Review Results

Comment

The change only bumps the package version in .SRCINFO from 7.1.8.lqx1 to 7.1.8.lqx2. No sources, build logic, install scripts, permissions, or dependencies are altered, and there are no new integrity or execution concerns visible in this diff. This appears to be a routine metadata update with negligible security impact.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.1.8.lqx1
+	pkgver = 7.1.8.lqx2
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only bumps the liquourix-package source archive from 7.1-10 to 7.1-11 and updates its SHA-512 checksum accordingly. The source remains on the official upstream GitHub repository over HTTPS, there are no new build-time fetches, scripts, or packaging changes, and no integrity red flags are introduced by this metadata-only update. I did not see any evidence of typosquatting, unpinned VCS sources, or suspicious extra artifacts in the provided diff.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.1-10.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.1-11.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = e7cb22351a5146b44e084e37dae3c46cf575fa974db40a1e21b0b7de2f222d163fa4ce803d5ab1273618a5353e777fbdb2e759bd45d34a8dc778b764e18da51e
+	sha512sums = 8df77b747541b671b9599b023a8c2b4a22027a22c89b9c2832f59add798400e3dc1b01f670fd6066c84a1e53441456e8d3cd863f0bc60f3f94a68e9de1505b86
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix patch release and pkgver, along with the corresponding source checksum. I did not find any new sources, build steps, install scripts, or privilege/persistence mechanisms introduced by this diff. The updated source remains an HTTPS GitHub tarball and the kernel source tarball is still verified via PGP. No security-relevant behavior changes are present in the reviewed hunk.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=10
+_lqxpatchrel=11
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.1.8.lqx1
+pkgver=7.1.8.lqx2
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the Liquorix patch release/version metadata and the corresponding SHA-512 checksum for the new upstream tarball. I did not find any new sources, build steps, network fetches, privilege changes, or packaging behavior changes in the diff. This is a routine integrity update with no security red flags in the reviewed hunk.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            'e7cb22351a5146b44e084e37dae3c46cf575fa974db40a1e21b0b7de2f222d163fa4ce803d5ab1273618a5353e777fbdb2e759bd45d34a8dc778b764e18da51e')
+            '8df77b747541b671b9599b023a8c2b4a22027a22c89b9c2832f59add798400e3dc1b01f670fd6066c84a1e53441456e8d3cd863f0bc60f3f94a68e9de1505b86')