Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 28.2 to 28.3, updating the upstream GitHub tarball URL and its checksum. The source remains HTTPS and points to the official openjdk/jfx repository tag archive, with no new build steps, scripts, or packaging behavior introduced. I do not see any supply-chain or privilege-escalation concern in this diff alone.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.2
+	pkgver = 28.3
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO: the GitHub tarball URL moves from 28+2 to 28+3 and the corresponding b2sum is updated. The source remains HTTPS and points to the official openjdk/jfx repository, with no new sources, scripts, or packaging logic introduced. Since this is only metadata and does not add build-time execution or privilege-related behavior, I see no security concern in the diff provided.

@@ -27,13 +27,13 @@ pkgbase = java-openjfx
 	makedepends = unzip
 	makedepends = zip
 	options = !lto
-	source = java-openjfx-28.2.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+2.tar.gz
+	source = java-openjfx-28.3.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+3.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = a9513ad80264ad3f32a5ba9e3c3cee3b810940e2f7430e338e73b567e1f22921da65af8a81f148db04f77ebc3115ea475e4d087ab48afea68b253c71120fbc88
+	b2sums = d0f26a1faa231ddd37dc98a9878d39025d3a470ac966c8d7b01b799daaf435921b273daf9850f2ff8d2ee510de29152f5d0aee5f69594baf12c7a269da17bd7a
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a one-line version bump in PKGBUILD from _tag='28+2' to _tag='28+3'. No new sources, build steps, install scripts, permissions, or packaging logic were introduced. This appears to be a routine upstream release update with no security-relevant behavior change in the reviewed hunk.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+2'
+_tag='28+3'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

Risk is low. The change only bumps the upstream OpenJFX tag from 28+2 to 28+3 and updates the corresponding b2sum for the first source artifact. There are no new sources, no build-script logic changes, no network-at-build-time additions, and no install/systemd/persistence-related files involved in this diff. The security impact is limited to trusting a newer upstream release artifact, which is normal for a version update and does not by itself indicate malicious behavior.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('a9513ad80264ad3f32a5ba9e3c3cee3b810940e2f7430e338e73b567e1f22921da65af8a81f148db04f77ebc3115ea475e4d087ab48afea68b253c71120fbc88'
+b2sums=('d0f26a1faa231ddd37dc98a9878d39025d3a470ac966c8d7b01b799daaf435921b273daf9850f2ff8d2ee510de29152f5d0aee5f69594baf12c7a269da17bd7a'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'