sources remain HTTPS, the kernel tarball is fetched from kernel.org, and the existing PGP verification entries are preserved. No new build-time execution, install scripts, or privilege/persistence mechanisms are introduced by this metadata-only change. Risk is low.

@@ -21,14 +21,14 @@ pkgbase = linux-lqx
 	makedepends = zstd
 	options = !debug
 	options = !strip
-	source = https://liquorix.net/linux-7.0.tar.xz
-	source = https://liquorix.net/linux-7.0.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.0-18.tar.gz
+	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
+	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
+	source = https://github.com/damentz/liquorix-package/archive/7.1-1.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
-	sha512sums = 8c85b708342f8f09ca25b2234b22e93b62b144a9ef919fbb21827f52fa47498e778c79db1559524dd7fb360f95b2ce174171443c1859656c281be41d2b6c5a0b
+	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = 2dd73f27e8482b7ea1c5e0c56976ff049ef87d8f331374476ec738ac63077998370de6c9384e2897f8cde918c025aeb7227fe77930cf34d0e1c87d4d07ced2b3
+	sha512sums = 23b100827b6a40a958a14491995e8862f854aac9d4740964b6797859c02677f369bce99dd66149719e198769a685686af1cb037a5d7917fbde3d7cdd1223d5e1
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a straightforward version/source bump for the Liquorix kernel package: it updates the upstream kernel major/minor, the Liquorix patch release, and the corresponding source URLs and checksums. The new sources still use HTTPS and point to official upstream locations (kernel.org and GitHub for the Liquorix packaging repo), with no new build-time network fetches, scripts, privilege escalation, or packaging logic changes. I do note the package continues to use !strip/!debug and fetches a kernel tarball plus patch archive, but that behavior predates this diff and is not introduced here. Overall this diff does not add a meaningful security risk.

@@ -51,14 +51,14 @@ _htmldocs_enable=
 ### Do not edit below this line unless you know what you're doing
 
 # pkgname=('linux-lqx' 'linux-lqx-headers' 'linux-lqx-docs')
-_major=7.0
+_major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=18
+_lqxpatchrel=1
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.0.14.lqx2
-pkgrel=2
+pkgver=7.1.3.lqx1
+pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'
 arch=(x86_64)

Comment

The change only updates the kernel release being packaged and switches the upstream tarball/signature source from liquorix.net to the official kernel.org CDN, with corresponding checksum updates. I don’t see any new code execution, build-time network fetches beyond declared sources, privilege escalation, or suspicious packaging behavior. The GitHub patch source remains unchanged and the PGP verification keys are still the standard kernel keys. Overall this looks like a routine upstream version/source refresh with low security risk.

@@ -97,16 +97,16 @@ options=(
 #_lucjanpath="https://raw.githubusercontent.com/sirlucjan/kernel-patches/master/${_major}"
 _lucjanpath="https://gitlab.com/sirlucjan/kernel-patches/raw/master/${_major}"
 
-source=("https://liquorix.net/${_srcname}.tar.xz"
-        "https://liquorix.net/${_srcname}.tar.sign"
+source=("https://cdn.kernel.org/pub/linux/kernel/v7.x/${_srcname}.tar.xz"
+        "https://cdn.kernel.org/pub/linux/kernel/v7.x/${_srcname}.tar.sign"
         "https://github.com/damentz/${_lqxpatchname}/archive/${_major}-${_lqxpatchrel}.tar.gz")
 validpgpkeys=(
     'ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds
     '647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman
 )
-sha512sums=('8c85b708342f8f09ca25b2234b22e93b62b144a9ef919fbb21827f52fa47498e778c79db1559524dd7fb360f95b2ce174171443c1859656c281be41d2b6c5a0b'
+sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            '2dd73f27e8482b7ea1c5e0c56976ff049ef87d8f331374476ec738ac63077998370de6c9384e2897f8cde918c025aeb7227fe77930cf34d0e1c87d4d07ced2b3')
+            '23b100827b6a40a958a14491995e8862f854aac9d4740964b6797859c02677f369bce99dd66149719e198769a685686af1cb037a5d7917fbde3d7cdd1223d5e1')