Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.5.1 to 2.5.2. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust were changed in the reviewed diff. On its face this is a routine upstream version update with no security red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = lyx
 	pkgdesc = An advanced WYSIWYM document processor & LaTeX front-end
-	pkgver = 2.5.1
+	pkgver = 2.5.2
 	pkgrel = 1
 	url = https://www.lyx.org
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from lyx 2.5.1 to 2.5.2, with the corresponding tarball checksum updated. The source remains the official upstream HTTPS release URL, the signature file is still present, and the PGP key pinning is unchanged. No new build steps, scripts, privileges, or persistence mechanisms are introduced by this metadata-only update. Risk is therefore minimal.

@@ -22,11 +22,11 @@ pkgbase = lyx
 	options = emptydirs
 	options = !lto
 	backup = etc/lyx/lyxrc.dist
-	source = https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.1.tar.xz
-	source = https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.1.tar.xz.sig
+	source = https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.2.tar.xz
+	source = https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.2.tar.xz.sig
 	source = lyxrc.dist
 	validpgpkeys = FE66471B43559707AFDAD955DE7A44FAC7FB382D
-	sha512sums = 77c3bd1deeb2c6d174d21ee9620654ac82d0695fbeba22b653819129d2d27f2a999e28cdff444c1e9fd64a0a7fae5ce0effa69818bce2aea1b708f7a27858e54
+	sha512sums = 301d8e4aa63bcf2cdaadee2a5dbbe2b5bf33d9ea6dd767db2e59c07fde83f1191d747d883adaf22690ccc0aed03e438ea2dbff19a45dcdadf5fab0d1b4f5fb28
 	sha512sums = SKIP
 	sha512sums = eef777cf6033a7b1e04700f33068b07309f8d5c6931c16927305dafb3a00fd46d4b536149349ab56b7455e7dea195c8889da2b6fbf9caa9e76bc0557f9358bc3
 

Comment

The change only bumps pkgver from 2.5.1 to 2.5.2 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or dependency changes are introduced in the provided diff hunk. Based on this hunk alone, there are no security-relevant concerns.

@@ -3,7 +3,7 @@
 # Contributor: Ronald van Haren <ronald.archlinux.org>
 # Contributor: Jason Chu <jason@archlinux.org>
 pkgname=lyx
-pkgver=2.5.1
+pkgver=2.5.2
 pkgrel=1
 pkgdesc="An advanced WYSIWYM document processor & LaTeX front-end"
 arch=(x86_64)

Comment

Risk is low. The change only bumps pkgver from 2.5.1 to 2.5.2 and updates the SHA-512 checksum for the upstream tarball. The source remains an HTTPS upstream release URL, the detached signature is still verified with the same pinned PGP key, and there are no new build-time commands, scripts, or packaging changes. No supply-chain or persistence red flags are introduced by this diff.

@@ -20,7 +20,7 @@ options=('emptydirs' '!lto')
 source=(https://ftp.lip6.fr/pub/${pkgname}/stable/${pkgver::4}x/${pkgname}-${pkgver}.tar.xz{,.sig}
 	lyxrc.dist)
 validpgpkeys=('FE66471B43559707AFDAD955DE7A44FAC7FB382D') # LyX Release Manager (Signing LyX tarballs and binaries) <sanda@lyx.org>
-sha512sums=('77c3bd1deeb2c6d174d21ee9620654ac82d0695fbeba22b653819129d2d27f2a999e28cdff444c1e9fd64a0a7fae5ce0effa69818bce2aea1b708f7a27858e54'
+sha512sums=('301d8e4aa63bcf2cdaadee2a5dbbe2b5bf33d9ea6dd767db2e59c07fde83f1191d747d883adaf22690ccc0aed03e438ea2dbff19a45dcdadf5fab0d1b4f5fb28'
             'SKIP'
             'eef777cf6033a7b1e04700f33068b07309f8d5c6931c16927305dafb3a00fd46d4b536149349ab56b7455e7dea195c8889da2b6fbf9caa9e76bc0557f9358bc3')