Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2. No sources, checksums, build steps, dependencies, install scripts, or package contents are altered. This is a metadata-only rebuild indicator and does not introduce an obvious security risk.

@@ -1,7 +1,7 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
 	pkgver = 7.1.3.lqx2
-	pkgrel = 1
+	pkgrel = 2
 	url = https://liquorix.net/
 	arch = x86_64
 	license = GPL-2.0-only

Comment

The change only bumps the package release and updates the pinned upstream tarball/checksum from liquorix-package 7.1-2 to 7.1-3 in .SRCINFO. The source remains an HTTPS GitHub archive from the same upstream project, and there are no new build steps, scripts, or integrity regressions introduced by this metadata-only update. No security issue is evident from the diff alone.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.1-2.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.1-3.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = a658fb647f0e6dc074d030cc6db42bf94e59fa7a103f92b96b3519277b93c059c9b75a2f86bd0bfecf8299ad476dbb1d5a3a135b8c8f90c2b35ebcd90a8db8c6
+	sha512sums = e7a8608cae766e372a07ae5543dd5caafda0f696eada99ea7393d8906b5dae28bd2fce2e888bf072cd57ad1216b3b2d2aef5e71ba50bdbc54c83349ddf166cfd
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix patch release identifier from 2 to 3 and increments pkgrel from 1 to 2. No sources, build commands, install scripts, permissions, or dependencies are altered, and there are no new integrity or execution risks visible in this hunk. This appears to be a routine packaging revision with no security impact.

@@ -54,11 +54,11 @@ _htmldocs_enable=
 _major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=2
+_lqxpatchrel=3
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
 pkgver=7.1.3.lqx2
-pkgrel=1
+pkgrel=2
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'
 arch=(x86_64)

Comment

The only change in this diff is an updated SHA-512 checksum for the third source tarball, alongside a routine pkgrel/lqxpatchrel bump. I inspected the PKGBUILD context: the source is still the upstream GitHub release tarball for the Liquorix patchset, fetched over HTTPS, and there are no new build-time downloads, scripts, or privilege/persistence mechanisms introduced by this change. This is a normal integrity hash refresh, not a security concern by itself.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            'a658fb647f0e6dc074d030cc6db42bf94e59fa7a103f92b96b3519277b93c059c9b75a2f86bd0bfecf8299ad476dbb1d5a3a135b8c8f90c2b35ebcd90a8db8c6')
+            'e7a8608cae766e372a07ae5543dd5caafda0f696eada99ea7393d8906b5dae28bd2fce2e888bf072cd57ad1216b3b2d2aef5e71ba50bdbc54c83349ddf166cfd')