Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 28.3 to 28.4. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were modified in the provided diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.3
+	pkgver = 28.4
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from OpenJFX 28+3 to 28+4, with the corresponding source tarball URL and checksum updated. The source remains on the official GitHub release archive over HTTPS, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Based on the provided hunk alone, this looks low risk.

@@ -27,13 +27,13 @@ pkgbase = java-openjfx
 	makedepends = unzip
 	makedepends = zip
 	options = !lto
-	source = java-openjfx-28.3.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+3.tar.gz
+	source = java-openjfx-28.4.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+4.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = d0f26a1faa231ddd37dc98a9878d39025d3a470ac966c8d7b01b799daaf435921b273daf9850f2ff8d2ee510de29152f5d0aee5f69594baf12c7a269da17bd7a
+	b2sums = 05b1402e252c9496a95ac85917efb73740b9c124cc91d0e53ae70cfa2c224f81efa2f15906358e0bb10d87cfb0ff117074b09ba55592e3bae082414ac510b091
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a one-line version bump in PKGBUILD from _tag '28+3' to '28+4'. No build logic, source URLs, checksums, install scripts, permissions, or packaging behavior changed. This does not introduce any new security-relevant behavior and appears to be a routine upstream version update.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+3'
+_tag='28+4'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change only bumps the upstream OpenJFX tag from 28+3 to 28+4 and updates the corresponding b2sum for the tarball. The source remains the official GitHub OpenJDK/jfx release archive over HTTPS, with no new build-time network fetches, scripts, privilege changes, or packaging behavior changes. I did not see any suspicious new sources or install-time execution introduced by this diff. Risk is low and limited to the normal integrity check update for a new upstream release.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('d0f26a1faa231ddd37dc98a9878d39025d3a470ac966c8d7b01b799daaf435921b273daf9850f2ff8d2ee510de29152f5d0aee5f69594baf12c7a269da17bd7a'
+b2sums=('05b1402e252c9496a95ac85917efb73740b9c124cc91d0e53ae70cfa2c224f81efa2f15906358e0bb10d87cfb0ff117074b09ba55592e3bae082414ac510b091'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'