Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 28.4 to 28.5, updating the upstream GitHub tarball URL and its checksum. The source remains HTTPS and points to the official OpenJDK/jfx repository tag, with no new scripts, patches, install hooks, or build-time network behavior introduced by this diff. No security-relevant red flags are visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.4
+	pkgver = 28.5
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is limited to .SRCINFO metadata and updates the upstream tarball version from 28+4 to 28+5 with a corresponding checksum refresh. The source remains an HTTPS GitHub release archive from the official openjdk/jfx repository, and there are no new build steps, scripts, or privilege-related changes introduced by this diff. No supply-chain red flags are evident in the provided hunk.

@@ -27,13 +27,13 @@ pkgbase = java-openjfx
 	makedepends = unzip
 	makedepends = zip
 	options = !lto
-	source = java-openjfx-28.4.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+4.tar.gz
+	source = java-openjfx-28.5.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+5.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = 05b1402e252c9496a95ac85917efb73740b9c124cc91d0e53ae70cfa2c224f81efa2f15906358e0bb10d87cfb0ff117074b09ba55592e3bae082414ac510b091
+	b2sums = 9922c3c35c25d83d8280442b91c000122b28e46c6473668eda0b643f9a7e4bba5b06115e140574c0f3c61d4de57d94f69d0332a65b3606b971124f91fa2d94f8
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change only bumps the upstream tag from 28+4 to 28+5 in PKGBUILD, which is a routine version update. No new sources, build steps, install scripts, permissions, or packaging behaviors are introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+4'
+_tag='28+5'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change only bumps the upstream OpenJFX tag from 28+4 to 28+5 and updates the corresponding b2sum for the first source tarball. I did not find any new build-time execution, network access, privilege changes, install-script changes, or suspicious additional sources. This appears to be a routine integrity update to track a new upstream release artifact.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('05b1402e252c9496a95ac85917efb73740b9c124cc91d0e53ae70cfa2c224f81efa2f15906358e0bb10d87cfb0ff117074b09ba55592e3bae082414ac510b091'
+b2sums=('9922c3c35c25d83d8280442b91c000122b28e46c6473668eda0b643f9a7e4bba5b06115e140574c0f3c61d4de57d94f69d0332a65b3606b971124f91fa2d94f8'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'