Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 7.1.3.lqx3 to 7.1.4.lqx1. No sources, checksums, build steps, install scripts, or package metadata affecting trust boundaries were changed in the provided diff. On its face this is a routine upstream version update with no security red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.1.3.lqx3
+	pkgver = 7.1.4.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is a straightforward source-version bump in .SRCINFO from liquorix-package 7.1-4 to 7.1-5, with the corresponding checksum updated. The upstream GitHub archive URL remains on the official repository, and there are no new sources, scripts, install hooks, or build-time execution changes in this diff. Based on the provided hunk alone, this does not introduce an obvious security risk.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.1-4.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.1-5.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = f906bc182f2d4aed81b7529b18b6fd81ac426d68602b18db1714baa52aac845ba3dd9b3dd50997a5dceb00d6bee7fe060d0d8b253cf89eb038994108f197a2da
+	sha512sums = 4a9f3862330bdd71a6204610c24036626113c3be4da771df55937de2a62066562930fbd12e54b1f07ccbce9fa7ac1d64b4de025761d4a5e3f54d8161499bc92b
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix package version/release metadata and updates the corresponding source checksum in PKGBUILD. I did not see any new sources, build steps, network fetches, privilege changes, or packaging logic changes. This is a routine version refresh with no security-relevant behavior change in the reviewed hunk.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=4
+_lqxpatchrel=5
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.1.3.lqx3
+pkgver=7.1.4.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the PKGBUILD checksums and version metadata to match a new upstream Liquorix patch release. I did not see any new sources, build steps, install scripts, or privilege/network behavior introduced by this diff. The updated source remains HTTPS and pinned to a specific archive URL. Risk is low because this is a routine integrity hash refresh, though the new tarball itself is not inspected here beyond the checksum update.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            'f906bc182f2d4aed81b7529b18b6fd81ac426d68602b18db1714baa52aac845ba3dd9b3dd50997a5dceb00d6bee7fe060d0d8b253cf89eb038994108f197a2da')
+            '4a9f3862330bdd71a6204610c24036626113c3be4da771df55937de2a62066562930fbd12e54b1f07ccbce9fa7ac1d64b4de025761d4a5e3f54d8161499bc92b')