Review Results

Comment

The change is a straightforward version bump in .SRCINFO: updated pkgver/provides/dependency versions and release tarball checksums for the upstream ZFS 2.4.4 release. The source URLs remain HTTPS and point to the official upstream GitHub release, the tarball is still accompanied by a detached signature, and there are no new build-time commands, scripts, or privilege-related artifacts introduced by this diff. No security-relevant red flags are visible in the provided hunk.

@@ -1,25 +1,25 @@
 pkgbase = zfs-dkms
 	pkgdesc = Kernel modules for the Zettabyte File System.
-	pkgver = 2.4.3
+	pkgver = 2.4.4
 	pkgrel = 1
 	url = https://zfsonlinux.org/
 	arch = any
 	license = CDDL
-	provides = ZFS-MODULE=2.4.3
-	provides = SPL-MODULE=2.4.3
+	provides = ZFS-MODULE=2.4.4
+	provides = SPL-MODULE=2.4.4
 	provides = zfs
-	source = https://github.com/zfsonlinux/zfs/releases/download/zfs-2.4.3/zfs-2.4.3.tar.gz
-	source = https://github.com/zfsonlinux/zfs/releases/download/zfs-2.4.3/zfs-2.4.3.tar.gz.asc
+	source = https://github.com/zfsonlinux/zfs/releases/download/zfs-2.4.4/zfs-2.4.4.tar.gz
+	source = https://github.com/zfsonlinux/zfs/releases/download/zfs-2.4.4/zfs-2.4.4.tar.gz.asc
 	source = 0001-only-build-the-module-in-dkms.conf.patch
 	validpgpkeys = 4F3BA9AB6D1F8D683DC2DFB56AD860EED4598027
 	validpgpkeys = C33DF142657ED1F7C328A2960AB9E991C6AF658B
-	sha256sums = 1f08f2d154f5189b5f1382848a32667b3d34066145b474c49cd3d41a5fba59a7
+	sha256sums = 2a3c70d55a37cc71618a95a60e81ad66530201eb118d37741dc92efcf848c8b1
 	sha256sums = SKIP
 	sha256sums = 8d5c31f883a906ab42776dcda79b6c89f904d8f356ade0dab5491578a6af55a5
-	b2sums = 9f9c58c31a99bc50cfa93a8a924c09a278e96706986afe09bd1fd02e3ce82fa6bee5d4b27542db76134e014ee09ce7c2c723eda5c98c7c6dab5f63aedb83ed47
+	b2sums = dd18ce2274009c723e5e331de4eb68d435f161807cd4d7cc129b37ebe196ccd072fa8eb43514bdebefb6b3067a9c0e742bc4128975bb3740f6be96acf6c31b0b
 	b2sums = SKIP
 	b2sums = 58dc2494e71b50833d44c126b72acad52e9817626542afbc245b7ba82009e8c8252ebde6023592aac42d9942207e7655c0a421da9067fbdd619746ebc372d791
 
 pkgname = zfs-dkms
-	depends = zfs-utils=2.4.3
+	depends = zfs-utils=2.4.4
 	depends = dkms

Comment

The change is a simple version bump in PKGBUILD from 2.4.3 to 2.4.4 with no modifications to sources, checksums, build steps, install scripts, permissions, or dependencies. Based on the provided diff hunk alone, there are no security-relevant changes to review.

@@ -3,7 +3,7 @@
 # Contributor: Iacopo Isimbaldi <isiachi@rhye.it>
 
 pkgname=zfs-dkms
-pkgver=2.4.3
+pkgver=2.4.4
 pkgrel=1
 pkgdesc="Kernel modules for the Zettabyte File System."
 arch=('any')

Comment

The change only updates the pinned checksums for the upstream ZFS release tarball in PKGBUILD. Source remains the official GitHub release URL over HTTPS, and there are no new build steps, scripts, or privilege/persistence mechanisms introduced by this diff. I did not see any indication of a malicious source swap or build-time code execution in the provided hunk. Risk is low, though checksum changes always warrant verifying they correspond to the intended upstream release artifact.

@@ -14,10 +14,10 @@ provides=("ZFS-MODULE=${pkgver}" "SPL-MODULE=${pkgver}")
 provides+=('zfs')
 source=("https://github.com/zfsonlinux/zfs/releases/download/zfs-${pkgver}/zfs-${pkgver}.tar.gz"{,.asc}
         "0001-only-build-the-module-in-dkms.conf.patch")
-sha256sums=('1f08f2d154f5189b5f1382848a32667b3d34066145b474c49cd3d41a5fba59a7'
+sha256sums=('2a3c70d55a37cc71618a95a60e81ad66530201eb118d37741dc92efcf848c8b1'
             'SKIP'
             '8d5c31f883a906ab42776dcda79b6c89f904d8f356ade0dab5491578a6af55a5')
-b2sums=('9f9c58c31a99bc50cfa93a8a924c09a278e96706986afe09bd1fd02e3ce82fa6bee5d4b27542db76134e014ee09ce7c2c723eda5c98c7c6dab5f63aedb83ed47'
+b2sums=('dd18ce2274009c723e5e331de4eb68d435f161807cd4d7cc129b37ebe196ccd072fa8eb43514bdebefb6b3067a9c0e742bc4128975bb3740f6be96acf6c31b0b'
         'SKIP'
         '58dc2494e71b50833d44c126b72acad52e9817626542afbc245b7ba82009e8c8252ebde6023592aac42d9942207e7655c0a421da9067fbdd619746ebc372d791')
 validpgpkeys=('4F3BA9AB6D1F8D683DC2DFB56AD860EED4598027'  # Tony Hutter (GPG key for signing ZFS releases) <hutter2@llnl.gov>