Review Results

Comment

The only change in this .SRCINFO hunk is a routine version bump from 7.1.4.lqx1 to 7.1.5.lqx1. No sources, checksums, build steps, dependencies, install scripts, or permissions changed in the reviewed diff, so there is no evident security impact from this change alone.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.1.4.lqx1
+	pkgver = 7.1.5.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only bumps the liquourix-package source tarball from 7.1-5 to 7.1-6 and updates its checksum in .SRCINFO. The source remains an HTTPS GitHub archive from the same upstream project, with no new hosts, no build-time fetches, no script changes, and no packaging metadata that would suggest privilege escalation or persistence. Based on the diff alone, this is a routine version refresh with low risk.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.1-5.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.1-6.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = 4a9f3862330bdd71a6204610c24036626113c3be4da771df55937de2a62066562930fbd12e54b1f07ccbce9fa7ac1d64b4de025761d4a5e3f54d8161499bc92b
+	sha512sums = 53c6d7509b7d851d1713b01a7650b74993df6828c6c70fa5f685c12cd69f5d8cbaa193578a4cd30b5eef7f560b17bacd76977be7ff0b06f3262ad168dc701885
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix patch release and kernel package version, along with the expected SHA-512 checksum update for the new upstream tarball. No new sources, scripts, build steps, permissions changes, or packaging logic were introduced. This is a routine version refresh with no security-relevant behavior change in the diff reviewed.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=5
+_lqxpatchrel=6
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.1.4.lqx1
+pkgver=7.1.5.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change is limited to bumping the Liquorix kernel package version/release metadata and updating the sha512 checksum for the corresponding source tarball/patch. I do not see any new execution paths, network fetches outside the existing source array, privilege changes, or packaging logic changes. The only security-relevant question is whether the new checksum matches the intended upstream artifact, but within this diff there is no indication of tampering or a suspicious source change.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            '4a9f3862330bdd71a6204610c24036626113c3be4da771df55937de2a62066562930fbd12e54b1f07ccbce9fa7ac1d64b4de025761d4a5e3f54d8161499bc92b')
+            '53c6d7509b7d851d1713b01a7650b74993df6828c6c70fa5f685c12cd69f5d8cbaa193578a4cd30b5eef7f560b17bacd76977be7ff0b06f3262ad168dc701885')