Review Results

Comment

The change is a version bump in .SRCINFO from 28.1 to 28.2 with no accompanying changes to sources, build logic, install scripts, or package metadata beyond pkgver. On its face this is low risk: .SRCINFO is generated metadata and does not itself introduce executable behavior or privilege/persistence mechanisms. I did not see any indicators of suspicious source URLs, build-time downloads, or packaging changes in the provided diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.1
+	pkgver = 28.2
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from OpenJFX 28.1 to 28.2, with the source URL still using HTTPS on the official upstream GitHub repository. No new build-time commands, scripts, or packaging behavior are introduced by this metadata-only diff. The updated checksum is expected for the new tarball and there are no obvious integrity or supply-chain red flags in the provided hunk.

@@ -27,13 +27,13 @@ pkgbase = java-openjfx
 	makedepends = unzip
 	makedepends = zip
 	options = !lto
-	source = java-openjfx-28.1.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+1.tar.gz
+	source = java-openjfx-28.2.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+2.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = f5ba9c75daee119e9355583984c76a602c6e8de2537cdf4a31dbb30ca0ad4f7c1ce530361cdcd4e7088cfe278ab40644088750d617058b491a45b40751df4813
+	b2sums = a9513ad80264ad3f32a5ba9e3c3cee3b810940e2f7430e338e73b567e1f22921da65af8a81f148db04f77ebc3115ea475e4d087ab48afea68b253c71120fbc88
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a one-line version bump in PKGBUILD from upstream tag 28+1 to 28+2, with no added build logic, downloads, scripts, permissions changes, or packaging behavior changes. Based on the provided diff hunk alone, this is a low-risk metadata update and does not introduce an obvious supply-chain or privilege-escalation concern.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+1'
+_tag='28+2'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

Low risk. The change only bumps the upstream OpenJFX tag from 28+1 to 28+2 and updates the corresponding b2sum for the source tarball. No new sources, scripts, install hooks, permissions changes, or build-time network behavior were introduced in this hunk. The security impact is limited to trusting a newer upstream release, which is normal for a version update and does not by itself indicate malicious behavior.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('f5ba9c75daee119e9355583984c76a602c6e8de2537cdf4a31dbb30ca0ad4f7c1ce530361cdcd4e7088cfe278ab40644088750d617058b491a45b40751df4813'
+b2sums=('a9513ad80264ad3f32a5ba9e3c3cee3b810940e2f7430e338e73b567e1f22921da65af8a81f148db04f77ebc3115ea475e4d087ab48afea68b253c71120fbc88'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'