Review Results

Comment

The only change in this .SRCINFO hunk is a package version bump from 7.1.8.lqx3 to 7.1.8.lqx4. No sources, checksums, build steps, install scripts, or permissions are altered, and there is no indication of added network access, privilege escalation, or persistence behavior. Based on the provided diff alone, this is a routine metadata update with no security impact.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.1.8.lqx3
+	pkgver = 7.1.8.lqx4
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only bumps the upstream liquorix-package tarball from 7.1-12 to 7.1-13 and updates the corresponding sha512 checksum in .SRCINFO. The source remains an HTTPS GitHub archive from the same upstream project, with no new sources, scripts, or build logic introduced. This is a routine metadata refresh with no apparent security impact.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.1-12.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.1-13.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = 0579e38eddba1c188dcddd937b0016f9358c9f04814329989e00fafc48991f20ebcb75afba2e20b0c81b50c24dfc1e99d37dab2d26e92abe6b4d733988ff269f
+	sha512sums = 69ce1178237b035729dc1d63d2df877d0f1864b5b7818e93ca0e15fa828715a4c94a7323951ae927283664db182d0d46c6563eb88f1d65d1fd15ae6f8b85ded1
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix patch release/version and updates the corresponding source checksum. No new sources, commands, install scripts, or packaging behavior are introduced, and the source URL remains the same official GitHub archive over HTTPS. I found no security-relevant behavior change in this diff.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=12
+_lqxpatchrel=13
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.1.8.lqx3
+pkgver=7.1.8.lqx4
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change is a straightforward checksum/version bump for the Liquorix patch tarball (7.1-12 -> 7.1-13, pkgver lqx3 -> lqx4). No new sources, scripts, install hooks, or build logic were introduced, and the only security-relevant effect is that PKGBUILD now verifies a different upstream archive. I did not see any indication of malicious content in this diff alone.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            '0579e38eddba1c188dcddd937b0016f9358c9f04814329989e00fafc48991f20ebcb75afba2e20b0c81b50c24dfc1e99d37dab2d26e92abe6b4d733988ff269f')
+            '69ce1178237b035729dc1d63d2df877d0f1864b5b7818e93ca0e15fa828715a4c94a7323951ae927283664db182d0d46c6563eb88f1d65d1fd15ae6f8b85ded1')