Review Results

Comment

The change only bumps pkgver in .SRCINFO from 7.1.9.lqx2 to 7.1.10.lqx1. No sources, checksums, build steps, install scripts, or permissions are altered, and there are no new integrity or execution red flags in the provided diff. This is a routine metadata update with no apparent security impact.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.1.9.lqx2
+	pkgver = 7.1.10.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is a routine source-version bump in .SRCINFO from liquorix-package 7.1-15 to 7.1-16, with the corresponding checksum updated. The upstream source remains the same GitHub project, HTTPS is used, and there are no new build-time commands, scripts, or privilege-related artifacts introduced by this diff. No security-relevant red flags are visible in the provided hunk.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.1-15.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.1-16.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = a6bbde83ecdac2dd57db51656bdb5a8a955bfd5e0073e459e14fc27aec3b8a4cdf412f7356cec5fe479827d42b02d32cf8bd0756e6081357087eb6856ccc1e92
+	sha512sums = 6c9d690730c704bc8bfd9a0936fb1f5af459c03796fa6fe6d2085d0eab75c5b54c520ba8acd54005b0dc228b4b925a05230bf1a1e45660f37ecd7f61f08c5264
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a straightforward version bump in PKGBUILD metadata: _lqxpatchrel 15->16 and pkgver 7.1.9.lqx2->7.1.10.lqx1. No build logic, source URLs, install scripts, permissions, or packaging behavior changed in the provided hunk. Based on this diff alone, there is no evidence of supply-chain risk or malicious behavior.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=15
+_lqxpatchrel=16
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.1.9.lqx2
+pkgver=7.1.10.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the recorded SHA-512 checksum for the Liquorix patch tarball, alongside the corresponding package version/patch release bump. I did not find any new sources, build steps, network fetches, privilege changes, or install-time behavior introduced by this diff. The security impact is limited to integrity verification of an upstream-hosted source archive; assuming the new checksum matches the intended upstream release, this is a routine maintenance update.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            'a6bbde83ecdac2dd57db51656bdb5a8a955bfd5e0073e459e14fc27aec3b8a4cdf412f7356cec5fe479827d42b02d32cf8bd0756e6081357087eb6856ccc1e92')
+            '6c9d690730c704bc8bfd9a0936fb1f5af459c03796fa6fe6d2085d0eab75c5b54c520ba8acd54005b0dc228b4b925a05230bf1a1e45660f37ecd7f61f08c5264')