Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 27.24 to 28.0, with the source tarball URL and checksum updated accordingly and the virtual provide adjusted to 28. There are no new build steps, scripts, privileges, or network-fetching behaviors introduced by this diff. Based on the provided hunk alone, this looks like routine metadata maintenance with low security risk.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 27.24
+	pkgver = 28.0
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change only updates the upstream source tarball URL/version in .SRCINFO from OpenJFX 27.24 to 28.0 and refreshes the corresponding checksum. The source remains an HTTPS GitHub release archive from the official upstream repository, with no new build-time commands, scripts, or privilege-related changes introduced in this diff. Based on the provided hunk alone, this is a routine version bump with no evident security impact.

@@ -27,13 +27,13 @@ pkgbase = java-openjfx
 	makedepends = unzip
 	makedepends = zip
 	options = !lto
-	source = java-openjfx-27.24.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/27+24.tar.gz
+	source = java-openjfx-28.0.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+0.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = f5e253bd0e6d80d195efcb84b76e4802396be325174daaf934234596b410564a6b7c60862d33bb786199b91cc30188ad938df5c260a88869c165852930ace6af
+	b2sums = 985b984aa854394c0d7b4bd1eaa24684c580c37396e4e57a3ede7a08db21b30f87f2230627950beb3f0a0cb8439ab665d27ca38f182ceb23413906e70b51ef1d
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The only change is bumping the virtual provide from java-openjfx=27 to java-openjfx=28 in .SRCINFO. This is metadata-only and does not alter build steps, sources, install scripts, permissions, or shipped artifacts. No security-relevant behavior is introduced by this diff.

@@ -46,7 +46,7 @@ pkgname = java-openjfx
 	depends = libx11
 	depends = libxtst
 	optdepends = gtk3: GTK3 support
-	provides = java-openjfx=27
+	provides = java-openjfx=28
 
 pkgname = java-openjfx-doc
 	arch = any

Comment

The change only bumps the upstream OpenJFX tag from 27+24 to 28+0, which updates pkgver accordingly. There are no new sources, no build-script changes, no added network fetches, and no packaging/install logic changes in the provided hunk. Based on this diff alone, I do not see a security issue beyond the normal trust in the upstream release being referenced.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='27+24'
+_tag='28+0'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change only bumps the upstream OpenJFX tag from 27+24 to 28+0 and updates the corresponding b2sum for the first source artifact. I don’t see any new build-time network access, script execution, privilege escalation, or packaging changes beyond the expected integrity hash refresh for a version update. No suspicious sources or install hooks are introduced in this hunk.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('f5e253bd0e6d80d195efcb84b76e4802396be325174daaf934234596b410564a6b7c60862d33bb786199b91cc30188ad938df5c260a88869c165852930ace6af'
+b2sums=('985b984aa854394c0d7b4bd1eaa24684c580c37396e4e57a3ede7a08db21b30f87f2230627950beb3f0a0cb8439ab665d27ca38f182ceb23413906e70b51ef1d'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'