Review Results

Comment

The change is a simple version bump in .SRCINFO from 7.2.pf2 to 7.2.pf3 with no added sources, build logic, install scripts, or packaging metadata changes. On its face this does not introduce any new security risk; it only reflects an upstream version update. I did not see evidence in the provided diff of network fetches, privilege escalation, persistence mechanisms, or integrity regressions.

@@ -1,6 +1,6 @@
 pkgbase = linux-pf
 	pkgdesc = pf-kernel
-	pkgver = 7.2.pf2
+	pkgver = 7.2.pf3
 	pkgrel = 1
 	url = https://pfkernel.natalenko.name
 	arch = x86_64

Comment

The change is limited to bumping the upstream kernel source tarball from one Codeberg commit to another and updating the corresponding checksum in .SRCINFO. The source remains HTTPS on the project’s official hosting, there are no new build-time downloads, scripts, install hooks, or packaging changes, and the diff does not introduce any obvious integrity or privilege-escalation concerns. Risk is low; the only caveat is the usual trust in the new upstream commit itself, but that is outside what this metadata-only change can establish.

@@ -26,10 +26,10 @@ pkgbase = linux-pf
 	makedepends = zstd
 	options = !debug
 	options = !strip
-	source = https://codeberg.org/pf-kernel/linux/archive/e9705a97e2f4a4c595dc7da6e111874d9726ede5.tar.gz
+	source = https://codeberg.org/pf-kernel/linux/archive/753c62f6eb1312a230397329d90061c1bac1d98b.tar.gz
 	source = config
 	b2sums = SKIP
-	b2sums = eb41395e84a7c75d07039d11dbfc99759328ba05e48941dc3013db0e2dceb51038a71c29d84f260c15ab1d7aea7ed027ec81235938c2073f8f1890b08f51d66e
+	b2sums = af0be93b85eb495a44ed2a5cdd7453314a0386b267dd050b86a77907615222ba527844dd318d6ac0ae5a1e4d4aee9034948a40bff833bd8646bcba646fdf3b6e
 
 pkgname = linux-pf
 	pkgdesc = The pf-kernel and modules

Comment

The change is a routine upstream version bump for a kernel package: it updates the pinned source revision, package version, and corresponding B2 checksum for the tarball fetched over HTTPS from the upstream Codeberg repository. There are no new build-time commands, no added network fetches outside source=(), no install-script or systemd changes, and no privilege/persistence red flags in this diff. Risk is low because the only security-relevant aspect is trusting the new upstream commit and checksum, which is expected for a source update.

@@ -3,8 +3,8 @@
 pkgbase="linux-pf"
 _suffix=""
 pkgname=(${pkgbase}${_suffix} ${pkgbase}-headers${_suffix})
-_rev=e9705a97e2f4a4c595dc7da6e111874d9726ede5
-pkgver=7.2.pf2
+_rev=753c62f6eb1312a230397329d90061c1bac1d98b
+pkgver=7.2.pf3
 pkgrel=1
 pkgdesc="pf-kernel"
 arch=(x86_64)

Comment

The change is a straightforward upstream version bump in PKGBUILD: it updates the pinned commit (_rev), pkgver, and the corresponding b2sum for the source tarball. The source remains an HTTPS Codeberg archive URL, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes. No suspicious metadata or persistence mechanisms were introduced in this diff. Risk is therefore very low.

@@ -15,7 +15,7 @@ options=(!debug !strip)
 source=(https://codeberg.org/pf-kernel/linux/archive/${_rev}.tar.gz
 		config)
 b2sums=(SKIP
-		'eb41395e84a7c75d07039d11dbfc99759328ba05e48941dc3013db0e2dceb51038a71c29d84f260c15ab1d7aea7ed027ec81235938c2073f8f1890b08f51d66e')
+		'af0be93b85eb495a44ed2a5cdd7453314a0386b267dd050b86a77907615222ba527844dd318d6ac0ae5a1e4d4aee9034948a40bff833bd8646bcba646fdf3b6e')
 
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=${pkgbase}

Comment

The change is limited to the generated kernel config banner/version text, updating the pf release label from pf2 to pf3 and the recorded GCC build date. There are no changes to sources, build commands, install scripts, permissions, network access, or runtime behavior. This looks like a benign metadata refresh with no security impact in the reviewed hunk.

@@ -1,8 +1,8 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 7.2.0-pf2 Kernel Configuration
+# Linux/x86 7.2.0-pf3 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.1.1 20260625"
+CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.1.1 20260725"
 CONFIG_CC_IS_GCC=y
 CONFIG_GCC_VERSION=160101
 CONFIG_CLANG_VERSION=0