Review Results

Comment

The change only bumps pkgver in .SRCINFO from 7.1.8.lqx4 to 7.1.9.lqx1. No sources, build logic, install scripts, permissions, or dependencies are altered in the reviewed diff. On its face this is a routine metadata/version update with no security-relevant behavior change visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.1.8.lqx4
+	pkgver = 7.1.9.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is a routine source version bump in .SRCINFO from liquorix-package 7.1-13 to 7.1-14, with the corresponding checksum updated. The upstream source remains the same official GitHub repository, kernel sources are still pinned and verified via PGP, and there are no new execution paths, install scripts, or privilege-related artifacts introduced by this diff. No security-relevant red flags are evident in the provided hunk.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.1-13.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.1-14.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = 69ce1178237b035729dc1d63d2df877d0f1864b5b7818e93ca0e15fa828715a4c94a7323951ae927283664db182d0d46c6563eb88f1d65d1fd15ae6f8b85ded1
+	sha512sums = 9c88665b576e28568cd2d3e96ad9023471d6c56f22e77430c91fd4e4d89c845ab21e197e233caec992f35b8cef52431f973eddb7a4f9a3a00610429f82f0b487
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a routine version bump in PKGBUILD: it updates the Liquorix patch release number, package version, and the corresponding sha512 checksum for the upstream tarball. I did not see any new sources, build-time network fetches, privilege escalation, install scripts, or packaging logic changes. The only security-relevant effect is that the package now trusts a different upstream release artifact, which is expected for a version update and is still pinned by checksum and HTTPS source URLs. No obvious supply-chain or persistence red flags in this diff.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=13
+_lqxpatchrel=14
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.1.8.lqx4
+pkgver=7.1.9.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change is limited to version metadata and an updated SHA-512 checksum for an existing source artifact. I did not find any new sources, build-time network fetches, privilege changes, install-script changes, or other execution paths introduced by this diff. The checksum update is expected when the upstream patch/source content changes between package versions, and the package still uses HTTPS and pinned source integrity checks. No security-relevant red flags are evident in this hunk alone.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            '69ce1178237b035729dc1d63d2df877d0f1864b5b7818e93ca0e15fa828715a4c94a7323951ae927283664db182d0d46c6563eb88f1d65d1fd15ae6f8b85ded1')
+            '9c88665b576e28568cd2d3e96ad9023471d6c56f22e77430c91fd4e4d89c845ab21e197e233caec992f35b8cef52431f973eddb7a4f9a3a00610429f82f0b487')