Review Results

Comment

The change only bumps pkgver in .SRCINFO from 28.0 to 28.1. No build logic, sources, checksums, install scripts, or packaging behavior changed in the reviewed hunk. On its face this is a metadata-only version update with no security impact visible from the diff provided.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.0
+	pkgver = 28.1
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

Risk is low. This change only bumps the package version from 28.0 to 28.1 and updates the GitHub release tarball URL plus its BLAKE2 checksum in .SRCINFO. There are no new sources, no build-script changes, no install hooks, and no signs of network-at-build, privilege escalation, or persistence mechanisms. The source remains an HTTPS GitHub release archive for the upstream OpenJDK/JFX project, so the integrity posture is unchanged aside from the expected checksum refresh.

@@ -27,13 +27,13 @@ pkgbase = java-openjfx
 	makedepends = unzip
 	makedepends = zip
 	options = !lto
-	source = java-openjfx-28.0.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+0.tar.gz
+	source = java-openjfx-28.1.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+1.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = 985b984aa854394c0d7b4bd1eaa24684c580c37396e4e57a3ede7a08db21b30f87f2230627950beb3f0a0cb8439ab665d27ca38f182ceb23413906e70b51ef1d
+	b2sums = f5ba9c75daee119e9355583984c76a602c6e8de2537cdf4a31dbb30ca0ad4f7c1ce530361cdcd4e7088cfe278ab40644088750d617058b491a45b40751df4813
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change only bumps the upstream tag from 28+0 to 28+1, which updates the source version used by the package. There are no new build steps, no added sources, no install-script changes, and no packaging or privilege-related behavior introduced in this diff. Based on the provided hunk alone, this is low risk.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+0'
+_tag='28+1'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

Low risk change. The diff only updates the package version/tag and the checksum for one source artifact, plus removes a local CFLAGS workaround in build(). There are no new sources, no network-fetching logic, no install-script or systemd changes, and no privilege/persistence mechanisms. The checksum update is expected for a new upstream release artifact and does not by itself indicate tampering. The build flag removal could affect build success, but it is not a security issue in this change.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('985b984aa854394c0d7b4bd1eaa24684c580c37396e4e57a3ede7a08db21b30f87f2230627950beb3f0a0cb8439ab665d27ca38f182ceb23413906e70b51ef1d'
+b2sums=('f5ba9c75daee119e9355583984c76a602c6e8de2537cdf4a31dbb30ca0ad4f7c1ce530361cdcd4e7088cfe278ab40644088750d617058b491a45b40751df4813'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'

Comment

The change only removes a build-time CFLAGS workaround (`-Wno-error=implicit-function-declaration`) from PKGBUILD. This does not introduce any new code execution, network access, privilege escalation, persistence, or packaging integrity risks. The impact is limited to potential build failures or stricter compiler diagnostics, not a security issue.

@@ -102,8 +102,6 @@ build() {
   # Workaround for situation where the linker treats whitespace as arguments
   export LDFLAGS="${LDFLAGS//+([[:space:]]|[[:blank:]])/ }"
 
-  export CFLAGS+=" -Wno-error=implicit-function-declaration"
-
   "${_gradle[@]}" --no-daemon zips
 }