Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump from 7.1.3.lqx1 to 7.1.3.lqx2. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries changed. On its face this is a routine version update with no security-relevant indicators in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.1.3.lqx1
+	pkgver = 7.1.3.lqx2
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only updates .SRCINFO metadata to match a new upstream package release (7.1-2) and its corresponding checksum/pkgver. The source remains the same official GitHub repository for the packaging metadata, with no new URLs, scripts, build steps, or privilege-related changes introduced in this diff. I do not see any security-relevant behavior change in the reviewed hunk.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.1-1.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.1-2.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = 3531c3f37261a31c193d8fdd28fad9dc6a79c8b7eaac71b52db3d0313a33001d6f9875587e19696e6d9dfa76b9bcf46a5289491e11b79c4fa3219f4640648e38
+	sha512sums = a658fb647f0e6dc074d030cc6db42bf94e59fa7a103f92b96b3519277b93c059c9b75a2f86bd0bfecf8299ad476dbb1d5a3a135b8c8f90c2b35ebcd90a8db8c6
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

Risk score 0. This change only bumps the Liquorix patch release/version identifiers and updates the corresponding source tarball checksum in PKGBUILD. No build logic, install scripts, permissions, or source URLs changed, and the source remains pinned and HTTPS-based. I did not see any new execution, persistence, or integrity red flags introduced by this diff.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=1
+_lqxpatchrel=2
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.1.3.lqx1
+pkgver=7.1.3.lqx2
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the package version/release metadata and replaces the SHA-512 checksum for the third declared source (the upstream liquorix patch tarball) to match the new `_lqxpatchrel=2` source. There are no new sources, no build-script logic changes, no added network fetches, and no privilege/persistence mechanisms introduced by this diff. This is a routine integrity checksum refresh for a version bump.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            '3531c3f37261a31c193d8fdd28fad9dc6a79c8b7eaac71b52db3d0313a33001d6f9875587e19696e6d9dfa76b9bcf46a5289491e11b79c4fa3219f4640648e38')
+            'a658fb647f0e6dc074d030cc6db42bf94e59fa7a103f92b96b3519277b93c059c9b75a2f86bd0bfecf8299ad476dbb1d5a3a135b8c8f90c2b35ebcd90a8db8c6')